CWE-78 · OS Command Injection (page 13)
Page 13 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2042 | High | 8.8 | 2026-02-20 | Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2026-2041 | High | 8.8 | 2026-02-20 | Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-2035 | Medium | 6.8 | 2026-02-20 | Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2019-25441 | Critical | 9.8 | 2026-02-20 | thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious inp… |
CVE-2026-27113 | Medium | 6.3 | 2026-02-20 | Liquid Prompt is an adaptive prompt for Bash and Zsh. Starting in commit cf3441250bb5d8b45f6f8b389fcdf427a99ac28a and prior to commit a4f6b8d8c90b3eaa33d13dfd1… |
CVE-2026-27190 | High | 8.1 | 2026-02-20 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation… |
CVE-2021-35402 | Critical | 10.0 | 2026-02-20 | PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for sate… |
CVE-2026-2847 | High | 7.2 | 2026-02-20 | A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Man… |
CVE-2026-2846 | High | 7.2 | 2026-02-20 | A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the compo… |
CVE-2025-70831 | Critical | 9.8 | 2026-02-20 | A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-su… |
CVE-2026-26323 | High | 8.8 | 2026-02-19 | OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts… |
CVE-2026-27476 | Critical | 9.8 | 2026-02-19 | RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without pr… |
CVE-2026-26318 | High | 8.8 | 2026-02-19 | systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` out… |
CVE-2026-26280 | High | 8.4 | 2026-02-19 | systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` fu… |
CVE-2026-26189 | Medium | 5.9 | 2026-02-19 | Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-… |
CVE-2025-15559 | Critical | 9.8 | 2026-02-19 | An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the… |
CVE-2026-2686 | Critical | 9.8 | 2026-02-19 | A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipu… |
CVE-2026-2670 | High | 7.2 | 2026-02-18 | A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the comp… |
CVE-2026-27175 | Critical | 9.8 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolat… |
CVE-2025-65791 | Critical | 9.8 | 2026-02-18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. N… |
CVE-2025-12122 | Medium | 6.4 | 2026-02-18 | The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all… |
CVE-2026-2629 | High | 7.3 | 2026-02-17 | A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tt… |
CVE-2026-2630 | High | 8.8 | 2026-02-17 | A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security C… |
CVE-2025-70828 | High | 8.8 | 2026-02-17 | An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration |
CVE-2026-2560 | Medium | 6.3 | 2026-02-16 | A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class… |
CVE-2026-2544 | High | 7.3 | 2026-02-16 | A security flaw has been discovered in yued-fe LuLu UI up to 3.0.0. This issue affects the function child_process.exec of the file run.js. The manipulation res… |
CVE-2026-25108 | High | 8.8 | 2026-02-13 | FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP requ… |
CVE-2026-26068 | Critical | 9.9 | 2026-02-12 | emp3r0r is a stealth-focused C2 designed by Linux users for Linux environments. Prior to 3.21.1, untrusted agent metadata (Transport, Hostname) is accepted dur… |
CVE-2026-25828 | Medium | 5.4 | 2026-02-12 | grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root paramet… |
CVE-2026-25933 | Medium | 6.8 | 2026-02-12 | Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-ap… |
CVE-2026-26029 | High | 7.5 | 2026-02-11 | sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use… |
CVE-2025-65480 | High | 8.8 | 2026-02-11 | An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain… |
CVE-2024-56808 | High | 7.8 | 2026-02-11 | A command injection vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access who have also gained a user acc… |
CVE-2026-26009 | Critical | 9.9 | 2026-02-10 | Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates ex… |
CVE-2026-0652 | High | 8.8 | 2026-02-10 | On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. A… |
CVE-2025-11142 | High | 7.1 | 2026-02-10 | The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited afte… |
CVE-2026-2260 | High | 7.2 | 2026-02-10 | A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument Admin… |
CVE-2026-2210 | High | 7.2 | 2026-02-09 | A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os… |
CVE-2026-2188 | High | 7.2 | 2026-02-08 | A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a ma… |
CVE-2026-2184 | High | 7.3 | 2026-02-08 | A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unkno… |
CVE-2026-2175 | High | 7.2 | 2026-02-08 | A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. This manipulation of… |
CVE-2026-2167 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The ma… |
CVE-2026-2157 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_route_table. Such man… |
CVE-2026-2155 | High | 7.2 | 2026-02-08 | A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Con… |
CVE-2026-2152 | High | 7.2 | 2026-02-08 | A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web Configuration Interf… |
CVE-2026-2151 | High | 7.2 | 2026-02-08 | A vulnerability has been found in D-Link DIR-615 4.10. This affects an unknown part of the file adv_firewall.php of the component DMZ Host Feature. Such manipu… |
CVE-2026-2143 | High | 7.2 | 2026-02-08 | A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component… |
CVE-2026-2142 | High | 7.2 | 2026-02-08 | A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulat… |
