CVE-2026-111451 | High | 7.8 | 2026-10-16 | Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can exec… |
CVE-2026-111229 | High | 7.2 | 2026-10-15 | pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal H… |
CVE-2026-111226 | High | 7.2 | 2026-10-15 | pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to ex… |
CVE-2026-111225 | Medium | 5.0 | 2026-10-15 | Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to exec… |
CVE-2026-111224 | High | 7.5 | 2026-10-15 | pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to e… |
CVE-2026-111218 | High | 7.2 | 2026-10-15 | Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges t… |
CVE-2026-111217 | High | 7.2 | 2026-10-15 | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute comm… |
CVE-2026-111216 | High | 7.2 | 2026-10-15 | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute command… |
CVE-2026-111215 | High | 7.2 | 2026-10-15 | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a craf… |
CVE-2026-111214 | High | 7.2 | 2026-10-15 | Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands… |
CVE-2026-55453 | Low | 3.3 | 2026-10-15 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function… |
CVE-2026-57155 | Critical | 9.9 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths… |
CVE-2026-45449 | High | 8.3 | 2026-10-15 | : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
Th… |
CVE-2026-110957 | Critical | 10.0 | 2026-10-15 | A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the compone… |
CVE-2026-47786 | | | 2026-10-15 | An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute a… |
CVE-2026-41545 | | | 2026-10-15 | A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vul… |
CVE-2026-34007 | | | 2026-10-15 | An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbi… |
CVE-2026-110925 | Medium | 5.4 | 2026-10-15 | A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u insi… |
CVE-2026-110908 | High | 8.8 | 2026-10-15 | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An au… |
CVE-2026-100232 | High | 7.2 | 2026-10-14 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWa… |
CVE-2026-0320 | | | 2026-10-14 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… |
CVE-2026-0313 | | | 2026-10-14 | A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute a… |
CVE-2026-55679 | Medium | 6.5 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php… |
CVE-2026-55786 | High | 8.4 | 2026-10-14 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-R… |
CVE-2026-54525 | High | 8.8 | 2026-10-14 | Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a dec… |
CVE-2026-110536 | Critical | 10.0 | 2026-10-14 | A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Execu… |
CVE-2026-102079 | High | 7.8 | 2026-10-14 | An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.
… |
CVE-2026-102059 | High | 8.8 | 2026-10-14 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks… |
CVE-2026-102031 | Critical | 9.8 | 2026-10-14 | An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands wit… |
CVE-2026-101978 | High | 8.8 | 2026-10-14 | An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated… |
CVE-2026-101967 | High | 8.8 | 2026-10-14 | An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on t… |
CVE-2026-103929 | High | 7.8 | 2026-10-14 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untr… |
CVE-2026-110650 | Critical | 9.8 | 2026-10-14 | The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by su… |
CVE-2026-110649 | Critical | 9.8 | 2026-10-14 | Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Att… |
CVE-2026-110648 | High | 7.8 | 2026-10-14 | @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files w… |
CVE-2026-110647 | High | 7.8 | 2026-10-14 | Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted na… |
CVE-2026-110646 | High | 8.1 | 2026-10-14 | Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the r… |
CVE-2026-110645 | Critical | 9.8 | 2026-10-14 | Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated… |
CVE-2026-110644 | Critical | 9.8 | 2026-10-14 | nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafte… |
CVE-2026-110643 | Critical | 9.8 | 2026-10-14 | transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values t… |
CVE-2026-110642 | High | 7.8 | 2026-10-14 | xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescap… |
CVE-2026-110641 | High | 8.8 | 2026-10-14 | @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archi… |
CVE-2026-110640 | Critical | 9.8 | 2026-10-14 | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOpt… |
CVE-2026-110639 | Critical | 9.8 | 2026-10-14 | @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in arch… |
CVE-2026-110638 | Critical | 9.8 | 2026-10-14 | doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog()… |
CVE-2026-110637 | High | 7.8 | 2026-10-14 | buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB… |
CVE-2026-110636 | Critical | 9.8 | 2026-10-14 | pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from cal… |
CVE-2026-110635 | Critical | 9.8 | 2026-10-14 | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell en… |
CVE-2026-110634 | Critical | 9.8 | 2026-10-14 | git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDif… |
CVE-2020-37282 | Critical | 9.8 | 2026-10-14 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to gene… |
