CWE-77 · Command Injection (page 2)
Page 2 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86152 | Critical | 10.0 | 2026-09-06 | A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the comp… |
CVE-2026-86151 | Critical | 9.1 | 2026-09-06 | A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Confi… |
CVE-2026-86149 | Critical | 9.1 | 2026-09-05 | A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the… |
CVE-2026-86148 | Critical | 9.1 | 2026-09-05 | A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kyli… |
CVE-2026-53932 | High | 8.0 | 2026-09-04 | laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injec… |
CVE-2026-75161 | High | 8.8 | 2026-09-04 | An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-pr… |
CVE-2026-85224 | Critical | 9.1 | 2026-09-03 | A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Shar… |
CVE-2026-85223 | Critical | 9.9 | 2026-09-03 | A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CG… |
CVE-2026-85222 | Critical | 9.1 | 2026-09-03 | A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of… |
CVE-2026-63694 | Medium | 5.0 | 2026-09-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vu… |
CVE-2026-85040 | Medium | 4.7 | 2026-09-03 | A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/sav… |
CVE-2026-79754 | | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline do… | |
CVE-2026-73766 | High | 7.2 | 2026-09-01 | Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary… |
CVE-2026-73763 | High | 7.1 | 2026-09-01 | A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation c… |
CVE-2026-73751 | High | 8.8 | 2026-09-01 | An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the und… |
CVE-2026-73722 | High | 7.2 | 2026-09-01 | Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perfo… |
CVE-2026-73717 | High | 7.5 | 2026-09-01 | A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote att… |
CVE-2026-73712 | High | 8.1 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if… |
CVE-2026-73709 | High | 8.3 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands… |
CVE-2026-73704 | High | 8.8 | 2026-09-01 | A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator… |
CVE-2026-79682 | High | 8.8 | 2026-09-01 | Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execu… |
CVE-2026-10195 | High | 8.8 | 2026-09-01 | The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization… |
CVE-2026-84190 | High | 7.2 | 2026-09-01 | LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to she… |
CVE-2026-84059 | High | 7.4 | 2026-09-01 | A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=Se… |
CVE-2026-83772 | Critical | 9.9 | 2026-09-01 | A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the fi… |
CVE-2026-83524 | Critical | 9.9 | 2026-08-31 | A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec… |
CVE-2026-82971 | Critical | 10.0 | 2026-08-31 | A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Scri… |
CVE-2026-82703 | Medium | 6.6 | 2026-08-31 | A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPi… |
CVE-2026-82702 | Medium | 6.6 | 2026-08-31 | A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such… |
CVE-2026-82692 | Critical | 9.9 | 2026-08-31 | A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipula… |
CVE-2026-82691 | Critical | 9.1 | 2026-08-31 | A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the f… |
CVE-2026-82690 | Critical | 9.1 | 2026-08-31 | A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cg… |
CVE-2026-82689 | Critical | 9.9 | 2026-08-31 | A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_m… |
CVE-2026-82688 | Critical | 9.1 | 2026-08-31 | A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-b… |
CVE-2026-82678 | Medium | 4.7 | 2026-08-31 | A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsol… |
CVE-2026-82668 | High | 7.3 | 2026-08-31 | A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/… |
CVE-2026-82597 | High | 7.4 | 2026-08-31 | A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation… |
CVE-2026-82595 | High | 7.4 | 2026-08-31 | A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component S… |
CVE-2026-50979 | High | 8.1 | 2026-08-28 | A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute ar… |
CVE-2026-81562 | Medium | 5.3 | 2026-08-27 | A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a mani… |
CVE-2026-55182 | | 2026-08-26 | LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal… | |
CVE-2026-52473 | Medium | 4.3 | 2026-08-26 | An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder. |
CVE-2020-15874 | High | 8.8 | 2026-08-26 | An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injecti… |
CVE-2026-79912 | High | 8.3 | 2026-08-25 | A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Pe… |
CVE-2026-79792 | Medium | 5.6 | 2026-08-25 | A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py… |
CVE-2026-24169 | High | 8.0 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a spe… |
CVE-2026-24168 | Medium | 6.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection… |
CVE-2026-24167 | Medium | 6.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafte… |
CVE-2026-79623 | Medium | 6.3 | 2026-08-25 | A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of… |
