NPM: code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

NPM: code-ollama: grepsearch Command Injection via Unescaped $ Shell Substitution CWE-78 vulnerability discovered by ? in WordPress Npm code-ollama versions = 0.36.0...

CVE-2026-101072

A vulnerability exists in Netcore NR289-GE 1.4.5102 within the CGI Handler component. Specifically, the /ap_ip.cgi file fails to properly handle the ip argument, which can lead to remote OS command injection . This vulnerability can be exploited over the network. An exploit is publicly available ...

EUVD-2026-88289

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-101072 Netcore NR289-GE CGI ap_ip.cgi system os command injection

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-101072 Netcore NR289-GE CGI ap_ip.cgi system os command injection

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2024-29269-EXPLOIT

CVE-2024-29269 - Telesquare TLR-2005KSH リモートコード実行 RCE Telesquare TLR-2005Ksh バージョン1.0.0および1.1.4において、攻撃者が Cmd パラメータを悪用して任意のシステムコマンドを実行できる可能性がある問題が特定されました。この脆弱性により、権限のない個人が影響を受けるシステム上でコマンドを実行し、不正アクセスやその他の悪意のある活動につながる可能性があります。 概念実証 PoC エクスプロイト 教育目的のみとして、脆弱性を実証するための概念実証 PoC...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

CVE-2026-86330

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

CVE-2026-86330

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

CVE-2026-86330 Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

CVE-2026-86330 Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

EUVD-2026-88236

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

CVE-2026-86330

An OS command injection flaw exists in the set_hostname_internal function of NooBaa's cluster_internal_api , a component used for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation . The root cause is the direct passing of the hostname parameter to a shell command without proper...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

CVE-2026-78424

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-95832

A flaw was found in kitty. This vulnerability allows an application writing output to the terminal to execute arbitrary commands in the user's shell. The issue occurs because the color control escape code handler echoes unrecognized field names back into the terminal's input stream without adequa...