188775 matches found
CVE-2026-102904: Improper Neutralization of Argument Delimiters in a Command
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...
CVE-2026-79535
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
PT-2026-102437
Name of the Vulnerable Software and Affected Versions MODSetter SurfSense versions prior to 2.0.4 Description An issue in the MCP Connector Integration component allows for remote command injection. This occurs due to improper processing of the /api/search-source/connectors/mcp/test endpoint...
Amazon Linux 2 : runfinch-finch (ALASDOCKER-2026-142)
The version of runfinch-finch installed on the remote host is prior to 1.19.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-142 advisory. A custom client can produce such an upload request to the BuildKit daemon that files can escape from the...
PT-2026-102608
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...
PT-2026-102800
Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Command injection exists in the certificate export CLI functionality. A privileged authenticated CLI user can exploit this weakness to execute arbitrary commands with root privileges...
CVE-2026-76724: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...
CVE-2026-102937: Improper Neutralization of Special Elements used in an OS Command
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...
PT-2026-102871
šØ CVE-2026-76727 Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a...
CVE-2026-102792: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...
PT-2026-102959
Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the url argument within the '/api/ZRnetwork/ping' endpoint. This allows an attacker to execute arbitrary commands on the system...
PT-2026-102872
Name of the Vulnerable Software and Affected Versions HPE Networking Instant ON APs affected versions not specified Description A server-side request forgery SSRF issue exists in the API endpoint of the device. An authenticated remote attacker with high privileges can exploit this to execute...
EUVD-2026-89361
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
PT-2026-102778
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...
CVE-2022-51019: Improper Neutralization of Special Elements used in an OS Command
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...
PT-2026-102672
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...
CVE-2026-79535
The mbailey VoiceMode software (versions
CVE-2026-79535
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
PT-2026-102427
Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description An OS command injection flaw exists in the OpenVPN Configuration Handler component. The issue occurs within the escapeshellcmd function located in the ajax/openvpn/del ovpncfg.php file. ...
Amazon Linux 2 : crash (ALAS-2026-3937)
The version of crash installed on the remote host is prior to 8.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3937 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal...