CWE-78 · OS Command Injection (page 13)
Page 13 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8190 | Medium | 6.3 | 2026-05-09 | A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of… |
CVE-2026-8189 | Medium | 6.3 | 2026-05-09 | A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipu… |
CVE-2026-8188 | Medium | 6.3 | 2026-05-09 | A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation o… |
CVE-2026-3828 | High | 7.2 | 2026-05-09 | Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation… |
CVE-2026-44656 | Medium | 5.3 | 2026-05-08 | Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion… |
CVE-2026-42454 | Critical | 9.9 | 2026-05-08 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container mana… |
CVE-2026-42307 | Medium | 4.4 | 2026-05-08 | Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled w… |
CVE-2026-41497 | Critical | 9.8 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument vali… |
CVE-2022-50994 | High | 8.1 | 2026-05-08 | DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote… |
CVE-2026-8153 | Critical | 9.8 | 2026-05-08 | OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands tha… |
CVE-2025-67888 | High | 7.3 | 2026-05-08 | An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" paramet… |
CVE-2024-51092 | Critical | 9.1 | 2026-05-08 | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController… |
CVE-2022-45899 | Medium | 6.5 | 2026-05-08 | Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the L… |
CVE-2026-43943 | High | 7.8 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists i… |
CVE-2026-42271 | High | 8.8 | 2026-05-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to previ… |
CVE-2026-41900 | High | 8.8 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identifie… |
CVE-2026-8112 | Medium | 6.3 | 2026-05-07 | A vulnerability was found in 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84. Affected is the function executeCognitivePulse of the file src/ke… |
CVE-2026-42215 | High | 8.8 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such… |
CVE-2025-63705 | High | 8.8 | 2026-05-07 | NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js. |
CVE-2025-9661 | High | 8.1 | 2026-05-07 | OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. This issue aff… |
CVE-2026-31196 | High | 8.8 | 2026-05-05 | OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware… |
CVE-2026-31195 | High | 8.8 | 2026-05-05 | OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN80… |
CVE-2026-36356 | Critical | 9.1 | 2026-05-05 | The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /actio… |
CVE-2026-7823 | Critical | 9.8 | 2026-05-05 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The man… |
CVE-2026-7785 | High | 7.3 | 2026-05-05 | A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89. This affect… |
CVE-2026-41926 | | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers t… | |
CVE-2026-41925 | | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows… | |
CVE-2026-41924 | | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated… | |
CVE-2026-41923 | | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated re… | |
CVE-2026-41922 | | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the wireless.cgi binary that allows unauthenticated re… | |
CVE-2026-42076 | Critical | 9.8 | 2026-05-04 | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows at… |
CVE-2025-13605 | | 2026-05-04 | 3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the con… | |
CVE-2026-7730 | Medium | 6.3 | 2026-05-04 | A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function child_process.spawn of the file src/index.ts of the component MCP Int… |
CVE-2026-42364 | Critical | 9.9 | 2026-05-04 | An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can… |
CVE-2026-7698 | High | 7.3 | 2026-05-03 | A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /E… |
CVE-2026-7653 | Medium | 6.3 | 2026-05-02 | A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4. Affected is the function open_image_in_browser of the file src/index.ts of… |
CVE-2026-7642 | Medium | 6.3 | 2026-05-02 | A vulnerability was detected in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts of the component MC… |
CVE-2026-7609 | Medium | 6.3 | 2026-05-02 | A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function tools_diagnostic of the file /tmp/diagnostic of the component… |
CVE-2026-7608 | Medium | 5.5 | 2026-05-02 | A vulnerability was detected in TRENDnet TEW-821DAP up to 1.12B01. The affected element is the function tools_diagnostic. The manipulation results in os comman… |
CVE-2026-7600 | Medium | 6.3 | 2026-05-02 | A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the compone… |
CVE-2026-7593 | High | 7.3 | 2026-05-01 | A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0. This impacts the function execute_command of the file sr… |
CVE-2026-7590 | High | 7.3 | 2026-05-01 | A vulnerability was identified in eyal-gor p_69_branch_monkey_mcp up to 69bc71874ce40050ef45fde5a435855f18af3373. The affected element is an unknown function o… |
CVE-2026-43003 | High | 8.0 | 2026-05-01 | An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot o… |
CVE-2026-42994 | Critical | 9.8 | 2026-05-01 | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply… |
CVE-2026-7538 | Critical | 9.8 | 2026-05-01 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function Vulnerability of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-7551 | High | 8.8 | 2026-04-30 | HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute a… |
CVE-2026-7461 | High | 7.2 | 2026-04-30 | Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version… |
