CWE-77 · Command Injection (page 4)
Page 4 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44871 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Succes… |
CVE-2026-44257 | | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName())… | |
CVE-2026-44872 | High | 7.2 | 2026-05-12 | A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an au… |
CVE-2026-44870 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Succes… |
CVE-2026-44869 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44868 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44867 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44866 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44865 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44854 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an aut… |
CVE-2026-44853 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an aut… |
CVE-2026-8431 | High | 7.2 | 2026-05-12 | An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMar… |
CVE-2026-23823 | High | 7.2 | 2026-05-12 | A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Succes… |
CVE-2026-42893 | High | 7.4 | 2026-05-12 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a… |
CVE-2026-41611 | High | 7.8 | 2026-05-12 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. |
CVE-2026-43990 | High | 8.4 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c'… |
CVE-2026-40135 | Medium | 6.5 | 2026-05-12 | An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with admi… |
CVE-2026-34259 | High | 8.2 | 2026-05-12 | Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non… |
CVE-2026-8346 | Medium | 6.3 | 2026-05-12 | A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_addr… |
CVE-2026-8345 | Medium | 6.3 | 2026-05-11 | A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/sing… |
CVE-2026-8344 | Medium | 6.3 | 2026-05-11 | A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ… |
CVE-2026-36734 | High | 8.8 | 2026-05-11 | EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input to the WLAN configur… |
CVE-2026-36983 | High | 7.3 | 2026-05-11 | D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. The manipulation of the argument LightSensorCo… |
CVE-2026-8273 | Medium | 4.7 | 2026-05-11 | A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bi… |
CVE-2026-8272 | Medium | 4.7 | 2026-05-11 | A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.c… |
CVE-2026-8271 | Medium | 4.7 | 2026-05-11 | A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_d… |
CVE-2026-8265 | Medium | 4.7 | 2026-05-11 | A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the… |
CVE-2026-8264 | Medium | 6.3 | 2026-05-11 | A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the co… |
CVE-2026-8263 | Medium | 4.7 | 2026-05-11 | A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of th… |
CVE-2026-8259 | Medium | 4.7 | 2026-05-11 | A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The… |
CVE-2026-8235 | Medium | 5.5 | 2026-05-10 | A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. This issue affects the function resolveSkillScriptPath of the file src/kernel.ts of the component… |
CVE-2026-8230 | Medium | 6.3 | 2026-05-10 | A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of th… |
CVE-2026-8229 | Medium | 6.3 | 2026-05-10 | A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipula… |
CVE-2026-8228 | Medium | 6.3 | 2026-05-10 | A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of… |
CVE-2026-8227 | Medium | 6.3 | 2026-05-10 | A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os c… |
CVE-2026-8217 | Medium | 6.3 | 2026-05-10 | A security flaw has been discovered in Industrial Application Software IAS Canias ERP 8.03. Impacted is the function Runtime.getRuntime.exec of the component R… |
CVE-2026-8210 | Medium | 5.3 | 2026-05-09 | A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS. Affected by this vulnerability is the function helper.Update of the… |
CVE-2026-42258 | Medium | 5.3 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to com… |
CVE-2026-42257 | Critical | 9.8 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP comma… |
CVE-2026-8192 | Medium | 6.3 | 2026-05-09 | A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a… |
CVE-2026-8191 | Medium | 6.3 | 2026-05-09 | A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the a… |
CVE-2026-8190 | Medium | 6.3 | 2026-05-09 | A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of… |
CVE-2026-8189 | Medium | 6.3 | 2026-05-09 | A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipu… |
CVE-2026-8188 | Medium | 6.3 | 2026-05-09 | A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation o… |
CVE-2026-42453 | | 2026-05-08 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and co… | |
CVE-2026-41497 | Critical | 9.8 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument vali… |
CVE-2024-45257 | High | 7.3 | 2026-05-08 | A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a craf… |
CVE-2024-30167 | Medium | 6.3 | 2026-05-08 | /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that ca… |
CVE-2023-47268 | Medium | 5.3 | 2026-05-08 | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is s… |
CVE-2026-42271 | High | 8.8 | 2026-05-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to previ… |
CVE-2026-41501 | Critical | 9.8 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in g… |
CVE-2026-41500 | Critical | 9.8 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in g… |
CVE-2026-8112 | Medium | 6.3 | 2026-05-07 | A vulnerability was found in 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84. Affected is the function executeCognitivePulse of the file src/ke… |
CVE-2026-35428 | Critical | 9.6 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing ov… |
CVE-2026-33111 | High | 7.5 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclos… |
CVE-2026-20169 | Medium | 6.4 | 2026-05-06 | A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to… |
CVE-2025-31951 | High | 8.8 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identif… |
CVE-2026-40068 | High | 8.8 | 2026-05-05 | In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An… |
CVE-2026-7833 | High | 7.2 | 2026-05-05 | A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component… |
CVE-2026-7823 | Critical | 9.8 | 2026-05-05 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The man… |
CVE-2026-7812 | High | 7.3 | 2026-05-05 | A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src… |
CVE-2026-7785 | High | 7.3 | 2026-05-05 | A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89. This affect… |
CVE-2026-36365 | High | 7.8 | 2026-05-04 | An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary code via the shutdo… |
CVE-2026-7730 | Medium | 6.3 | 2026-05-04 | A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function child_process.spawn of the file src/index.ts of the component MCP Int… |
CVE-2026-7721 | Medium | 6.3 | 2026-05-04 | A security vulnerability has been detected in Totolink WA300 5.2cu.7112_B20190227. This affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-7720 | Medium | 6.3 | 2026-05-04 | A weakness has been identified in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-7718 | Medium | 6.3 | 2026-05-04 | A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-7705 | Medium | 6.3 | 2026-05-03 | A flaw has been found in JD Cloud JDCOS 4.5.1.r4518. This vulnerability affects the function set_iptv_info of the file /jdcap of the component Service Interfac… |
CVE-2026-7698 | High | 7.3 | 2026-05-03 | A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /E… |
CVE-2026-7692 | Medium | 6.3 | 2026-05-03 | A vulnerability was detected in Wavlink WL-WN570HA1 R70HA1 V1410_221110. The affected element is the function ping_ddns of the file /cgi-bin/adm.cgi. Performin… |
CVE-2026-7691 | Medium | 6.3 | 2026-05-03 | A security vulnerability has been detected in Wavlink WL-WN570HA1 R70HA1 V1410_221110. Impacted is the function set_sys_cmd of the file /cgi-bin/adm.cgi. Such… |
CVE-2026-7690 | Medium | 6.3 | 2026-05-03 | A weakness has been identified in Wavlink WL-WN570HA1 R70HA1 V1410_221110. This issue affects the function set_sys_adm of the file /cgi-bin/adm.cgi. This manip… |
CVE-2026-7687 | Medium | 6.3 | 2026-05-03 | A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parse_callable_details of the file src/lf… |
CVE-2026-7683 | Medium | 6.3 | 2026-05-03 | A weakness has been identified in Edimax BR-6428nC up to 1.16. This affects an unknown function of the file /goform/setWAN of the component Web Interface. This… |
CVE-2026-7682 | Medium | 6.3 | 2026-05-03 | A security flaw has been discovered in Edimax BR-6208AC 1.02. The impacted element is the function setWAN of the file /goform/setWAN of the component L2TP Mode… |
CVE-2026-7653 | Medium | 6.3 | 2026-05-02 | A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4. Affected is the function open_image_in_browser of the file src/index.ts of… |
CVE-2026-7642 | Medium | 6.3 | 2026-05-02 | A vulnerability was detected in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts of the component MC… |
CVE-2026-7629 | Medium | 6.3 | 2026-05-02 | A flaw has been found in kleneway awesome-cursor-mpc-server up to 2.0.1. Impacted is the function runCodeReviewTool of the file src/tools/codeReview.ts of the… |
CVE-2026-7628 | Medium | 6.3 | 2026-05-02 | A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of… |
CVE-2026-7609 | Medium | 6.3 | 2026-05-02 | A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function tools_diagnostic of the file /tmp/diagnostic of the component… |
CVE-2026-7608 | Medium | 5.5 | 2026-05-02 | A vulnerability was detected in TRENDnet TEW-821DAP up to 1.12B01. The affected element is the function tools_diagnostic. The manipulation results in os comman… |
CVE-2026-7600 | Medium | 6.3 | 2026-05-02 | A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the compone… |
CVE-2026-7593 | High | 7.3 | 2026-05-01 | A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0. This impacts the function execute_command of the file sr… |
CVE-2026-7590 | High | 7.3 | 2026-05-01 | A vulnerability was identified in eyal-gor p_69_branch_monkey_mcp up to 69bc71874ce40050ef45fde5a435855f18af3373. The affected element is an unknown function o… |
CVE-2026-26461 | Medium | 6.5 | 2026-05-01 | A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary command… |
CVE-2026-7548 | High | 8.8 | 2026-05-01 | A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a man… |
CVE-2026-7538 | Critical | 9.8 | 2026-05-01 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function Vulnerability of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-7246 | High | 7.2 | 2026-04-30 | Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS comman… |
CVE-2026-7469 | Medium | 6.3 | 2026-04-30 | A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFil. The manipulation… |
CVE-2026-7446 | High | 7.3 | 2026-04-30 | A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/sca… |
CVE-2026-7443 | High | 7.3 | 2026-04-29 | A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of… |
CVE-2026-7416 | High | 7.3 | 2026-04-29 | A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the compone… |
CVE-2026-26015 | Critical | 9.8 | 2026-04-29 | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any l… |
CVE-2026-36841 | Critical | 9.8 | 2026-04-29 | TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function. |
CVE-2026-7316 | High | 7.3 | 2026-04-28 | A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of the file aider_mcp… |
CVE-2026-7244 | Critical | 9.8 | 2026-04-28 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cste… |
CVE-2026-7243 | Critical | 9.8 | 2026-04-28 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7242 | Critical | 9.8 | 2026-04-28 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-7241 | Critical | 9.8 | 2026-04-28 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-7240 | Critical | 9.8 | 2026-04-28 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.c… |