CWE-77 · Command Injection (page 3)
Page 3 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10182 | Medium | 6.3 | 2026-05-31 | A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. The impacted element is the function formWlanSetup of the file /goform/formWlanSetup. Executing… |
CVE-2026-10180 | Medium | 6.3 | 2026-05-31 | A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSysCmd of the file /goform/formSysCmd. Such manipulation of the arg… |
CVE-2026-10166 | Medium | 6.3 | 2026-05-31 | A vulnerability was determined in Edimax BR-6478AC 1.23. The affected element is the function formWlbasic of the file /goform/formWlbasic of the component POST… |
CVE-2026-10127 | Medium | 6.3 | 2026-05-30 | A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Re… |
CVE-2026-45628 | Critical | 9.6 | 2026-05-29 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and… |
CVE-2026-45663 | Critical | 9.9 | 2026-05-29 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functi… |
CVE-2026-10061 | Medium | 6.3 | 2026-05-29 | A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected is the function formWPS of the file /goform/formWPS. The manipulation of the argument peerPi… |
CVE-2026-10060 | Medium | 6.3 | 2026-05-29 | A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /goform/formSetRoute. The manipulation of the… |
CVE-2026-49199 | Critical | 9.8 | 2026-05-29 | Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device. |
CVE-2026-49196 | High | 7.2 | 2026-05-29 | The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands. |
CVE-2026-48116 | High | 7.5 | 2026-05-28 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-sea… |
CVE-2026-38707 | Critical | 9.8 | 2026-05-28 | A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118… |
CVE-2026-38704 | Critical | 9.8 | 2026-05-28 | A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0… |
CVE-2026-38703 | Critical | 9.8 | 2026-05-28 | A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.1… |
CVE-2026-38702 | Critical | 9.8 | 2026-05-28 | A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.1… |
CVE-2026-5509 | High | 7.2 | 2026-05-27 | An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system co… |
CVE-2025-69600 | High | 7.8 | 2026-05-27 | Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getconfig, upload, inven… |
CVE-2026-38945 | High | 7.8 | 2026-05-27 | Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path that matches the i… |
CVE-2026-36540 | High | 7.3 | 2026-05-27 | Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm… |
CVE-2026-48694 | High | 8.1 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fas… |
CVE-2026-9565 | Medium | 6.3 | 2026-05-26 | A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-tauri/src/agent/tools/b… |
CVE-2026-46368 | High | 8.8 | 2026-05-26 | luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packa… |
CVE-2026-40034 | High | 7.8 | 2026-05-26 | gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the… |
CVE-2026-9543 | Critical | 9.8 | 2026-05-26 | A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-9534 | Medium | 6.3 | 2026-05-26 | A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Hand… |
CVE-2026-9533 | Medium | 6.3 | 2026-05-26 | A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The impacted element is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-9532 | Medium | 6.3 | 2026-05-26 | A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi… |
CVE-2026-9531 | Medium | 6.3 | 2026-05-26 | A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setti… |
CVE-2026-9515 | Medium | 6.3 | 2026-05-26 | A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the com… |
CVE-2026-9514 | Medium | 6.3 | 2026-05-25 | A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. Impacted is the function setNetworkDiag of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-9513 | Medium | 6.3 | 2026-05-25 | A weakness has been identified in Totolink CA750-PoE 6.2c.510. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-9512 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in Totolink CA750-PoE 6.2c.510. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-9511 | Medium | 6.3 | 2026-05-25 | A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Settin… |
CVE-2026-9478 | Critical | 9.8 | 2026-05-25 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the compo… |
CVE-2026-9477 | Critical | 9.8 | 2026-05-25 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cg… |
CVE-2026-9476 | Critical | 9.8 | 2026-05-25 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-9475 | Critical | 9.8 | 2026-05-25 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the compone… |
CVE-2026-9458 | Critical | 9.8 | 2026-05-25 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-9457 | Critical | 9.8 | 2026-05-25 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cg… |
CVE-2026-9456 | Critical | 9.8 | 2026-05-25 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnCfg of the file /cgi-bin/cstecgi.cgi of the component Web… |
CVE-2026-9455 | Critical | 9.8 | 2026-05-25 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-9454 | Critical | 9.8 | 2026-05-25 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi… |
CVE-2026-9453 | High | 7.3 | 2026-05-25 | A vulnerability was detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. This affects the function which of the file /src/applicati… |
CVE-2026-9452 | High | 7.3 | 2026-05-25 | A security vulnerability has been detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. Affected by this issue is the function ExecT… |
CVE-2026-9441 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formiNICbasic of the file /goform/formiNICbasic of the com… |
CVE-2026-9440 | Medium | 6.3 | 2026-05-25 | A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formAccept of the file /goform/formAccept of the compon… |
CVE-2026-9439 | Medium | 6.3 | 2026-05-25 | A vulnerability was determined in Edimax BR-6675nD 1.12. Affected is the function stainfo of the file /goform/stainfo. This manipulation of the argument interf… |
CVE-2026-9437 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlTe… |