CVE-2026-78430 | Medium | 5.3 | 2026-08-24 | A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the… |
CVE-2025-26237 | High | 8.1 | 2026-08-24 | D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands. |
CVE-2026-78177 | Medium | 4.5 | 2026-08-24 | A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src… |
CVE-2026-78141 | High | 7.4 | 2026-08-23 | A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument… |
CVE-2026-78063 | High | 7.4 | 2026-08-23 | A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipula… |
CVE-2026-77988 | Medium | 6.6 | 2026-08-22 | A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvram_get of the component CLI Configuration Tool. Thi… |
CVE-2026-77945 | High | 7.4 | 2026-08-22 | A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a… |
CVE-2026-77683 | Critical | 9.9 | 2026-08-21 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§i… |
CVE-2026-47827 | High | 7.5 | 2026-08-21 | Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabiliti… |
CVE-2026-61400 | High | 8.8 | 2026-08-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality… |
CVE-2026-77031 | High | 7.4 | 2026-08-20 | A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manip… |
CVE-2026-54449 | High | 8.8 | 2026-08-20 | LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuratio… |
CVE-2026-77004 | High | 7.4 | 2026-08-20 | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a m… |
CVE-2026-76761 | High | 7.3 | 2026-08-19 | A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Manage… |
CVE-2026-76591 | High | 7.4 | 2026-08-19 | A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the comp… |
CVE-2026-76339 | Medium | 5.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject arbitrary Sea… |
CVE-2026-76328 | Medium | 6.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Process… |
CVE-2026-76321 | High | 7.3 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into re… |
CVE-2026-76583 | High | 7.4 | 2026-08-19 | A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/set_time… |
CVE-2026-76582 | High | 7.4 | 2026-08-19 | A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Exec… |
CVE-2026-76233 | Medium | 6.7 | 2026-08-19 | Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam d… |
CVE-2026-76232 | Medium | 6.7 | 2026-08-19 | Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to hel… |
CVE-2026-76231 | Medium | 6.7 | 2026-08-19 | Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appende… |
CVE-2026-76230 | Medium | 6.7 | 2026-08-19 | Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended… |
CVE-2026-76229 | Medium | 6.7 | 2026-08-19 | Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names ar… |
CVE-2026-75985 | High | 7.4 | 2026-08-19 | A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipulation of the argumen… |
CVE-2026-75984 | High | 7.4 | 2026-08-19 | A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument… |
CVE-2026-53533 | | 2026-08-18 | aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied add… | |
CVE-2026-24301 | High | 8.8 | 2026-08-18 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose informatio… |
CVE-2026-75094 | Critical | 9.1 | 2026-08-18 | A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the co… |
CVE-2026-75011 | Medium | 6.3 | 2026-08-17 | A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interf… |
CVE-2026-75052 | Low | 3.6 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects |
CVE-2026-75007 | Medium | 5.4 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead… |
CVE-2026-75004 | Medium | 4.3 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted r… |
CVE-2026-75002 | High | 7.1 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privil… |
CVE-2026-19983 | High | 8.3 | 2026-08-17 | A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of t… |
CVE-2026-19982 | High | 7.4 | 2026-08-17 | A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC… |
CVE-2026-19981 | High | 7.4 | 2026-08-17 | A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19978 | Medium | 5.3 | 2026-08-17 | A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec o… |
CVE-2026-19976 | Medium | 6.6 | 2026-08-17 | A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=… |
CVE-2026-19963 | High | 7.4 | 2026-08-17 | A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the a… |
CVE-2026-19962 | High | 7.4 | 2026-08-17 | A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of… |
CVE-2026-19960 | High | 7.4 | 2026-08-16 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation… |
CVE-2026-50523 | High | 7.8 | 2026-08-14 | Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code local… |
CVE-2026-19771 | High | 7.2 | 2026-08-14 | A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web I… |
CVE-2026-19747 | Critical | 9.8 | 2026-08-13 | A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAt… |
CVE-2026-73250 | | 2026-08-11 | Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced install… | |
CVE-2026-68792 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges loc… |
CVE-2026-65656 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-49179 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code… |
CVE-2026-47299 | High | 7.2 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges… |