CWE-77 · Command Injection (page 7)
Page 7 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4537 | Medium | 4.7 | 2026-03-22 | A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controll… |
CVE-2026-32052 | Medium | 6.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands… |
CVE-2026-4499 | High | 7.3 | 2026-03-20 | A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os c… |
CVE-2026-4497 | High | 7.3 | 2026-03-20 | A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-4496 | Medium | 5.3 | 2026-03-20 | A vulnerability was found in sigmade Git-MCP-Server up to 785aa159f262a02d5791a5d8a8e13c507ac42880. Affected by this vulnerability is the function child_proces… |
CVE-2025-15607 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files… |
CVE-2026-4468 | Medium | 4.7 | 2026-03-20 | A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=update_interfac… |
CVE-2026-4467 | Medium | 4.7 | 2026-03-20 | A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=wireless_device_dis… |
CVE-2026-4466 | Medium | 4.7 | 2026-03-20 | A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone… |
CVE-2026-4465 | Medium | 6.3 | 2026-03-20 | A flaw has been found in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formSysCmd. Executing a manipulation of the argum… |
CVE-2026-32194 | Critical | 9.8 | 2026-03-19 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code ov… |
CVE-2026-32622 | High | 8.8 | 2026-03-19 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability th… |
CVE-2026-26136 | Medium | 6.5 | 2026-03-19 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose informatio… |
CVE-2026-24299 | Medium | 5.3 | 2026-03-19 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-22317 | High | 7.2 | 2026-03-18 | A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests th… |
CVE-2026-27811 | High | 8.8 | 2026-03-18 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in th… |
CVE-2025-14031 | High | 7.5 | 2026-03-17 | IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 coul… |
CVE-2026-4253 | Medium | 4.7 | 2026-03-16 | A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the compon… |
CVE-2026-23862 | High | 7.8 | 2026-03-16 | Dell ThinOS 10 versions prior to ThinOS 2602_10.0573, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerabil… |
CVE-2026-4228 | Medium | 6.3 | 2026-03-16 | A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command… |
CVE-2026-4210 | Medium | 6.3 | 2026-03-16 | A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L… |
CVE-2026-4209 | Medium | 6.3 | 2026-03-16 | A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-4207 | Medium | 6.3 | 2026-03-16 | A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-4206 | Medium | 6.3 | 2026-03-16 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2026-4205 | Medium | 6.3 | 2026-03-16 | A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-4204 | Medium | 6.3 | 2026-03-16 | A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS… |
CVE-2026-4203 | Medium | 6.3 | 2026-03-16 | A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-3… |
CVE-2026-4199 | Medium | 5.3 | 2026-03-16 | A vulnerability was identified in bazinga012 mcp_code_executor up to 0.3.0. Affected by this issue is the function installDependencies of the file src/index.ts… |
CVE-2026-4198 | Medium | 5.3 | 2026-03-16 | A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index… |
CVE-2026-4197 | Medium | 6.3 | 2026-03-16 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2026-4196 | Medium | 6.3 | 2026-03-16 | A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-4195 | Medium | 6.3 | 2026-03-16 | A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS… |
CVE-2026-4192 | Medium | 6.3 | 2026-03-16 | A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts… |
CVE-2026-4170 | Critical | 9.8 | 2026-03-16 | A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc_s… |
CVE-2026-4164 | Critical | 9.8 | 2026-03-16 | A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the compone… |
CVE-2026-4163 | Critical | 9.8 | 2026-03-16 | A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component… |
CVE-2026-26133 | High | 7.1 | 2026-03-16 | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-26793 | Critical | 9.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to exe… |
CVE-2026-26795 | Critical | 9.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnera… |
CVE-2026-26792 | Critical | 9.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version… |
CVE-2026-26791 | Critical | 9.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This… |
CVE-2026-3964 | Medium | 5.3 | 2026-03-11 | A weakness has been identified in OpenAkita up to 1.24.3. This impacts the function run of the file src/openakita/tools/shell.py of the component Chat API Endp… |
CVE-2026-3959 | Medium | 5.3 | 2026-03-11 | A vulnerability was found in 0xKoda WireMCP up to 7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e. Impacted is the function server.tool of the file index.js of the co… |
CVE-2026-20163 | High | 7.2 | 2026-03-11 | In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9… |
CVE-2026-32063 | High | 7.1 | 2026-03-11 | OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environmen… |
CVE-2026-3943 | High | 7.3 | 2026-03-11 | A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa_portal_auth_local_submit. The manipulation… |
CVE-2026-23815 | High | 7.2 | 2026-03-11 | A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection… |
CVE-2026-23814 | High | 8.8 | 2026-03-11 | A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious command… |
CVE-2026-3854 | High | 8.8 | 2026-03-10 | An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a reposito… |
CVE-2026-3813 | Medium | 6.3 | 2026-03-09 | A vulnerability was identified in opencc JFlow up to 5badc00db382d7cb82dad231e6a866b18e0addfe. Affected by this vulnerability is the function Calculate of the… |
CVE-2026-3798 | Medium | 4.7 | 2026-03-09 | A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config… |
CVE-2026-3704 | Medium | 4.7 | 2026-03-08 | A vulnerability has been found in Wavlink NU516U1 251208. This vulnerability affects the function sub_405B2C of the file /cgi-bin/firewall.cgi of the component… |
