EUVD-2026-86014

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-96515

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

ROS-20260924-73-0001

The vulnerability in Dracut is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

USN-8809-1: libgit2 vulnerability

Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly handled certain repository URLs when using the SSH transport. A remote attacker could possibly use this issue to execute arbitrary commands...

Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

EUVD-2026-84947

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...

EUVD-2026-84972

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-96456: Concurrent Execution using Shared Resource with Improper Synchronization

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-17102

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16346

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-18137

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a flaw that could allow a remote attacker to execute arbitrary ESQL commands . The root cause is the improper neutralization of special elements used in an ESQL command. The vulnerability has a HIGH base severity (CVSS ...

CVE-2026-18137 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...

CVE-2026-16469 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

NPM vm2 Arbitrary Command Execution

The vulnerability of the NPM package manager’s vm2 library is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-16346: Improper Authorization

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

PT-2026-97093

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper neutralization of special elements used in an ESQL command allows a remote attacker to execute arbitrary ESQL commands. ESQL Extend...

EUVD-2026-84213

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

SUSE CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

Malicious code in @nimbusedge2/xa (npm)

Source: amazon-inspector 537505221bc3cd73b0d5a60062d6ad127211b2d1be1f1cdfdac13053e2224a11 package.json declares a preinstall lifecycle script that runs an interactive bash reverse shell to the hardcoded host 147.93.157.202.nip.io on TCP port 8080 and pipes the shell's output through curl to...