CVE-2026-9436 | Critical | 9.8 | 2026-05-25 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-9435 | Critical | 9.8 | 2026-05-25 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-9434 | Critical | 9.8 | 2026-05-25 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-9433 | Critical | 9.8 | 2026-05-25 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-9432 | Critical | 9.8 | 2026-05-25 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setWiFiAdvancedCfg of the file /cgi-bin/cs… |
CVE-2026-9424 | Medium | 6.3 | 2026-05-25 | A weakness has been identified in Edimax EW-7438RPn 1.31. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component Conte… |
CVE-2026-9423 | Medium | 4.7 | 2026-05-25 | A security flaw has been discovered in Edimax BR-6675nD 1.12. Impacted is the function mp of the file /goform/mp of the component POST Request Handler. Perform… |
CVE-2026-9408 | Critical | 9.8 | 2026-05-25 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cg… |
CVE-2026-9407 | Critical | 9.8 | 2026-05-25 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setFirewallType of the file… |
CVE-2026-9406 | Critical | 9.8 | 2026-05-25 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-9405 | Critical | 9.8 | 2026-05-25 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-9404 | Critical | 9.8 | 2026-05-24 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-9402 | Medium | 6.3 | 2026-05-24 | A vulnerability was found in Edimax BR-6675nD 1.12. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component POST Reques… |
CVE-2026-9400 | Medium | 6.3 | 2026-05-24 | A flaw has been found in Edimax BR-6675nD 1.12. This issue affects the function formUSBStorage of the file /goform/formUSBStorage of the component POST Request… |
CVE-2026-9388 | Critical | 9.8 | 2026-05-24 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-9387 | Critical | 9.8 | 2026-05-24 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-9386 | Critical | 9.8 | 2026-05-24 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the compone… |
CVE-2026-9385 | Critical | 9.8 | 2026-05-24 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-9384 | Critical | 9.8 | 2026-05-24 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-9379 | Medium | 6.3 | 2026-05-24 | A weakness has been identified in Edimax BR-6675nD 1.12. This impacts the function formWpsStart of the file /goform/formWpsStart of the component POST Request… |
CVE-2026-9378 | Medium | 6.3 | 2026-05-24 | A security flaw has been discovered in Edimax BR-6675nD 1.12. This affects the function formHwSet of the file /goform/formHwSet of the component POST Request H… |
CVE-2026-9367 | High | 7.3 | 2026-05-24 | A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command… |
CVE-2026-9363 | Medium | 6.3 | 2026-05-24 | A vulnerability was detected in Edimax EW-7438RPn 1.12. This issue affects the function formEZCHNwlanSetup of the file /goform/formEZCHNwlanSetu of the compone… |
CVE-2026-9362 | Medium | 6.3 | 2026-05-24 | A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the file /goform/formCon… |
CVE-2026-9361 | Medium | 6.3 | 2026-05-24 | A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Hand… |
CVE-2026-9359 | Medium | 6.3 | 2026-05-24 | A vulnerability was identified in Edimax EW-7438RPn 1.28a. Affected by this vulnerability is the function formHwSet of the file /goform/formHwSet of the compon… |
CVE-2026-9347 | Medium | 6.3 | 2026-05-24 | A vulnerability has been found in Edimax EW-7438RPn up to 1.31. Affected is the function formWizSurvey of the file /goform/formWizSurvey of the component webs… |
CVE-2026-9343 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the compo… |
CVE-2026-9297 | Medium | 6.3 | 2026-05-23 | A security vulnerability has been detected in Edimax BR-6428NS 1.10. Affected is the function formWlbasic of the file /goform/formWlbasic of the component POST… |
CVE-2026-9296 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in Edimax BR-6428NS 1.10. This impacts the function system of the file /goform/formWlanM of the component POST Request Handler… |
CVE-2026-42827 | Medium | 6.5 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-41090 | Critical | 9.3 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-23652 | Critical | 10.0 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code ov… |
CVE-2026-9277 | High | 8.1 | 2026-05-22 | shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped chara… |
CVE-2026-2740 | High | 8.4 | 2026-05-21 | Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticate… |
CVE-2026-42000 | Medium | 6.8 | 2026-05-21 | Insufficient Validation of Names During AXFR |
CVE-2026-5433 | Critical | 9.1 | 2026-05-21 | Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command … |
CVE-2026-8632 | High | 7.8 | 2026-05-20 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of priv… |
CVE-2026-35070 | Medium | 6.4 | 2026-05-20 | Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vul… |
CVE-2026-45585 | Medium | 6.8 | 2026-05-20 | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerabi… |
CVE-2025-57282 | High | 8.8 | 2026-05-18 | ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. |
CVE-2026-8777 | Medium | 6.3 | 2026-05-18 | A vulnerability was found in Edimax BR-6428NS 1.10. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST R… |
CVE-2026-8774 | Medium | 6.3 | 2026-05-18 | A vulnerability was detected in Edimax BR-6228NC 1.22. Affected by this issue is the function mp of the file /goform/mp of the component POST Request Handler… |
CVE-2026-8767 | Medium | 5.0 | 2026-05-17 | A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component… |
CVE-2026-8753 | Medium | 6.3 | 2026-05-17 | A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/pl… |
CVE-2026-46508 | High | 7.8 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute she… |
CVE-2026-39054 | High | 7.3 | 2026-05-15 | Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. The method starts a shell process and writes attacker-controll… |
CVE-2026-24712 | High | 7.3 | 2026-05-14 | Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection. |
CVE-2026-41953 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configurati… |
CVE-2026-40698 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create… |
CVE-2026-40061 | High | 8.7 | 2026-05-13 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated att… |
CVE-2026-36741 | High | 7.2 | 2026-05-13 | U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The Network Time Protocol (NTP) configuration interface does not… |