CWE-78 · OS Command Injection (page 14)
Page 14 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41179 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1… |
CVE-2026-40517 | High | 7.8 | 2026-04-22 | radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary command… |
CVE-2026-41064 | Critical | 9.3 | 2026-04-22 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget bu… |
CVE-2026-40933 | Critical | 9.9 | 2026-04-21 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the M… |
CVE-2026-21571 | High | 8.8 | 2026-04-21 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamb… |
CVE-2026-31019 | High | 8.8 | 2026-04-21 | In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to sys… |
CVE-2026-40520 | High | 7.2 | 2026-04-21 | FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fiel… |
CVE-2026-41036 | High | 8.8 | 2026-04-21 | This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. An authenticated re… |
CVE-2026-5965 | Critical | 9.8 | 2026-04-21 | NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute… |
CVE-2026-32311 | Critical | 9.8 | 2026-04-20 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint allows a user to cre… |
CVE-2026-26943 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-26942 | Medium | 6.7 | 2026-04-20 | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS command injection… |
CVE-2026-24506 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-22761 | Medium | 6.7 | 2026-04-20 | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A high privileged attacker with remote access could potentia… |
CVE-2026-23774 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug… |
CVE-2026-5967 | High | 8.8 | 2026-04-20 | ThreatSonar Anti-Ransomware developed by TeamT5 has an Privilege Escalation vulnerability. Authenticated remote attackers with shell access can inject OS comma… |
CVE-2026-6644 | Critical | 9.1 | 2026-04-20 | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted… |
CVE-2026-35582 | High | 8.8 | 2026-04-18 | Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection because it int… |
CVE-2026-40527 | High | 7.8 | 2026-04-17 | radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 com… |
CVE-2026-33145 | Medium | 6.3 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handlin… |
CVE-2026-23500 | Critical | 9.1 | 2026-04-17 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF con… |
CVE-2026-6483 | High | 7.2 | 2026-04-17 | A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipu… |
CVE-2026-35074 | Medium | 6.7 | 2026-04-17 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2… |
CVE-2026-35073 | Medium | 6.7 | 2026-04-17 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2… |
CVE-2026-35072 | Medium | 6.7 | 2026-04-17 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2… |
CVE-2026-21719 | High | 7.2 | 2026-04-17 | An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS com… |
CVE-2026-41113 | High | 8.1 | 2026-04-16 | sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c. |
CVE-2026-6349 | Critical | 9.8 | 2026-04-16 | The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and exec… |
CVE-2026-41015 | High | 7.4 | 2026-04-16 | radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use th… |
CVE-2026-40261 | High | 8.8 | 2026-04-15 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCode… |
CVE-2026-40176 | High | 7.8 | 2026-04-15 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generate… |
CVE-2026-40499 | High | 7.8 | 2026-04-15 | radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary… |
CVE-2026-33414 | High | 7.8 | 2026-04-14 | Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in… |
CVE-2026-35196 | High | 8.8 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gr… |
CVE-2026-24893 | High | 8.8 | 2026-04-14 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a comma… |
CVE-2026-39808 | Critical | 9.8 | 2026-04-14 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may all… |
CVE-2026-40288 | Critical | 9.8 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary… |
CVE-2026-39420 | Medium | 6.3 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with… |
CVE-2026-39417 | Medium | 4.6 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulne… |
CVE-2026-6195 | Critical | 9.8 | 2026-04-13 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setPasswordCfg of the file /cgi-bin… |
CVE-2026-28291 | High | 8.1 | 2026-04-13 | simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option ma… |
CVE-2026-34188 | High | 7.2 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pa… |
CVE-2026-30809 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandor… |
CVE-2026-30806 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS… |
CVE-2026-6204 | High | 7.2 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand… |
CVE-2026-6158 | High | 7.3 | 2026-04-13 | A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argumen… |
CVE-2026-6156 | Critical | 9.8 | 2026-04-13 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-6155 | Critical | 9.8 | 2026-04-13 | A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-6154 | Critical | 9.8 | 2026-04-13 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cg… |
CVE-2026-6141 | Medium | 6.3 | 2026-04-13 | A vulnerability was determined in danielmiessler Personal_AI_Infrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parse_… |
CVE-2026-6140 | Critical | 9.8 | 2026-04-13 | A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the compon… |
