PT-2026-106726

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

Debian dsa-6548 : node-shell-quote - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6548 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/securit...

RockyLinux 10 : vim (RLSA-2026:75769)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly...

AlmaLinux 10 : vim (ALSA-2026:75769)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fr...

Linux Distros Unpatched Vulnerability : CVE-2026-105326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mail...

PT-2026-106300

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description An OS command injection flaw exists in the UploadFirmwareFile Handler component. A remote, unauthenticated attacker can exploit this by manipulating the file name parameter within the...

PT-2026-106354

Memory corruption when processing draw objects of incorrect type during graphics command list execution...

Command Injection Vulnerabilities in Brocade Fabric OS Management Interface and Authentication Workflows

: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...

Command Injection vulnerability exists in Brocade Fabric OS REST API management interface

: A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

OS Command Injection via Fabric Synchronization

: An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys...

Command Injection in Security Certificate Management Subsystem

: An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution...

Brocade Fabric OS command injection vulnerability in PAM session cleanup routines (CVE-2026-94579)

: An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

Command injection vulnerability exists in the REST API management interface of Brocade Fabric OS (CVE-2026-94581)

: An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

Privilege escalation vulnerability exists in the internal Command-Line Interface of Fabric OS (CVE-2026-94577)

: A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypas...

Authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS

: An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these...

An input validation and command injection vulnerability exists in the firmware download and upgrade component of Brocade Fabric OS

: Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

Command Injection vulnerability exists in the Brocade Fabric OS WebTools management (CVE-2026-94586)

: A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using...

Authenticated Privilege Escalation via Command Injection in Timezone Configuration Processing

: An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

Local Privilege Escalation via Command Injection in Brocade Fabric OS Diagnostic Utility

: An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A...

Command Injection via Unsanitized Remote Brocade Fabric OS Configuration Import Utility

: An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host...