PT-2026-97840

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-81547: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

CVE-2026-81548: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81552: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2026-93289: Improper Neutralization of Special Elements used in an OS Command

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

CVE-2026-84399: Incorrect Authorization

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

CVE-2026-97366: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

PT-2026-97839

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary code due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-82370: Improper Neutralization of Special Elements used in a Command

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

CVE-2026-81545: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

Linux Distros Unpatched Vulnerability : CVE-2026-97430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the...

PT-2026-105044

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-93425: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

PT-2026-98193

Name of the Vulnerable Software and Affected Versions Decepticon versions prior to 1.1.17 Description Decepticon fails to neutralize ChatML special-token literals when wrapping web crawl results and other tool outputs into LLM messages. In Bring Your Own Key BYOK deployments using OpenAI-compatib...

PT-2026-97919

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. An authenticated user can execute arbitrary commands with the privileges of the selected remo...

CVE-2026-79761: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

PT-2026-98266

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

PT-2026-98316

Name of the Vulnerable Software and Affected Versions Root Browser Classic version 3.3.0 Description Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for comma...

CVE-2026-97430: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCDFLAGHWACCESSIBLE. HCDFLAGHWACCESSIBLE is set and cleared in suspend and resume...

CVE-2026-61732: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...