CVE-2026-6139 | Critical | 9.8 | 2026-04-13 | A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-6138 | Critical | 9.8 | 2026-04-13 | A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-6132 | Critical | 9.8 | 2026-04-12 | A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-6131 | Critical | 9.8 | 2026-04-12 | A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecg… |
CVE-2026-6130 | High | 7.3 | 2026-04-12 | A flaw has been found in chatboxai chatbox up to 1.20.0. This impacts the function StdioClientTransport of the file src/main/mcp/ipc-stdio-transport.ts of the… |
CVE-2026-6116 | Critical | 9.8 | 2026-04-12 | A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.c… |
CVE-2026-6115 | Critical | 9.8 | 2026-04-12 | A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setAppCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handl… |
CVE-2026-6114 | Critical | 9.8 | 2026-04-12 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setNetworkCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-6113 | Critical | 9.8 | 2026-04-12 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTtyServiceCfg of the fil… |
CVE-2026-6112 | Critical | 9.8 | 2026-04-12 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-6108 | Medium | 6.3 | 2026-04-12 | A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1. The affected element is the function execute of the file apps/application/flow/step_node/mcp_node/im… |
CVE-2026-5059 | Critical | 9.8 | 2026-04-11 | aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-5058 | Critical | 9.8 | 2026-04-11 | aws-mcp-server Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa… |
CVE-2026-4157 | High | 7.5 | 2026-04-11 | ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arb… |
CVE-2026-32892 | Critical | 9.1 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move funct… |
CVE-2026-6029 | Critical | 9.8 | 2026-04-10 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-6028 | Critical | 9.8 | 2026-04-10 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-6027 | Critical | 9.8 | 2026-04-10 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This issue affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-6026 | Critical | 9.8 | 2026-04-10 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setPortalConfWeChat of the file /cgi-bin/… |
CVE-2026-6025 | Critical | 9.8 | 2026-04-10 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the compone… |
CVE-2026-5997 | Critical | 9.8 | 2026-04-10 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cg… |
CVE-2026-5996 | Critical | 9.8 | 2026-04-10 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setAdvancedInfoShow of the file /cgi-… |
CVE-2026-5995 | Critical | 9.8 | 2026-04-10 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-5994 | Critical | 9.8 | 2026-04-10 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This issue affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-5993 | Critical | 9.8 | 2026-04-10 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.c… |
CVE-2026-40111 | High | 8.8 | 2026-04-09 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly t… |
CVE-2026-33791 | Medium | 6.7 | 2026-04-09 | An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executin… |
CVE-2026-21915 | Medium | 6.7 | 2026-04-09 | A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, hig… |
CVE-2026-5978 | Critical | 9.8 | 2026-04-09 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-5977 | Critical | 9.8 | 2026-04-09 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-5976 | Critical | 9.8 | 2026-04-09 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-5975 | Critical | 9.8 | 2026-04-09 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-5974 | High | 7.3 | 2026-04-09 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/termina… |
CVE-2026-5973 | High | 7.3 | 2026-04-09 | A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation… |
CVE-2026-5972 | High | 7.3 | 2026-04-09 | A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/… |
CVE-2026-40088 | Critical | 9.6 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via a… |
CVE-2026-5854 | Critical | 9.8 | 2026-04-09 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi o… |
CVE-2026-5853 | Critical | 9.8 | 2026-04-09 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LanCfg of the file /… |
CVE-2026-5852 | Critical | 9.8 | 2026-04-09 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-5851 | Critical | 9.8 | 2026-04-09 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-5850 | Critical | 9.8 | 2026-04-09 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the compon… |
CVE-2026-5844 | High | 7.2 | 2026-04-09 | A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkSettings Handler. T… |
CVE-2026-5831 | Medium | 6.3 | 2026-04-09 | A security flaw has been discovered in Agions taskflow-ai up to 2.1.8. This impacts an unknown function of the file src/mcp/server/handlers.ts of the component… |
CVE-2026-40032 | High | 7.8 | 2026-04-08 | UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline… |
CVE-2026-40030 | High | 7.8 | 2026-04-08 | parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() s… |
CVE-2026-40029 | High | 7.8 | 2026-04-08 | parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell comman… |
CVE-2026-5802 | High | 7.3 | 2026-04-08 | A vulnerability was identified in idachev mcp-javadc up to 1.2.4. Impacted is an unknown function of the component HTTP Interface. Such manipulation of the arg… |
CVE-2026-39862 | High | 8.8 | 2026-04-08 | Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 UR… |
CVE-2026-30818 | High | 8.0 | 2026-04-08 | An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code whe… |