Total
6742 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-56389 | 1 Gnu | 1 Bison | 2026-08-24 | N/A | 8.6 HIGH |
| GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable. | |||||
| CVE-2026-16842 | 1 Ibm | 2 Aix, Vios | 2026-08-24 | N/A | 8.8 HIGH |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-16844 | 1 Ibm | 2 Aix, Vios | 2026-08-24 | N/A | 8.8 HIGH |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-16848 | 1 Ibm | 2 Aix, Vios | 2026-08-24 | N/A | 8.8 HIGH |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options. | |||||
| CVE-2026-73570 | 1 Synacor | 1 Zimbra Collaboration Suite | 2026-08-24 | N/A | 8.9 HIGH |
| A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. | |||||
| CVE-2026-16875 | 1 Ibm | 2 Aix, Vios | 2026-08-22 | N/A | 7.8 HIGH |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection. | |||||
| CVE-2026-16865 | 1 Ibm | 2 Aix, Vios | 2026-08-22 | N/A | 8.8 HIGH |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection. | |||||
| CVE-2026-41449 | 2026-08-21 | N/A | 7.8 HIGH | ||
| UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence. | |||||
| CVE-2026-53804 | 2026-08-21 | N/A | 7.2 HIGH | ||
| OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed. | |||||
| CVE-2026-41450 | 2026-08-21 | N/A | 7.8 HIGH | ||
| UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system. | |||||
| CVE-2026-54795 | 1 Dell | 1 Openmanage Enterprise | 2026-08-21 | N/A | 8.8 HIGH |
| Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | |||||
| CVE-2026-54796 | 1 Dell | 1 Openmanage Enterprise | 2026-08-21 | N/A | 7.2 HIGH |
| Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | |||||
| CVE-2026-17186 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-21 | N/A | 9.9 CRITICAL |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command. | |||||
| CVE-2026-16524 | 2026-08-21 | N/A | 7.8 HIGH | ||
| A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh. | |||||
| CVE-2026-71551 | 2026-08-21 | N/A | 7.8 HIGH | ||
| Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0. | |||||
| CVE-2026-16882 | 1 Ibm | 2 Aix, Vios | 2026-08-21 | N/A | 9.8 CRITICAL |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-17179 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-20 | N/A | 8.5 HIGH |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection. | |||||
| CVE-2026-23501 | 2026-08-20 | N/A | 7.2 HIGH | ||
| Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | |||||
| CVE-2026-16816 | 1 Ibm | 2 Aix, Vios | 2026-08-20 | N/A | 9.9 CRITICAL |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-15068 | 1 Ibm | 2 Aix, Vios | 2026-08-20 | N/A | 9.9 CRITICAL |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | |||||