CWE-77 · Command Injection (page 2)
Page 2 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47690 | High | 7.5 | 2026-07-21 | MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3… |
CVE-2026-44879 | High | 7.2 | 2026-07-21 | A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on ce… |
CVE-2026-16448 | Medium | 6.3 | 2026-07-21 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2026-59846 | Low | 3.9 | 2026-07-21 | A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables a… |
CVE-2026-16133 | Medium | 5.0 | 2026-07-18 | A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manip… |
CVE-2025-71392 | High | 8.0 | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authen… |
CVE-2026-52199 | Critical | 9.1 | 2026-07-17 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component |
CVE-2026-30623 | Critical | 9.8 | 2026-07-15 | LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a… |
CVE-2025-65720 | Critical | 9.8 | 2026-07-15 | An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page. |
CVE-2026-46709 | High | 7.8 | 2026-07-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts in… |
CVE-2026-56197 | High | 8.8 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over… |
CVE-2026-55145 | Medium | 6.3 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over… |
CVE-2026-50488 | High | 7.8 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate… |
CVE-2026-58635 | High | 7.8 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privil… |
CVE-2026-50520 | High | 8.4 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code local… |
CVE-2026-48561 | Critical | 9.6 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute… |
CVE-2026-15669 | Medium | 5.3 | 2026-07-14 | A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the com… |
CVE-2026-22103 | | 2026-07-13 | The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-22095 | | 2026-07-13 | The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-15547 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulat… |
CVE-2026-15546 | Medium | 6.3 | 2026-07-13 | A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing… |
CVE-2026-15513 | Medium | 6.3 | 2026-07-13 | A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a mani… |
CVE-2026-15511 | Critical | 9.8 | 2026-07-12 | A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /us… |
CVE-2026-15496 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org… |
CVE-2026-15495 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the co… |
CVE-2026-15487 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts the function sub_41FBD0 of the file /goform/system_ntp of the component Firmware Update… |
CVE-2026-15486 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This affects the function sub_42026C of the file /goform/tools_ddns of the component Firmware Up… |
CVE-2026-15485 | Medium | 6.3 | 2026-07-12 | A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/tools_nslookup of the component DNS L… |
CVE-2026-15481 | High | 8.8 | 2026-07-12 | A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the compone… |
CVE-2025-6784 | High | 8.8 | 2026-07-11 | The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This i… |
CVE-2026-59721 | High | 7.2 | 2026-07-09 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attack… |
CVE-2026-15193 | Medium | 5.3 | 2026-07-09 | A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of the file android/app/src/main/java/com… |
CVE-2026-15035 | Medium | 5.3 | 2026-07-08 | A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repos… |
CVE-2026-15033 | Medium | 6.3 | 2026-07-08 | A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/p… |
CVE-2026-14802 | High | 7.3 | 2026-07-06 | A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the co… |
CVE-2026-54402 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command… |
CVE-2026-9834 | High | 7.2 | 2026-07-02 | The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to an… |
CVE-2026-38142 | Medium | 6.5 | 2026-07-01 | An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arb… |
CVE-2026-13581 | Medium | 6.3 | 2026-06-29 | A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the comp… |
CVE-2026-13561 | Medium | 6.3 | 2026-06-29 | A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted element is the function formiNICbasic of the file /goform/formiNICbasic of the component P… |
CVE-2026-13560 | Medium | 6.3 | 2026-06-29 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the com… |
CVE-2026-13545 | High | 8.8 | 2026-06-29 | A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler… |
CVE-2026-13538 | Medium | 6.3 | 2026-06-29 | A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the… |
CVE-2026-13501 | Medium | 5.3 | 2026-06-28 | A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr… |
CVE-2026-54090 | | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when… | |
CVE-2026-57453 | Medium | 6.5 | 2026-06-25 | Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse… |
CVE-2026-52806 | Critical | 9.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creati… |
CVE-2026-47242 | | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash a… | |
CVE-2026-47240 | | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw… | |
CVE-2026-12815 | Medium | 6.3 | 2026-06-22 | A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os… |
CVE-2026-12814 | Medium | 6.3 | 2026-06-21 | A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of th… |
CVE-2026-12810 | Medium | 6.3 | 2026-06-21 | A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerability is the function mp of the file /goform/mp of the component POST… |
CVE-2026-12809 | Medium | 6.3 | 2026-06-21 | A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz_5in1_redirect of the file /goform/wiz_5in1_redirect of the component P… |