CVE-2026-101215 | Medium | 6.6 | 2026-10-14 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… |
CVE-2026-16741 | Critical | 9.8 | 2026-10-14 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual applian… |
CVE-2026-73792 | Low | 3.8 | 2026-10-14 | A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow. |
CVE-2026-105106 | High | 8.8 | 2026-10-14 | Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-d… |
CVE-2026-46449 | Medium | 6.7 | 2026-10-14 | The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The… |
CVE-2026-106931 | High | 7.8 | 2026-10-14 | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privi… |
CVE-2026-105429 | High | 8.0 | 2026-10-14 | Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0… |
CVE-2026-110447 | | | 2026-10-14 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September… |
CVE-2026-110392 | Critical | 9.8 | 2026-10-14 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command In… |
CVE-2026-53563 | | | 2026-10-13 | Vulnerability in Citrix UniconOS leading to Persistent Command Execution
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2. |
CVE-2026-86022 | High | 7.0 | 2026-10-13 | VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a comm… |
CVE-2026-55601 | High | 7.3 | 2026-10-13 | MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attac… |
CVE-2026-103848 | Critical | 9.9 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could… |
CVE-2026-110236 | High | 7.0 | 2026-10-13 | KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names… |
CVE-2026-110233 | High | 7.8 | 2026-10-13 | Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attac… |
CVE-2026-100207 | High | 7.3 | 2026-10-13 | Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code lo… |
CVE-2026-106171 | Medium | 6.1 | 2026-10-13 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 t… |
CVE-2026-104085 | High | 8.8 | 2026-10-13 | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploadi… |
CVE-2026-55376 | High | 8.8 | 2026-10-13 | Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or e… |
CVE-2026-77099 | | | 2026-10-13 | CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS. |
CVE-2026-109110 | Critical | 10.0 | 2026-10-13 | A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to… |
CVE-2026-109108 | Critical | 9.9 | 2026-10-13 | A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulati… |
CVE-2026-75826 | | | 2026-10-13 | Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB… |
CVE-2026-89116 | Medium | 5.9 | 2026-10-13 | The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary… |
CVE-2026-82096 | High | 8.8 | 2026-10-12 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
CVE-2026-18529 | High | 8.7 | 2026-10-12 | IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-… |
CVE-2025-71429 | Critical | 9.8 | 2026-10-12 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands v… |
CVE-2020-37279 | High | 8.1 | 2026-10-12 | easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters i… |
CVE-2026-109318 | High | 8.8 | 2026-10-12 | Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting she… |
CVE-2026-108896 | Critical | 9.9 | 2026-10-12 | A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the ar… |
CVE-2026-108895 | Critical | 9.9 | 2026-10-12 | A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation o… |
CVE-2026-18390 | High | 7.8 | 2026-10-12 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Informat… |
CVE-2026-108894 | Critical | 9.9 | 2026-10-12 | A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component S… |
CVE-2026-108953 | High | 7.8 | 2026-10-12 | mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharac… |
CVE-2026-105407 | High | 8.8 | 2026-10-12 | An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the s… |
CVE-2026-108817 | Medium | 5.5 | 2026-10-12 | A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/to… |
CVE-2026-108804 | Critical | 10.0 | 2026-10-12 | A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the… |
CVE-2026-108744 | High | 7.0 | 2026-10-11 | pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening… |
CVE-2026-108576 | Critical | 10.0 | 2026-10-11 | A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The mani… |
CVE-2026-108540 | Critical | 9.9 | 2026-10-11 | A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing… |
CVE-2026-108546 | High | 7.5 | 2026-10-10 | Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishi… |
CVE-2026-108161 | High | 7.5 | 2026-10-10 | FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands… |
CVE-2026-101947 | | | 2026-10-10 | ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the… |
CVE-2026-55797 | High | 8.8 | 2026-10-09 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vu… |
CVE-2026-84057 | High | 8.1 | 2026-10-08 | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-107780 | Critical | 9.8 | 2026-10-08 | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsControlle… |
CVE-2026-106126 | Critical | 9.9 | 2026-10-08 | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker… |
CVE-2026-84278 | High | 7.2 | 2026-10-08 | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privile… |
CVE-2026-107704 | Critical | 9.8 | 2026-10-08 | The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to exec… |
CVE-2026-107703 | Critical | 9.8 | 2026-10-08 | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized… |