CWE-77 · Command Injection (page 8)
Page 8 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2527 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation o… |
CVE-2026-2526 | Medium | 6.3 | 2026-02-16 | A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulati… |
CVE-2025-70093 | High | 7.4 | 2026-02-13 | An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response. |
CVE-2026-26068 | Critical | 9.9 | 2026-02-12 | emp3r0r is a stealth-focused C2 designed by Linux users for Linux environments. Prior to 3.21.1, untrusted agent metadata (Transport, Hostname) is accepted dur… |
CVE-2026-20675 | Medium | 5.5 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS… |
CVE-2026-20671 | Low | 3.1 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS So… |
CVE-2025-70296 | Medium | 5.4 | 2026-02-11 | A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resul… |
CVE-2026-21522 | Medium | 6.7 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privilege… |
CVE-2026-21518 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
CVE-2026-21516 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a ne… |
CVE-2026-21257 | High | 8.0 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevat… |
CVE-2026-21256 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2026-20841 | High | 7.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code loca… |
CVE-2026-2260 | High | 7.2 | 2026-02-10 | A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument Admin… |
CVE-2026-25761 | High | 8.8 | 2026-02-09 | Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to… |
CVE-2026-2227 | Medium | 4.7 | 2026-02-09 | A vulnerability was found in D-Link DCS-931L up to 1.13.0. Impacted is the function doSystem of the file /setSystemAdmin. Performing a manipulation of the argu… |
CVE-2026-2218 | Medium | 6.3 | 2026-02-09 | A vulnerability was determined in D-Link DCS-933L up to 1.14.11. This affects an unknown function of the file /setSystemAdmin of the component alphapd. This ma… |
CVE-2026-2210 | High | 7.2 | 2026-02-09 | A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os… |
CVE-2026-2194 | Medium | 6.3 | 2026-02-09 | A flaw has been found in D-Link DI-7100G C1 24.04.18D1. This affects the function start_proxy_client_email. Executing a manipulation can lead to command inject… |
CVE-2026-2193 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argumen… |
CVE-2026-2188 | High | 7.2 | 2026-02-08 | A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a ma… |
CVE-2026-2184 | High | 7.3 | 2026-02-08 | A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unkno… |
CVE-2026-2182 | High | 7.2 | 2026-02-08 | A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipula… |
CVE-2026-2178 | Medium | 6.3 | 2026-02-08 | A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb. This affects the function registerXcodeTools of the file… |
CVE-2026-2175 | High | 7.2 | 2026-02-08 | A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. This manipulation of… |
CVE-2026-2169 | Medium | 6.3 | 2026-02-08 | A vulnerability has been found in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of… |
CVE-2026-2168 | Medium | 6.3 | 2026-02-08 | A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the a… |
CVE-2026-2167 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The ma… |
CVE-2026-2163 | Medium | 4.7 | 2026-02-08 | A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argume… |
CVE-2026-2157 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_route_table. Such man… |
CVE-2026-2155 | High | 7.2 | 2026-02-08 | A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Con… |
CVE-2026-2152 | High | 7.2 | 2026-02-08 | A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web Configuration Interf… |
CVE-2026-2151 | High | 7.2 | 2026-02-08 | A vulnerability has been found in D-Link DIR-615 4.10. This affects an unknown part of the file adv_firewall.php of the component DMZ Host Feature. Such manipu… |
CVE-2026-2143 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component… |
CVE-2026-2142 | High | 7.2 | 2026-02-08 | A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulat… |
CVE-2026-2135 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_43F020 of the file /goform/formPdbUpConfig. Performing a m… |
CVE-2026-2131 | Medium | 6.3 | 2026-02-08 | A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the argument… |
CVE-2026-2130 | Medium | 6.3 | 2026-02-08 | A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search_username… |
CVE-2026-2129 | High | 7.2 | 2026-02-08 | A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manip… |
CVE-2026-2120 | High | 7.2 | 2026-02-08 | A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configurati… |
CVE-2026-2118 | High | 7.2 | 2026-02-08 | A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the com… |
CVE-2026-2085 | High | 7.2 | 2026-02-07 | A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component US… |
CVE-2026-2084 | High | 7.2 | 2026-02-07 | A weakness has been identified in D-Link DIR-823X 250416. This impacts an unknown function of the file /goform/set_language. Executing a manipulation of the ar… |
CVE-2026-2082 | Medium | 4.7 | 2026-02-07 | A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of t… |
CVE-2026-2081 | Medium | 4.7 | 2026-02-07 | A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of th… |
CVE-2026-2080 | High | 7.2 | 2026-02-07 | A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the a… |
CVE-2026-2063 | Medium | 4.7 | 2026-02-06 | A security flaw has been discovered in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/set_ac_server of the component Web M… |
CVE-2026-2061 | Medium | 4.7 | 2026-02-06 | A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file /goform/set_ipv6. Executing a manipulat… |
CVE-2026-2000 | Medium | 4.7 | 2026-02-06 | A vulnerability was found in DCN DCME-320 up to 20260121. Impacted is the function apply_config of the file /function/system/basic/bridge_cfg.php of the compon… |
CVE-2025-59818 | Critical | 10.0 | 2026-02-04 | This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file. |