CVE-2026-12808 | Medium | 6.3 | 2026-06-21 | A vulnerability was determined in Edimax BR-6478AC V2 1.23. This impacts the function stainfo of the file /goform/stainfo of the component POST Request Handler… |
CVE-2026-12807 | Medium | 6.3 | 2026-06-21 | A vulnerability was found in Edimax BR-6478AC V2 1.23. This affects the function setWAN of the file /goform/setWAN of the component POST Request Handler. The m… |
CVE-2026-42895 | Medium | 6.5 | 2026-06-19 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-12045 | Critical | 9.0 | 2026-06-19 | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary… |
CVE-2026-38717 | Critical | 9.8 | 2026-06-18 | InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the fi… |
CVE-2026-38716 | Critical | 9.8 | 2026-06-18 | InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Py… |
CVE-2026-38715 | Critical | 9.8 | 2026-06-18 | InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the lo… |
CVE-2026-38714 | Critical | 9.8 | 2026-06-18 | InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Py… |
CVE-2024-24909 | High | 8.8 | 2026-06-16 | Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. A remote authenticated us… |
CVE-2025-56814 | High | 7.8 | 2026-06-15 | A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters. |
CVE-2026-12223 | Medium | 5.5 | 2026-06-15 | A vulnerability was identified in Yealink SIP-T46U 108.86.0.118. Affected by this vulnerability is the function mod_webd.TFTPUploadIperf of the file /api/inner… |
CVE-2026-12219 | Medium | 6.3 | 2026-06-15 | A flaw has been found in Yealink SIP-T46U 108.86.0.118. The impacted element is the function mod_diagnose.CommandShellByType of the file /api/diagnosis/start o… |
CVE-2026-12197 | High | 7.2 | 2026-06-15 | A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the compo… |
CVE-2026-12187 | High | 8.8 | 2026-06-14 | A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/on… |
CVE-2026-12186 | High | 8.8 | 2026-06-14 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the comp… |
CVE-2026-53822 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuil… |
CVE-2026-42850 | High | 8.8 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special… |
CVE-2026-46529 | High | 7.8 | 2026-06-10 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions… |
CVE-2026-45558 | Critical | 9.9 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST… |
CVE-2026-11572 | High | 8.8 | 2026-06-09 | Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git… |
CVE-2026-11556 | High | 8.8 | 2026-06-08 | A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component We… |
CVE-2026-11487 | Medium | 5.3 | 2026-06-08 | A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch… |
CVE-2026-11455 | Medium | 5.0 | 2026-06-07 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function check_cmd_exists of the file metagpt/utils/commo… |
CVE-2026-11452 | High | 7.3 | 2026-06-07 | A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD H… |
CVE-2026-11451 | High | 7.3 | 2026-06-07 | A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing… |
CVE-2026-11450 | High | 7.3 | 2026-06-07 | A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normaliz… |
CVE-2026-11449 | Medium | 6.3 | 2026-06-07 | A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpc_sys of the file /cgi-bin/luci/rpc of the compon… |
CVE-2026-11448 | Medium | 4.7 | 2026-06-07 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Servi… |
CVE-2026-11447 | Medium | 6.3 | 2026-06-07 | A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfo_backend of the file iwinfo.so of the component MTK Backen… |
CVE-2026-11408 | Medium | 6.3 | 2026-06-06 | A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the compone… |
CVE-2026-11406 | Medium | 6.3 | 2026-06-06 | A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client… |
CVE-2026-11341 | Medium | 6.3 | 2026-06-05 | A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of… |
CVE-2026-11339 | Medium | 6.3 | 2026-06-05 | A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulati… |
CVE-2026-10878 | Medium | 6.3 | 2026-06-05 | A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation… |
CVE-2026-45497 | High | 7.7 | 2026-06-04 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a n… |
CVE-2026-42824 | Medium | 6.5 | 2026-06-04 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-10873 | High | 7.2 | 2026-06-04 | A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a ma… |
CVE-2026-10872 | High | 7.2 | 2026-06-04 | A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing… |
CVE-2026-10871 | High | 7.2 | 2026-06-04 | A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web U… |
CVE-2026-10870 | High | 7.2 | 2026-06-04 | A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes… |
CVE-2026-8037 | Critical | 9.6 | 2026-06-04 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on t… |
CVE-2026-10550 | Medium | 6.3 | 2026-06-02 | A weakness has been identified in elunez eladmin up to 2.7. This vulnerability affects unknown code of the file App.java of the component Application Deploymen… |
CVE-2026-10279 | Medium | 6.3 | 2026-06-01 | A vulnerability was identified in hiraishikentaro wezterm-mcp 0.1.0. The affected element is an unknown function of the file src/wezterm_executor.ts of the com… |
CVE-2024-52011 | High | 8.3 | 2026-06-01 | launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` a… |
CVE-2026-10273 | High | 7.3 | 2026-06-01 | A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoin… |
CVE-2026-10219 | High | 7.3 | 2026-06-01 | A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox/fsbridge.go of the… |
CVE-2026-10214 | High | 7.3 | 2026-06-01 | A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8. This issue affects the function _get_safety_warning of the file agent/tools/bash/bash… |