Ivanti Sentry CVE-2026-10520 unauthenticated OS command injection

CVE-2026-10520: Ivanti Sentry before R10.5.2, R10.6.2, R10.7.1 exposes /mics/api/v2/sentry/mics-config/handleMessage without authentication. An attacker can inject OS commands via the commandexec MICS message and achieve root-level remote code execution. !/usr/bin/env python3 -- coding: utf-8 --...

CVE-2026-26009: Improper Neutralization of Special Elements used in an OS Command

Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerization. Any user with template.create or...