Command Injection vulnerability exists in Brocade Fabric OS REST API management interface

: A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

Brocade Fabric OS command injection vulnerability in PAM session cleanup routines (CVE-2026-94579)

: An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

Command injection vulnerability exists in the REST API management interface of Brocade Fabric OS (CVE-2026-94581)

: An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

Authenticated Privilege Escalation via Command Injection in Timezone Configuration Processing

: An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

Command Injection in Security Certificate Management Subsystem

: An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution...

An input validation and command injection vulnerability exists in the firmware download and upgrade component of Brocade Fabric OS

: Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

Command Injection via Unsanitized Remote Brocade Fabric OS Configuration Import Utility

: An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host...

Privilege escalation vulnerability exists in the internal Command-Line Interface of Fabric OS (CVE-2026-94577)

: A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypas...

Command Injection vulnerability exists in the Brocade Fabric OS WebTools management (CVE-2026-94586)

: A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using...

CVE-2026-105788: Improper Neutralization of Special Elements used in an OS Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

PT-2026-106738

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type text and launch app tools in ufo/client/mcp/http servers/mobile mcp server.py pass the authenticated caller-controlled text and package name parameters into adb shell comma...

OS Command Injection via Fabric Synchronization

: An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys...

Authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS

: An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these...

CVE-2026-25270: Out-of-bounds Write

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...

Linux Distros Unpatched Vulnerability : CVE-2026-105326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mail...

Debian dsa-6548 : node-shell-quote - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6548 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-102828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...

RockyLinux 10 : vim (RLSA-2026:75769)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly...

Cisco ASA Argument Injection (CVE-2026-20016)

A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attack...

GHSA-X6JW-M9V5-85VH simple-git unsafe-operation guard does not block trailer command configuration

Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...