CWE-78 · OS Command Injection (page 10)
Page 10 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5978 | Critical | 9.8 | 2026-04-09 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-5977 | Critical | 9.8 | 2026-04-09 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-5976 | Critical | 9.8 | 2026-04-09 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-5975 | Critical | 9.8 | 2026-04-09 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-5974 | High | 7.3 | 2026-04-09 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/termina… |
CVE-2026-5973 | High | 7.3 | 2026-04-09 | A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation… |
CVE-2026-5972 | High | 7.3 | 2026-04-09 | A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/… |
CVE-2026-40088 | Critical | 9.6 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via a… |
CVE-2026-5854 | Critical | 9.8 | 2026-04-09 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-5853 | Critical | 9.8 | 2026-04-09 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LanCfg of the file /… |
CVE-2026-5852 | Critical | 9.8 | 2026-04-09 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-5851 | Critical | 9.8 | 2026-04-09 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-5850 | Critical | 9.8 | 2026-04-09 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the compon… |
CVE-2026-5844 | High | 7.2 | 2026-04-09 | A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkSettings Handler. T… |
CVE-2026-5831 | Medium | 6.3 | 2026-04-09 | A security flaw has been discovered in Agions taskflow-ai up to 2.1.8. This impacts an unknown function of the file src/mcp/server/handlers.ts of the component… |
CVE-2026-40032 | High | 7.8 | 2026-04-08 | UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline… |
CVE-2026-40030 | High | 7.8 | 2026-04-08 | parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() s… |
CVE-2026-40029 | High | 7.8 | 2026-04-08 | parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell comman… |
CVE-2026-5802 | High | 7.3 | 2026-04-08 | A vulnerability was identified in idachev mcp-javadc up to 1.2.4. Impacted is an unknown function of the component HTTP Interface. Such manipulation of the arg… |
CVE-2026-39862 | High | 8.8 | 2026-04-08 | Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 UR… |
CVE-2026-30818 | High | 8.0 | 2026-04-08 | An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code whe… |
CVE-2026-30815 | High | 8.0 | 2026-04-08 | An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands wh… |
CVE-2026-27806 | High | 7.8 | 2026-04-08 | Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's pass… |
CVE-2026-5208 | High | 8.2 | 2026-04-08 | Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands… |
CVE-2026-5741 | High | 7.3 | 2026-04-07 | A weakness has been identified in suvarchal docker-mcp-server up to 0.1.0. The impacted element is the function stop_container/remove_container/pull_image of t… |
CVE-2026-39382 | | 2026-04-07 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable… | |
CVE-2026-4631 | Critical | 9.8 | 2026-04-07 | Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An att… |
CVE-2026-35585 | High | 7.2 | 2026-04-07 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33… |
CVE-2026-35581 | High | 7.2 | 2026-04-07 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-der… |
CVE-2026-35521 | High | 8.8 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine conta… |
CVE-2026-35520 | High | 8.8 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine conta… |
CVE-2026-35519 | High | 8.8 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine conta… |
CVE-2026-35518 | High | 8.8 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine conta… |
CVE-2026-35517 | High | 8.8 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine conta… |
CVE-2025-24817 | High | 8.0 | 2026-04-07 | Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Co… |
CVE-2026-35463 | High | 8.8 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts securi… |
CVE-2021-4473 | Critical | 9.8 | 2026-04-07 | Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers… |
CVE-2026-34197 | High | 8.8 | 2026-04-07 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ… |
CVE-2026-5692 | High | 7.3 | 2026-04-07 | A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi. The manipulatio… |
CVE-2026-5691 | High | 7.3 | 2026-04-06 | A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setFirewallType of the file /cgi-bin/cstecgi.cgi. The manipu… |
CVE-2026-5690 | High | 7.3 | 2026-04-06 | A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi. Executing a… |
CVE-2026-5689 | High | 7.3 | 2026-04-06 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/cstecgi.cgi. Perform… |
CVE-2026-5688 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Such… |
CVE-2026-5709 | High | 8.8 | 2026-04-06 | Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated act… |
CVE-2026-5707 | High | 8.8 | 2026-04-06 | Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01… |
CVE-2026-5679 | Medium | 5.5 | 2026-04-06 | A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cs… |
CVE-2026-5678 | High | 7.3 | 2026-04-06 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-5677 | High | 7.3 | 2026-04-06 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing… |
CVE-2026-35043 | High | 7.8 | 2026-04-06 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/be… |
CVE-2026-34977 | Critical | 9.8 | 2026-04-06 | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploading a JPEG, a user can specify an optional password to acc… |
CVE-2026-34982 | High | 8.2 | 2026-04-06 | Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user… |
CVE-2026-34940 | High | 8.7 | 2026-04-06 | KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constr… |
