CVE-2023-22631

Remote File Write via HTTP XML/REST Sensor in PRTG Network Monitor

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Paessler

Products

Prtg Network Monitor

CVE-2023-22632

PRTG FTP Server Count Sensor Remote File Write

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Paessler

Products

Prtg Network Monitor

CVE-2026-90809

HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. The name of the patch is af582246f141311d574551b7571a517bcc3df750. It is best practice to apply a patch to resolve this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hkuds Nanobot

Products

Nanobot Nanobot

CVE-2026-19624

NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-90467

aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cole

Products

Aiosmtplib

CVE-2026-90894

Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-89459

s390/percpu: Fix MVIY_PERCPU() with older binutils

In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Infrastructure for more efficient this_cpu operations") introduced MVIY_PERCPU(), which stringifies arguments that are already C string literals. This generates an assembler macro invocation with whitespace-separated quoted arguments: GEN_MVIY "459712" "%r3" GNU as versions prior to binutils 2.39 drop the separating whitespace between quoted macro arguments during input scrubbing. They consequently parse the invocation as a single argument and emit repeated warnings: Warning: missing closing `"' The .ifc in GEN_MVIY never matches and GNU as exits successfully without emitting the mviy instruction. As a result, the interrupted per-CPU sequence is not marked in lowcore and the exception return path cannot repair the per-CPU address register after migration. All MVIY_PERCPU() callers pass C string literals. Use them directly and separate the assembler macro arguments with an explicit comma. The resulting invocation is: GEN_MVIY 459712, %r3 This form is unambiguous for GNU as and LLVM's integrated assembler. This behavior was fixed in GNU as from binutils 2.39, but Linux supports binutils 2.30.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-11765

Argument Injection in TUBITAK BILGEM's Pardus Pen

Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection. This issue affects Pardus Pen: before 4.2.1.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Pen

CVE-2026-89066

OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Projen

CVE-2026-86060

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS 4.0 · 9.2 Critical EPSS 6.4% KEV · Listed

Vendors

Mikrotik

Products

Routeros

CVE-2026-78635

Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Okta Privileged Access Client

CVE-2026-8044

Remote Code Execution via Argument Injection in Backup Configuration Parameters

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Schneider-electric

Products

Ecostruxure It Data Center Expert

CVE-2026-74237

GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gfi Software

Products

Gfi Exinda Ai

CVE-2026-0304

Cortex XDR Broker VM: Privilege Escalation Vulnerability

A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Palo Alto Networks

Products

Cortex Xdr Broker Vm

CVE-2026-71377

Command Argument Injection Vulnerability in Cosminexus Component Container

Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hitachi

Products

Cosminexus Component Container

CVE-2026-76220

GitPython before 3.1.58 Command Execution via split_single_char_options

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-76218

GitPython before 3.1.58 Remote Code Execution via Repo.init

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython

CVE-2026-76217

GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-78676

GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-78678

GitPython before 3.1.59 Arbitrary File Read via Repo.blame()

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython