CWE-77 · Command Injection (page 5)
Page 5 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7220 | High | 7.3 | 2026-04-28 | A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-m… |
CVE-2026-7215 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_tool of the file mcp_server.py of the comp… |
CVE-2026-7211 | High | 7.3 | 2026-04-28 | A weakness has been identified in dvladimirov MCP up to 0.1.0. The impacted element is the function GitSearchRequest of the file mcp_server.py of the component… |
CVE-2026-7204 | Critical | 9.8 | 2026-04-28 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7203 | Critical | 9.8 | 2026-04-28 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-7202 | Critical | 9.8 | 2026-04-28 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the compo… |
CVE-2026-7160 | High | 8.8 | 2026-04-27 | A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation… |
CVE-2026-7157 | High | 7.3 | 2026-04-27 | A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of… |
CVE-2026-7156 | Critical | 9.8 | 2026-04-27 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI… |
CVE-2026-7155 | Critical | 9.8 | 2026-04-27 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi… |
CVE-2026-7154 | Critical | 9.8 | 2026-04-27 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-7153 | Critical | 9.8 | 2026-04-27 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cs… |
CVE-2026-7152 | Critical | 9.8 | 2026-04-27 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-31255 | Critical | 9.8 | 2026-04-27 | A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper ha… |
CVE-2026-7140 | Critical | 9.8 | 2026-04-27 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component C… |
CVE-2026-7139 | Critical | 9.8 | 2026-04-27 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-7138 | Critical | 9.8 | 2026-04-27 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-7137 | Critical | 9.8 | 2026-04-27 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-7136 | Critical | 9.8 | 2026-04-27 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-30352 | Critical | 9.8 | 2026-04-27 | A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code v… |
CVE-2026-7125 | Critical | 9.8 | 2026-04-27 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-7124 | Critical | 9.8 | 2026-04-27 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstec… |
CVE-2026-7123 | Critical | 9.8 | 2026-04-27 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Ha… |
CVE-2026-7122 | Critical | 9.8 | 2026-04-27 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-7121 | Critical | 9.8 | 2026-04-27 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Han… |
CVE-2026-7119 | High | 8.8 | 2026-04-27 | A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argumen… |
CVE-2026-7102 | Medium | 6.3 | 2026-04-27 | A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipula… |
CVE-2026-7096 | High | 8.8 | 2026-04-27 | A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. T… |
CVE-2026-7067 | High | 7.3 | 2026-04-27 | A vulnerability was determined in D-Link DIR-822 A_101. The impacted element is the function system of the file /udhcpcd/dhcpd.c of the component udhcpd DHCP S… |
CVE-2026-7066 | High | 7.3 | 2026-04-27 | A vulnerability was found in choieastsea simple-openstack-mcp up to 767b2f4a8154cca344344b9725537a58399e6036. The affected element is the function exec_opensta… |
CVE-2026-7064 | High | 7.3 | 2026-04-26 | A flaw has been found in AgentDeskAI browser-tools-mcp up to 1.2.0. This issue affects some unknown processing of the file browser-tools-server/browser-connect… |
CVE-2026-7062 | High | 7.3 | 2026-04-26 | A security vulnerability has been detected in Intina47 context-sync up to 2.0.0. This affects an unknown part of the file src/git-integration.ts of the compone… |
CVE-2026-7061 | High | 7.3 | 2026-04-26 | A weakness has been identified in Toowiredd chatgpt-mcp-server up to 0.1.0. Affected by this issue is some unknown functionality of the file src/services/docke… |
CVE-2026-7058 | High | 7.3 | 2026-04-26 | A vulnerability has been found in 666ghj MiroFish up to 0.1.2. The impacted element is the function SimulationIPCClient.send_command of the file backend/app/se… |
CVE-2026-7039 | High | 7.8 | 2026-04-26 | A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file src/index.ts. Such ma… |
CVE-2026-7037 | Critical | 9.8 | 2026-04-26 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-6992 | High | 7.2 | 2026-04-25 | A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh… |
CVE-2026-6989 | Medium | 6.3 | 2026-04-25 | A vulnerability has been found in Tenda F453 up to 1.0.0.3. Impacted is the function TendaTelnet of the file /goform/telnet of the component Telnet Service. Su… |
CVE-2026-6987 | High | 7.3 | 2026-04-25 | A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management… |
CVE-2026-6980 | High | 7.3 | 2026-04-25 | A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of the file m… |
CVE-2026-41265 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the… |
CVE-2026-31173 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the interval parameter to /cgi… |
CVE-2026-31169 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin… |
CVE-2026-31168 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-… |
CVE-2026-31167 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin… |
CVE-2026-31166 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin… |