CVE-2026-3696 | High | 7.3 | 2026-03-08 | A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-3680 | Medium | 6.3 | 2026-03-07 | A security flaw has been discovered in RyuzakiShinji biome-mcp-server up to 1.0.0. Affected by this issue is some unknown functionality of the file biome-mcp-s… |
CVE-2026-3662 | Medium | 4.7 | 2026-03-07 | A vulnerability has been found in Wavlink WL-NU516U1 240425. This vulnerability affects the function usb_p910 of the file /cgi-bin/adm.cgi. Such manipulation o… |
CVE-2026-3661 | Medium | 4.7 | 2026-03-07 | A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument m… |
CVE-2026-3612 | High | 7.2 | 2026-03-06 | A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upg… |
CVE-2026-3485 | Critical | 9.8 | 2026-03-03 | A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes… |
CVE-2026-3484 | Medium | 6.3 | 2026-03-03 | A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_pro… |
CVE-2025-52365 | High | 7.8 | 2026-03-03 | A command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository allows remote attackers to execute arbitrary system commands via u… |
CVE-2026-2256 | Medium | 6.5 | 2026-03-02 | A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system co… |
CVE-2026-3301 | Critical | 9.8 | 2026-02-27 | A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/c… |
CVE-2026-22719 | High | 8.1 | 2026-02-25 | VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which… |
CVE-2025-33181 | High | 7.3 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit… |
CVE-2025-33180 | High | 8.0 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit… |
CVE-2026-3102 | Medium | 6.3 | 2026-02-24 | A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the co… |
CVE-2026-3101 | Medium | 6.3 | 2026-02-24 | A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping Handler. The manipulation results in os… |
CVE-2026-3066 | Medium | 6.3 | 2026-02-24 | A flaw has been found in HummerRisk up to 1.5.0. This vulnerability affects the function fixedCommand of the file hummer-common/hummer-common-core/src/main/jav… |
CVE-2026-3065 | Medium | 6.3 | 2026-02-24 | A vulnerability was detected in HummerRisk up to 1.5.0. This affects the function CommandUtils.commonExecCmdWithResult of the file CloudTaskService.java of the… |
CVE-2026-3064 | Medium | 6.3 | 2026-02-24 | A security vulnerability has been detected in HummerRisk up to 1.5.0. Affected by this issue is some unknown functionality of the file ResourceCreateService.ja… |
CVE-2026-3040 | Medium | 4.7 | 2026-02-23 | A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of t… |
CVE-2026-2956 | Medium | 6.3 | 2026-02-22 | A security flaw has been discovered in qinming99 dst-admin up to 1.5.0. This affects the function revertBackup of the file /home/restore. The manipulation of t… |
CVE-2026-2952 | High | 7.3 | 2026-02-22 | A flaw has been found in Vaelsys 4.1.0. This vulnerability affects unknown code of the file /tree/tree_server.php of the component HTTP POST Request Handler. T… |
CVE-2026-2944 | High | 7.3 | 2026-02-22 | A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php… |
CVE-2026-2333 | Critical | 9.8 | 2026-02-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request. |
CVE-2026-26093 | Critical | 9.8 | 2026-02-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request. |
CVE-2026-2847 | High | 7.2 | 2026-02-20 | A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Man… |
CVE-2026-2846 | High | 7.2 | 2026-02-20 | A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the compo… |
CVE-2026-20761 | High | 8.1 | 2026-02-20 | A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to s… |
CVE-2026-2824 | Medium | 6.3 | 2026-02-20 | A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the com… |
CVE-2026-2823 | Medium | 6.3 | 2026-02-20 | A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntp_… |
CVE-2026-27001 | High | 7.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt… |
CVE-2026-2686 | Critical | 9.8 | 2026-02-19 | A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipu… |
CVE-2026-2670 | High | 7.2 | 2026-02-18 | A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the comp… |
CVE-2025-33249 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attacker could cause a co… |
CVE-2025-33246 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafte… |
CVE-2026-2629 | High | 7.3 | 2026-02-17 | A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tt… |
CVE-2026-22284 | Medium | 6.6 | 2026-02-17 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vu… |
CVE-2026-2615 | High | 7.2 | 2026-02-17 | A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Exe… |
CVE-2026-2560 | Medium | 6.3 | 2026-02-16 | A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class… |
CVE-2026-2548 | Medium | 6.3 | 2026-02-16 | A flaw has been found in WAYOS FBM-220G 24.10.19. This affects the function sub_40F820 of the file rc. Executing a manipulation of the argument upnp_waniface/u… |
CVE-2026-2544 | High | 7.3 | 2026-02-16 | A security flaw has been discovered in yued-fe LuLu UI up to 3.0.0. This issue affects the function child_process.exec of the file run.js. The manipulation res… |
CVE-2026-2537 | Medium | 4.7 | 2026-02-16 | A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of t… |
CVE-2026-2535 | Medium | 6.3 | 2026-02-16 | A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET§ion=ptes… |
CVE-2026-2534 | Medium | 6.3 | 2026-02-16 | A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET§ion… |
CVE-2026-2533 | High | 7.3 | 2026-02-16 | A flaw has been found in Tosei Self-service Washing Machine 4.02. Impacted is an unknown function of the file /cgi-bin/tosei_datasend.php. Executing a manipula… |
CVE-2026-2530 | Medium | 6.3 | 2026-02-16 | A weakness has been identified in Wavlink WL-WN579A3 up to 20210219. This affects the function AddMac of the file /cgi-bin/wireless.cgi. This manipulation of t… |
CVE-2026-2529 | Medium | 6.3 | 2026-02-16 | A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. T… |
CVE-2026-2528 | Medium | 6.3 | 2026-02-16 | A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wirele… |
CVE-2026-2527 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation o… |