CVE-2026-2131 | Medium | 6.3 | 2026-02-08 | A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the argument… |
CVE-2026-2129 | High | 7.2 | 2026-02-08 | A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manip… |
CVE-2026-2120 | High | 7.2 | 2026-02-08 | A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configurati… |
CVE-2026-25857 | High | 8.8 | 2026-02-07 | Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). T… |
CVE-2026-2084 | High | 7.2 | 2026-02-07 | A weakness has been identified in D-Link DIR-823X 250416. This impacts an unknown function of the file /goform/set_language. Executing a manipulation of the ar… |
CVE-2026-2082 | Medium | 4.7 | 2026-02-07 | A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of t… |
CVE-2026-2081 | Medium | 4.7 | 2026-02-07 | A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of th… |
CVE-2026-25763 | Critical | 9.9 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in Open… |
CVE-2026-1731 | Critical | 9.8 | 2026-02-06 | BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulner… |
CVE-2026-25593 | High | 8.4 | 2026-02-06 | OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply a… |
CVE-2026-25643 | Critical | 9.1 | 2026-02-06 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulne… |
CVE-2026-2063 | Medium | 4.7 | 2026-02-06 | A security flaw has been discovered in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/set_ac_server of the component Web M… |
CVE-2025-69212 | High | 8.8 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerabilit… |
CVE-2026-2061 | Medium | 4.7 | 2026-02-06 | A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file /goform/set_ipv6. Executing a manipulat… |
CVE-2026-25723 | Medium | 6.5 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo comma… |
CVE-2026-25722 | Critical | 9.1 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations t… |
CVE-2025-64111 | Critical | 9.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update fi… |
CVE-2020-37125 | Critical | 9.8 | 2026-02-05 | Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /… |
CVE-2020-37123 | Critical | 9.8 | 2026-02-05 | Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can… |
CVE-2025-11730 | High | 7.2 | 2026-02-05 | A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 thro… |
CVE-2026-25546 | High | 7.8 | 2026-02-04 | Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in god… |
CVE-2026-25512 | High | 8.8 | 2026-02-04 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execu… |
CVE-2026-25157 | High | 7.7 | 2026-02-04 | OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. Th… |
CVE-2026-25143 | High | 7.8 | 2026-02-04 | melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch… |
CVE-2026-24844 | High | 7.9 | 2026-02-04 | melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, bu… |
CVE-2026-21893 | High | 7.2 | 2026-02-04 | n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community… |
CVE-2026-25053 | Critical | 9.9 | 2026-02-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with perm… |
CVE-2026-24887 | High | 8.8 | 2026-02-03 | Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prom… |
CVE-2025-52626 | Medium | 4.5 | 2026-02-03 | A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the… |
CVE-2026-22550 | High | 8.8 | 2026-02-03 | OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command executio… |
CVE-2026-0383 | High | 7.8 | 2026-02-03 | A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file con… |
CVE-2026-24763 | High | 8.8 | 2026-02-02 | OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw… |
CVE-2026-23515 | Critical | 9.9 | 2026-02-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with… |
CVE-2026-22229 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Ar… |
CVE-2026-22227 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE2… |
CVE-2026-22226 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Arc… |
CVE-2026-22225 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2 and Archer AXE75 v1… |
CVE-2026-22224 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2. Succ… |
CVE-2026-22223 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful… |
CVE-2026-22222 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) allows adjacent authenticated attacker to execute arbitrary code. Successfu… |
CVE-2026-22221 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful… |
CVE-2026-0631 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and OpenVPN of AXE75 v1 allows an adjacent authenticated attacker to execut… |
CVE-2026-0630 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent authenticated attacker to execute arb… |
CVE-2025-9974 | High | 8.0 | 2026-02-02 | The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level comma… |
CVE-2026-24788 | High | 8.8 | 2026-02-02 | RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who… |
CVE-2020-37032 | High | 8.8 | 2026-01-30 | Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. A… |
CVE-2020-37027 | Critical | 9.8 | 2026-01-30 | Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts… |
CVE-2026-25130 | Critical | 9.6 | 2026-01-30 | Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument… |
CVE-2026-1723 | | 2026-01-30 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This is… | |
CVE-2025-51958 | Critical | 9.8 | 2026-01-30 | aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postac… |
CVE-2026-0709 | High | 7.2 | 2026-01-30 | Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials… |
CVE-2026-22277 | High | 7.8 | 2026-01-30 | Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability… |