CVE-2026-1802 | High | 7.3 | 2026-02-03 | A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the file luci\controller\api\zrMacClone.lua… |
CVE-2026-1735 | Medium | 4.3 | 2026-02-02 | A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This mani… |
CVE-2025-24293 | High | 8.1 | 2026-01-30 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation me… |
CVE-2026-1690 | Medium | 4.7 | 2026-01-30 | A flaw has been found in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. This affects the function system of the file /boaform/formSysCmd. This manipulation of… |
CVE-2026-1689 | High | 7.3 | 2026-01-30 | A vulnerability was detected in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. The impacted element is the function checkUserFromLanOrWan of the file /boaform… |
CVE-2026-1687 | High | 7.3 | 2026-01-30 | A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the file /boaform/formSamba of the compone… |
CVE-2026-22623 | High | 7.2 | 2026-01-30 | Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the devi… |
CVE-2025-26385 | | 2026-01-30 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Success… | |
CVE-2026-1638 | Medium | 6.3 | 2026-01-30 | A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg… |
CVE-2026-25046 | Low | 2.9 | 2026-01-29 | Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass f… |
CVE-2026-24905 | High | 7.8 | 2026-01-29 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The `ig` binary p… |
CVE-2026-1625 | Medium | 6.3 | 2026-01-29 | A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boafrm/formSmsManage of the component SMS… |
CVE-2026-1624 | Medium | 6.3 | 2026-01-29 | A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLtefotaUpgradeFibocom… |
CVE-2026-1623 | Medium | 6.3 | 2026-01-29 | A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the… |
CVE-2026-1601 | Medium | 6.3 | 2026-01-29 | A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executin… |
CVE-2026-1596 | Medium | 6.3 | 2026-01-29 | A flaw has been found in D-Link DWR-M961 1.1.47. This vulnerability affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipul… |
CVE-2026-1548 | Medium | 6.3 | 2026-01-28 | A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation… |
CVE-2026-1547 | Medium | 6.3 | 2026-01-28 | A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of t… |
CVE-2026-1544 | Medium | 6.3 | 2026-01-28 | A security flaw has been discovered in D-Link DIR-823X 250416. Impacted is the function sub_41E2A0 of the file /goform/set_mode. Performing a manipulation of t… |
CVE-2022-40619 | High | 7.7 | 2026-01-28 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This… |
CVE-2026-24685 | High | 8.8 | 2026-01-28 | OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenPro… |
CVE-2026-1506 | High | 7.2 | 2026-01-28 | A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php of the component MAC Filter Configuratio… |
CVE-2026-1505 | High | 7.2 | 2026-01-28 | A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The m… |
CVE-2026-1448 | High | 7.2 | 2026-01-27 | A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Manageme… |
CVE-2025-14756 | High | 8.8 | 2026-01-26 | Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute sys… |
CVE-2016-15057 | Critical | 9.9 | 2026-01-26 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This is… |
CVE-2026-1419 | Medium | 4.7 | 2026-01-26 | A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Execu… |
CVE-2026-1414 | Medium | 6.3 | 2026-01-26 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the fi… |
CVE-2026-1413 | Medium | 6.3 | 2026-01-26 | A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /for… |
CVE-2026-1412 | High | 7.3 | 2026-01-26 | A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the… |
CVE-2026-0779 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-24132 | Critical | 9.8 | 2026-01-23 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0… |
CVE-2026-21520 | High | 7.5 | 2026-01-22 | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network at… |
CVE-2026-1327 | Medium | 6.3 | 2026-01-22 | A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cst… |
CVE-2026-1326 | Medium | 6.3 | 2026-01-22 | A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-1324 | High | 8.8 | 2026-01-22 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionController of… |
CVE-2025-15367 | | 2026-01-20 | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control… | |
CVE-2025-15366 | | 2026-01-20 | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control… | |
CVE-2026-23947 | Critical | 9.8 | 2026-01-20 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to… |
CVE-2026-1192 | High | 7.3 | 2026-01-19 | A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unknown function of the file /cgi-bin/imode… |
CVE-2026-1150 | Medium | 6.3 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1149 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-1125 | High | 7.3 | 2026-01-18 | A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing… |
CVE-2026-1066 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in kalcaddle kodbox up to 1.61.10. This issue affects some unknown processing of the file /?explorer/index/zip of the component Co… |
CVE-2026-1064 | Medium | 4.7 | 2026-01-17 | A vulnerability was found in bastillion-io Bastillion up to 4.0.1. This issue affects some unknown processing of the file src/main/java/io/bastillion/manage/co… |
CVE-2026-1063 | Medium | 4.7 | 2026-01-17 | A vulnerability has been found in bastillion-io Bastillion up to 4.0.1. This vulnerability affects unknown code of the file src/main/java/io/bastillion/manage/… |
CVE-2025-60021 | Critical | 9.8 | 2026-01-16 | Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject rem… |
CVE-2026-0975 | High | 7.8 | 2026-01-16 | Delta Electronics DIAView has Command Injection vulnerability. |
CVE-2026-22864 | High | 8.1 | 2026-01-15 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error… |
CVE-2026-22708 | Critical | 9.8 | 2026-01-14 | Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shel… |