CVE-2026-31163 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-… |
CVE-2026-31162 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to /cgi-b… |
CVE-2026-31179 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to /cgi… |
CVE-2026-31176 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun_user parameter to /cg… |
CVE-2026-31175 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /c… |
CVE-2026-31174 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to… |
CVE-2026-31172 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin… |
CVE-2026-31171 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the url parameter to /cgi-bin/… |
CVE-2026-31165 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter… |
CVE-2026-31164 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi… |
CVE-2026-31160 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi… |
CVE-2026-31159 | Medium | 6.5 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi… |
CVE-2026-41304 | Critical | 9.8 | 2026-04-22 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands… |
CVE-2026-6799 | Medium | 6.3 | 2026-04-21 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SE… |
CVE-2026-38835 | Critical | 9.8 | 2026-04-21 | Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter… |
CVE-2026-38834 | High | 7.3 | 2026-04-21 | Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerabilit… |
CVE-2026-39866 | High | 8.8 | 2026-04-21 | Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workfl… |
CVE-2026-4048 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbi… |
CVE-2026-3519 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions… |
CVE-2026-3518 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arb… |
CVE-2026-3517 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions… |
CVE-2026-6576 | Medium | 6.3 | 2026-04-19 | A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/comm… |
CVE-2026-30898 | High | 8.8 | 2026-04-18 | An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to es… |
CVE-2026-35682 | High | 8.8 | 2026-04-17 | Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd)… |
CVE-2026-21709 | Medium | 6.7 | 2026-04-17 | A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement. |
CVE-2026-41153 | Medium | 5.8 | 2026-04-17 | In JetBrains Junie before 252.549.29 command execution was possible via malicious project file |
CVE-2026-6483 | High | 7.2 | 2026-04-17 | A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipu… |
CVE-2026-23779 | Medium | 6.7 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug… |
CVE-2026-23778 | High | 7.2 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug… |
CVE-2026-20186 | Critical | 9.9 | 2026-04-15 | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating… |
CVE-2026-20147 | Critical | 9.9 | 2026-04-15 | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system o… |
CVE-2026-30625 | Critical | 9.8 | 2026-04-15 | Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks w… |
CVE-2026-30624 | High | 8.6 | 2026-04-15 | Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP s… |
CVE-2026-30617 | High | 8.6 | 2026-04-15 | LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can acc… |
CVE-2026-30616 | High | 7.3 | 2026-04-15 | Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to… |
CVE-2026-30615 | High | 8.0 | 2026-04-15 | A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attack… |
CVE-2026-30461 | High | 8.3 | 2026-04-15 | Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the… |
CVE-2024-53412 | High | 8.4 | 2026-04-15 | Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code exec… |
CVE-2026-32183 | High | 7.8 | 2026-04-14 | Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code lo… |
CVE-2026-23653 | Medium | 5.7 | 2026-04-14 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to d… |
CVE-2026-4786 | High | 7.1 | 2026-04-13 | Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" AP… |
CVE-2026-6219 | Medium | 5.3 | 2026-04-13 | A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of the file src/compressor.js of the compo… |
CVE-2026-6195 | Critical | 9.8 | 2026-04-13 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setPasswordCfg of the file /cgi-bin… |
CVE-2026-6158 | High | 7.3 | 2026-04-13 | A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argumen… |
CVE-2026-6156 | Critical | 9.8 | 2026-04-13 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-6155 | Critical | 9.8 | 2026-04-13 | A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-6154 | Critical | 9.8 | 2026-04-13 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cg… |
CVE-2026-6141 | Medium | 6.3 | 2026-04-13 | A vulnerability was determined in danielmiessler Personal_AI_Infrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parse_… |
CVE-2026-6140 | Critical | 9.8 | 2026-04-13 | A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the compon… |
CVE-2026-6139 | Critical | 9.8 | 2026-04-13 | A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-6138 | Critical | 9.8 | 2026-04-13 | A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-6132 | Critical | 9.8 | 2026-04-12 | A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-6131 | Critical | 9.8 | 2026-04-12 | A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecg… |
CVE-2026-6130 | High | 7.3 | 2026-04-12 | A flaw has been found in chatboxai chatbox up to 1.20.0. This impacts the function StdioClientTransport of the file src/main/mcp/ipc-stdio-transport.ts of the… |