CVE-2026-17410 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper neutralization of argument delimiters (CWE-88), allowing a remote authenticated attacker to access and modify portal data belonging to other tenants. This flaw impacts confidentiality, integrity, and availability of affected systems.
CVE-2026-17062 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper neutralization of argument delimiters, allowing a remote authenticated attacker to inject additional parameters into internal server requests by exploiting unsafe handling of special characters in user input. The vulnerability has a low severity rating with a CVSS score of 2.7.
CVE-2026-123285 is a vulnerability in JetBrains Datalore before version 2026.3 that allows command execution in the database task container via JVM options injection. This flaw is classified as CWE-88 Argument Injection. The issue has been fixed in version 2026.3.
CVE-2026-123281 is a high-severity vulnerability in JetBrains Datalore before version 2026.4. It involves argument injection (CWE-88) that allows notebook code to execute commands in the sidecar container via the mount broker. This flaw is fixed in version 2026.4.
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.
CVE-2026-82413 is a command injection vulnerability in ntopng, a network traffic monitoring application, affecting versions prior to 6.7.260717. The flaw arises from insufficient validation of the scan_ports parameter in certain Lua scripts, allowing authenticated users or unauthenticated users if login is disabled, to inject shell metacharacters. This leads to arbitrary command execution with the privileges of the ntopng service account when nmap is installed. The issue is fixed in version 6.7.260717.
CVE-2026-123014 is an argument injection vulnerability in iTerm2 versions before 3.7.7beta2. It affects the x-man-page URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by tricking the user into opening a crafted URL. The vulnerability arises because percent-encoded NUL characters bypass input sanitization and are converted to whitespace during command-line parsing, enabling injection of additional arguments to the /usr/bin/man command. This includes injecting the -P option to specify an attacker-controlled pager command. The issue is due to an incomplete fix for a previous vulnerability (CVE-2023-46321).
Node Version Manager (nvm) versions 0.5.0 through 0.40.8 contain an argument injection vulnerability (CWE-88) where version patterns from a .nvmrc file starting with '-' are interpreted as grep options. This causes unintended recursive directory searches, potentially leaking sensitive data such as npm tokens from symlinked files to terminal output and logs. The issue is fixed in version 0.41.0 by passing version patterns to grep with the '-e' option.
Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges.
Two attack vectors have been identified:
*
Improper authorization of configuration checksum updates: The privileged service does not properly validate the authorization of connecting clients when updating the checksum of an OpenVPN configuration. This allows a non-privileged local user to modify an OpenVPN configuration and set a valid checksum without administrator privileges. The modified configuration is subsequently processed with NT AUTHORITY\SYSTEM privileges.
*
Argument injection via proxy settings: The client does not properly validate or sanitize proxy settings before passing them as arguments to OpenVPN. A non-privileged local user can inject additional arguments through the proxy settings, influencing the execution of OpenVPN with NT AUTHORITY\SYSTEM privileges. This attack vector does not require direct communication with the privileged service or modification of the protected OpenVPN configuration.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpreted by `yt-dlp`, potentially altering its behavior. This issue is fixed in version 1.8.2.
CVE-2026-116252 is an argument injection vulnerability in pgAdmin 4 prior to version 9.19. The issue occurs because the materialized view refresh feature passes the target database name directly to the psql client's --dbname argument without proper sanitization. This allows a specially crafted database name containing connection string keywords to override connection parameters, potentially redirecting connections to attacker-controlled hosts and exposing saved server passwords. The vulnerability was fixed in pgAdmin 4 version 9.19 by routing the database name through a helper function that enforces strict interpretation as a database name.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an argument injection vulnerability (CWE-88) that allows a high privileged remote attacker to potentially elevate privileges. This vulnerability involves improper neutralization of argument delimiters in commands. A fix is available in version 4.8.0 and later.
CVE-2026-119282 is an OS command injection vulnerability in the nrwl nx monorepo tool affecting certain versions of the @nx/maven and @nx/gradle plugins. The issue arises because project-graph analyzers launch shell commands that interpolate user-controlled plugin options, allowing command injection if the repository or pull request is attacker-controlled. This vulnerability allows an attacker to execute arbitrary commands with the privileges of the user running Nx. The flaw is fixed in nx versions 22.7.9 and 23.1.2 and corresponding plugin versions.
CVE-2026-90868 is a critical OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker with limited privileges to execute arbitrary commands without user interaction under certain configurations. The vulnerability has a CVSS score of 9.9, indicating a severe risk to confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 have been released to address this issue.
CVE-2026-90865 is a critical OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a CVSS 3.1 score of 9.0, indicating high impact on confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 have been released to address this issue.
CVE-2026-50056 is a local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS). It allows the Unix zimbra account to execute arbitrary commands as root by exploiting a passwordless sudo interface that accepts unrestricted JVM arguments. The attacker can delay Jetty's privilege drop and force heap exhaustion during startup, triggering command execution with root privileges. Exploitation requires local access as the zimbra user on a mailbox server and interrupts mailboxd during restart. Versions 10.1.16 and 10.1.21 of ZCS are affected.
Apache Traffic Server's experimental magick plugin contains an argument injection vulnerability (CWE-88) that allows unauthenticated clients to control ImageMagick convert arguments in its default unsigned configuration. This affects versions from 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-113708 is a critical argument injection vulnerability in Argo CD, a GitOps continuous delivery tool for Kubernetes. Versions from 2.7.0 up to but not including 3.3.15, 3.4.0-rc1 up to 3.4.10, 3.5.0-rc1 up to 3.5.4, and 3.6.0-rc1 up to 3.6.0-rc2 are affected. The issue arises because Kustomize passes certain query values to git fetch without an end-of-options separator, allowing a leading hyphen value to be interpreted as a git command option when using local file transport. This can lead to command execution inside the argocd-repo-server pod with the privileges of the repo-server user. An attacker with Application get permission on an existing Application can exploit this by committing malicious Kustomizations or uploading files, without needing update, sync, or repository write permissions. The vulnerability is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.