CVE-2026-77084 | | | 2026-08-20 | n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local gi… |
CVE-2026-77080 | | | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes fre… |
CVE-2026-76761 | High | 7.3 | 2026-08-19 | A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Manage… |
CVE-2026-75616 | | | 2026-08-19 | An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operat… |
CVE-2026-53545 | Critical | 9.8 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect… |
CVE-2026-53542 | High | 8.8 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in… |
CVE-2026-68560 | | | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured… |
CVE-2026-16882 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-16875 | High | 7.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection. |
CVE-2026-16865 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection. |
CVE-2026-16848 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacter… |
CVE-2026-16844 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-16842 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-71961 | High | 8.8 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS comma… |
CVE-2026-49255 | High | 8.8 | 2026-08-19 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in sr… |
CVE-2026-23501 | High | 7.2 | 2026-08-19 | Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') v… |
CVE-2026-16816 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of speci… |
CVE-2026-15068 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of s… |
CVE-2026-76228 | Medium | 6.7 | 2026-08-19 | Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper ar… |
CVE-2026-76226 | Medium | 6.3 | 2026-08-19 | Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintena… |
CVE-2026-65612 | | | 2026-08-19 | nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted a… |
CVE-2026-65611 | | | 2026-08-19 | nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name… |
CVE-2026-54796 | High | 7.2 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2026-54795 | High | 8.8 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2024-58376 | High | 8.8 | 2026-08-19 | Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers wit… |
CVE-2026-52876 | High | 8.8 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/… |
CVE-2026-55426 | High | 7.8 | 2026-08-18 | linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modu… |
CVE-2026-53455 | | | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential… |
CVE-2026-71551 | High | 7.8 | 2026-08-18 | Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/i… |
CVE-2026-68939 | | | 2026-08-18 | Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .pyt… |
CVE-2026-75094 | Critical | 9.1 | 2026-08-18 | A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the co… |
CVE-2026-67965 | Critical | 9.8 | 2026-08-17 | An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function |
CVE-2026-71858 | | | 2026-08-17 | Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation appl… |
CVE-2026-71472 | Critical | 9.1 | 2026-08-17 | A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) edit… |
CVE-2026-68519 | | | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for o… |
CVE-2026-62982 | High | 8.8 | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and… |
CVE-2026-68518 | | | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache… |
CVE-2026-75056 | High | 7.8 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible |
CVE-2026-71567 | High | 7.7 | 2026-08-17 | In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables
are injected without quoting them either into command li… |
CVE-2026-59910 | High | 7.8 | 2026-08-17 | Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi… |
CVE-2026-56686 | High | 7.8 | 2026-08-17 | Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi… |
CVE-2026-56685 | High | 7.3 | 2026-08-17 | Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi… |
CVE-2026-74997 | High | 8.8 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeh… |
CVE-2026-74801 | High | 8.2 | 2026-08-17 | SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. A… |
CVE-2026-19983 | High | 8.3 | 2026-08-17 | A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of t… |
CVE-2026-19982 | High | 7.4 | 2026-08-17 | A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC… |
CVE-2026-19981 | High | 7.4 | 2026-08-17 | A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19978 | Medium | 5.3 | 2026-08-17 | A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec o… |
CVE-2026-73680 | High | 8.8 | 2026-08-14 | Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload p… |
CVE-2026-17186 | Critical | 9.9 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a c… |
CVE-2026-17179 | High | 8.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection. |
CVE-2026-19188 | Critical | 10.0 | 2026-08-14 | A critical OS command injection vulnerability has been identified in the
Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the
Net Check fea… |
CVE-2026-19682 | Critical | 9.9 | 2026-08-14 | A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on… |
CVE-2026-19681 | Critical | 9.9 | 2026-08-14 | An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading… |
CVE-2026-19679 | High | 8.8 | 2026-08-14 | An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a… |
CVE-2026-19635 | High | 8.8 | 2026-08-14 | A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary co… |
CVE-2026-19628 | High | 7.2 | 2026-08-14 | A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve ar… |
CVE-2026-19771 | High | 7.2 | 2026-08-14 | A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web I… |
CVE-2026-73667 | High | 8.8 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under sampl… |
CVE-2026-73662 | | | 2026-08-13 | FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and oth… |
CVE-2026-73660 | | | 2026-08-13 | FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destinati… |
CVE-2026-73570 | High | 8.9 | 2026-08-13 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notificat… |
CVE-2026-53790 | High | 8.1 | 2026-08-13 | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious i… |
CVE-2026-73625 | High | 8.8 | 2026-08-13 | GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options… |
CVE-2026-73623 | High | 7.5 | 2026-08-13 | GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command exec… |
CVE-2026-73483 | | | 2026-08-13 | Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticat… |
CVE-2026-49819 | Critical | 9.8 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperus… |
CVE-2026-17431 | Medium | 6.1 | 2026-08-13 | PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for… |
CVE-2026-49481 | Critical | 9.6 | 2026-08-12 | UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the… |
CVE-2026-16695 | High | 7.8 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special element… |
CVE-2026-13476 | High | 7.3 | 2026-08-12 | IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the sys… |
CVE-2026-73414 | | | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` w… |
CVE-2026-73412 | | | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure s… |
CVE-2026-63298 | Critical | 9.9 | 2026-08-12 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitra… |
CVE-2026-17642 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used… |
CVE-2026-17417 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters. |
CVE-2026-12005 | High | 7.2 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-18235 | High | 8.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation. |
CVE-2026-17420 | Medium | 6.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in… |
CVE-2026-17248 | High | 7.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an… |
CVE-2026-16956 | Critical | 9.8 | 2026-08-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in a… |
CVE-2026-16906 | High | 8.8 | 2026-08-12 | IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special… |
CVE-2026-16856 | High | 8.8 | 2026-08-12 | IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command. |
CVE-2026-48554 | High | 7.5 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitu… |
CVE-2026-48553 | High | 7.5 | 2026-08-12 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the N… |
CVE-2026-18683 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execut… |
CVE-2026-73294 | Critical | 9.9 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --uploa… |
CVE-2026-73263 | Critical | 9.9 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provide… |
CVE-2026-11325 | High | 8.8 | 2026-08-12 | Description
Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue… |
CVE-2026-5917 | Critical | 9.6 | 2026-08-11 | libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote… |
CVE-2026-14863 | High | 8.8 | 2026-08-11 | FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code executio… |
CVE-2026-73224 | High | 8.8 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to… |
CVE-2026-73222 | High | 8.8 | 2026-08-11 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option… |
CVE-2026-73081 | | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step… |
CVE-2026-70335 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized atta… |
CVE-2026-69320 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute cod… |
CVE-2026-48385 | High | 7.7 | 2026-08-11 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Se… |
CVE-2026-48362 | Critical | 10.0 | 2026-08-11 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbi… |
CVE-2026-73077 | | | 2026-08-11 | Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetyp… |
CVE-2026-67180 | High | 8.4 | 2026-08-11 | Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/n… |