187220 matches found
PT-2026-106746
Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...
CVE-2026-79815: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevated privileges on the affected Windows endpoint...
CVE-2026-85523: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...
PT-2026-107333
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper input validation leads to the improper neutralization of special elements used in an OS command, allowing a remote authenticated attacker to perform code injection and execute...
CVE-2026-79813: Improper Privilege Management
A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands with elevated privileges on the affected system, if certain conditions outside of the attacker's control are met...
CVE-2026-105841: Improper Neutralization of Special Elements used in an OS Command
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...
PT-2026-107112
Name of the Vulnerable Software and Affected Versions Dell Command | Configure DCC versions prior to 5.2.3.35 Description An issue exists due to the use of a hard-coded cryptographic key. An unauthenticated attacker with local access could exploit this to cause information disclosure...
PT-2026-107199
Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An authenticated path traversal vulnerability exists in the command line interface. This flaw allows a low-privileged authenticated remote attacker to execute arbitrary code...
PT-2026-107255
Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...
PT-2026-106750
Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9 Description The press key tool in ufo/client/mcp/http servers/mobile mcp server.py accepts a free-form key code parameter and passes it to adb shell input keyevent. The adb client joins the arguments into ...
CVE-2026-103778: Use of Hard-coded Cryptographic Key
Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...
PT-2026-107330
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Remote authenticated attackers can execute arbitrary OS commands due to improper neutralization of special elements used in an OS command, a condition known as code injection. This...
CVE-2026-34498: Improper Input Validation
Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...
PT-2026-107257
Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...
PT-2026-107108
Dell Command | Configure DCC, versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...
PT-2026-106736
Name of the Vulnerable Software and Affected Versions Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator versions prior to 2.1 Description An OS command injection flaw exists in the shell-based temporary-file cleanup instructions. An attacker can execute arbitrary command...
PT-2026-106354
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Memory corruption occurs when the system processes draw objects of an incorrect type during the execution of a graphics command list. Recommendations At the...
PT-2026-106355
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A transient Denial of Service DOS occurs when processing a continuous receive command that includes a zero-sized global configuration override. Recommendations A...
PT-2026-106738
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type text and launch app tools in ufo/client/mcp/http servers/mobile mcp server.py pass the authenticated caller-controlled text and package name parameters into adb shell comma...