command injection news
6 stories
U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, to its Known Exploited Vulnerabilities (KEV) catalog. This move mandates that all U.S. federal civilian executive branch (FCEB) agencies address the flaw by August 24, 2026, to protect their networks, and private organizations…
Snowflake GitHub Actions Flaw Allows Command Injection
A recently disclosed vulnerability in Snowflake's GitHub Actions workflows could allow for command injection, according to researchers. The flaw, identified within the snowflakedb/snowflake-connector-net repository, reportedly enables the execution of arbitrary commands within a workflow through the submission of a specially crafted GitHub issue.
Cisco Identity Services Engine Vulnerable to Command Injection
A critical command injection vulnerability has been reported in Cisco Identity Services Engine (ISE), potentially allowing remote attackers to execute arbitrary code. While the flaw is severe, successful exploitation requires prior authentication to the system. The vulnerability has been assigned a CVSS score of 7.2, indicating a high level of concern despite the authentication prerequisite.
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
A critical command injection vulnerability affecting Progress Kemp LoadMaster has been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog. The flaw, identified as CVE-2026-8037, reportedly enables unauthenticated attackers to achieve arbitrary code execution on vulnerable devices. This inclusion by CISA follows reports of…
Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation
Ubiquiti has released security updates to address seven vulnerabilities in its UniFi OS, including a critical flaw that could allow for command injection. The most severe of these, CVE-2026-50746, carries a CVSS score of 10.0 and affects the UniFi Connect Application, versions 3.4.16 and earlier. This application is used for managing commercial building systems like smart lighting and EV chargers.
Ubiquiti warns of new max severity UniFi OS vulnerability
Ubiquiti has issued security updates to address seven critical vulnerabilities affecting its UniFi OS, including a maximum-severity flaw that could allow for command injection attacks. The most severe issue, tracked as CVE-2026-50746, impacts the UniFi Connect Application, specifically versions 3.4.16 and earlier.