CVE-2025-71284 | Critical | 9.8 | 2026-04-30 | Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiu… |
CVE-2026-7246 | High | 7.2 | 2026-04-30 | This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record desc… |
CVE-2026-7446 | High | 7.3 | 2026-04-30 | A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/sca… |
CVE-2026-7443 | High | 7.3 | 2026-04-29 | A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of… |
CVE-2026-7416 | High | 7.3 | 2026-04-29 | A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the compone… |
CVE-2026-6849 | High | 8.8 | 2026-04-29 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Insti… |
CVE-2026-7244 | Critical | 9.8 | 2026-04-28 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cste… |
CVE-2026-7243 | Critical | 9.8 | 2026-04-28 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7242 | Critical | 9.8 | 2026-04-28 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-7241 | Critical | 9.8 | 2026-04-28 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-7240 | Critical | 9.8 | 2026-04-28 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.c… |
CVE-2024-54012 | Medium | 5.3 | 2026-04-28 | Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted reques… |
CVE-2026-7220 | High | 7.3 | 2026-04-28 | A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-m… |
CVE-2026-1460 | High | 7.2 | 2026-04-28 | A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware ve… |
CVE-2026-0711 | Medium | 6.8 | 2026-04-28 | A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.1)C0 could allow an… |
CVE-2026-7204 | Critical | 9.8 | 2026-04-28 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7203 | Critical | 9.8 | 2026-04-28 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-7202 | Critical | 9.8 | 2026-04-28 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the compo… |
CVE-2026-32649 | Medium | 6.8 | 2026-04-28 | A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras. |
CVE-2026-7156 | Critical | 9.8 | 2026-04-27 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI… |
CVE-2026-7155 | Critical | 9.8 | 2026-04-27 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi… |
CVE-2026-7154 | Critical | 9.8 | 2026-04-27 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-7153 | Critical | 9.8 | 2026-04-27 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cs… |
CVE-2026-7152 | Critical | 9.8 | 2026-04-27 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-7140 | Critical | 9.8 | 2026-04-27 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component C… |
CVE-2026-7139 | Critical | 9.8 | 2026-04-27 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-7138 | Critical | 9.8 | 2026-04-27 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-7137 | Critical | 9.8 | 2026-04-27 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-7136 | Critical | 9.8 | 2026-04-27 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7125 | Critical | 9.8 | 2026-04-27 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-7124 | Critical | 9.8 | 2026-04-27 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstec… |
CVE-2026-7123 | Critical | 9.8 | 2026-04-27 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Ha… |
CVE-2026-7122 | Critical | 9.8 | 2026-04-27 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-7121 | Critical | 9.8 | 2026-04-27 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Han… |
CVE-2026-7119 | High | 8.8 | 2026-04-27 | A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argumen… |
CVE-2026-7096 | High | 8.8 | 2026-04-27 | A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. T… |
CVE-2026-7066 | High | 7.3 | 2026-04-27 | A vulnerability was found in choieastsea simple-openstack-mcp up to 767b2f4a8154cca344344b9725537a58399e6036. The affected element is the function exec_opensta… |
CVE-2026-33277 | High | 8.8 | 2026-04-27 | An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user. |
CVE-2026-7064 | High | 7.3 | 2026-04-26 | A flaw has been found in AgentDeskAI browser-tools-mcp up to 1.2.0. This issue affects some unknown processing of the file browser-tools-server/browser-connect… |
CVE-2026-7062 | High | 7.3 | 2026-04-26 | A security vulnerability has been detected in Intina47 context-sync up to 2.0.0. This affects an unknown part of the file src/git-integration.ts of the compone… |
CVE-2026-7061 | High | 7.3 | 2026-04-26 | A weakness has been identified in Toowiredd chatgpt-mcp-server up to 0.1.0. Affected by this issue is some unknown functionality of the file src/services/docke… |
CVE-2026-7037 | Critical | 9.8 | 2026-04-26 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-6992 | High | 7.2 | 2026-04-25 | A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh… |
CVE-2026-41421 | High | 8.8 | 2026-04-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messages as raw HTML inside an Electron rend… |
CVE-2026-41411 | Medium | 6.6 | 2026-04-24 | Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag… |
CVE-2026-33208 | High | 8.8 | 2026-04-24 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpo… |
CVE-2026-6942 | Critical | 9.8 | 2026-04-23 | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing th… |
CVE-2026-41247 | Critical | 9.8 | 2026-04-23 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in… |
CVE-2026-31181 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter t… |
CVE-2026-31178 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to… |
CVE-2026-31177 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to… |
CVE-2026-41208 | High | 8.8 | 2026-04-23 | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain… |
CVE-2026-5935 | High | 7.3 | 2026-04-23 | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with n… |