CVE-2026-5663 | High | 7.3 | 2026-04-06 | A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/stores… |
CVE-2026-31067 | Medium | 6.8 | 2026-04-06 | A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows attackers to execute a… |
CVE-2026-5621 | Medium | 5.3 | 2026-04-06 | A vulnerability was found in ChrisChinchilla Vale-MCP up to 0.1.0. Affected by this vulnerability is an unknown functionality of the file src/index.ts of the c… |
CVE-2026-5619 | Medium | 5.3 | 2026-04-06 | A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the compone… |
CVE-2026-5603 | Medium | 5.3 | 2026-04-05 | A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts… |
CVE-2026-5602 | Medium | 5.3 | 2026-04-05 | A vulnerability was determined in Nor2-io heim-mcp up to 0.1.3. Impacted is the function registerTools of the file src/tools.ts of the component new_heim_appli… |
CVE-2026-5547 | Medium | 6.3 | 2026-04-05 | A vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01. Affected is the function formAddMacfilterRule of the file /bin/httpd. Such manipulation l… |
CVE-2026-5532 | Medium | 6.3 | 2026-04-05 | A vulnerability was found in ScrapeGraphAI scrapegraph-ai up to 1.74.0. The affected element is the function create_sandbox_and_execute of the file scrapegraph… |
CVE-2026-5528 | Medium | 6.3 | 2026-04-05 | A security vulnerability has been detected in MoussaabBadla code-screenshot-mcp up to 0.1.0. This affects an unknown part of the component HTTP Interface. Such… |
CVE-2026-34955 | High | 8.8 | 2026-04-04 | PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with… |
CVE-2026-34779 | Medium | 6.5 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-be… |
CVE-2026-34937 | High | 7.8 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolating user-controlled… |
CVE-2026-34935 | Critical | 9.8 | 2026-04-03 | PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded… |
CVE-2017-20236 | Critical | 9.8 | 2026-04-03 | ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote at… |
CVE-2026-28797 | High | 8.8 | 2026-04-03 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exis… |
CVE-2026-5485 | High | 7.8 | 2026-04-03 | OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute a… |
CVE-2026-35216 | Critical | 9.0 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase serv… |
CVE-2026-25044 | High | 8.8 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper s… |
CVE-2025-64340 | Medium | 6.7 | 2026-04-03 | FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause comma… |
CVE-2026-5355 | Medium | 6.3 | 2026-04-02 | A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpn_drop of the file /setup.cgi. The manipulation of the a… |
CVE-2026-5354 | Medium | 6.3 | 2026-04-02 | A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affected by this vulnerability is the function vpn_connect of the file /setup.cgi. Executing a manipulatio… |
CVE-2026-5353 | Medium | 6.3 | 2026-04-02 | A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. Affected is the function ping_test of the file /setup.cgi. Performing a manipulation of the argumen… |
CVE-2026-5352 | Medium | 6.3 | 2026-04-02 | A security vulnerability has been detected in Trendnet TEW-657BRM 1.00.1. This impacts the function Edit of the file /setup.cgi. Such manipulation of the argum… |
CVE-2026-5351 | Medium | 6.3 | 2026-04-02 | A weakness has been identified in Trendnet TEW-657BRM 1.00.1. This affects the function add_wps_client of the file /setup.cgi. This manipulation of the argumen… |
CVE-2026-34797 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_smtp.cgi. The DATE… |
CVE-2026-34796 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DA… |
CVE-2026-34795 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_log.cgi. The DATE p… |
CVE-2026-34794 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_ids.cgi. The DATE p… |
CVE-2026-34793 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_firewall.cgi. The D… |
CVE-2026-34792 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_clamav.cgi. The DAT… |
CVE-2026-34791 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_proxy.cgi. The DATE… |
CVE-2026-33641 | High | 7.8 | 2026-04-02 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings encl… |
CVE-2026-3692 | High | 8.8 | 2026-04-02 | In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generat… |
CVE-2026-2701 | Critical | 9.1 | 2026-04-02 | Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution. |
CVE-2026-33613 | High | 7.2 | 2026-04-02 | Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray functi… |
CVE-2026-1345 | High | 7.3 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-24154 | High | 7.6 | 2026-03-31 | NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful… |
CVE-2026-34243 | Critical | 9.8 | 2026-03-31 | wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow… |
CVE-2026-30314 | Critical | 9.8 | 2026-03-31 | Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely inef… |
CVE-2026-30312 | Critical | 9.8 | 2026-03-31 | DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineff… |
CVE-2026-30311 | Critical | 9.8 | 2026-03-31 | Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely inef… |
CVE-2026-30309 | High | 7.8 | 2026-03-31 | InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffecti… |
CVE-2026-0596 | High | 7.8 | 2026-03-31 | A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell c… |
CVE-2026-32917 | Critical | 9.8 | 2026-03-31 | OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary… |
CVE-2025-14213 | | 2026-03-31 | Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interf… | |
CVE-2026-30880 | Critical | 9.8 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been p… |
CVE-2026-30877 | Critical | 9.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this is… |
CVE-2026-21861 | Critical | 9.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality… |