CWE-78 · OS Command Injection (page 14)
Page 14 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21418 | High | 7.8 | 2026-01-30 | Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability… |
CVE-2026-1665 | | 2026-01-29 | A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget command… | |
CVE-2026-25063 | High | 7.8 | 2026-01-29 | gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gradle-completion up to and including 9.3… |
CVE-2026-24905 | High | 7.8 | 2026-01-29 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The `ig` binary p… |
CVE-2020-37012 | Critical | 9.8 | 2026-01-29 | Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php end… |
CVE-2020-37002 | Critical | 9.8 | 2026-01-29 | Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful… |
CVE-2026-1544 | Medium | 6.3 | 2026-01-28 | A security flaw has been discovered in D-Link DIR-823X 250416. Impacted is the function sub_41E2A0 of the file /goform/set_mode. Performing a manipulation of t… |
CVE-2025-57283 | High | 7.8 | 2026-01-28 | The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in… |
CVE-2026-1506 | High | 7.2 | 2026-01-28 | A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php of the component MAC Filter Configuratio… |
CVE-2026-1505 | High | 7.2 | 2026-01-28 | A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The m… |
CVE-2026-24841 | Critical | 9.9 | 2026-01-28 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebS… |
CVE-2026-23592 | High | 7.2 | 2026-01-27 | Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated attackers to achieve remote code execution… |
CVE-2025-33234 | High | 7.8 | 2026-01-27 | NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, d… |
CVE-2026-1448 | High | 7.2 | 2026-01-27 | A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Manageme… |
CVE-2026-1428 | High | 8.8 | 2026-01-26 | Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS c… |
CVE-2026-1427 | High | 8.8 | 2026-01-26 | Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS c… |
CVE-2025-67264 | High | 7.8 | 2026-01-23 | An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local attacker to execute a… |
CVE-2021-47903 | High | 8.8 | 2026-01-23 | LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated adm… |
CVE-2026-0796 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0795 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0787 | Critical | 9.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0786 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0785 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0784 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0783 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0782 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0781 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0780 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0779 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-0765 | High | 8.8 | 2026-01-23 | Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2026-0759 | Critical | 9.8 | 2026-01-23 | Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2026-0758 | High | 7.8 | 2026-01-23 | mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges o… |
CVE-2026-0757 | High | 8.8 | 2026-01-23 | MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox… |
CVE-2026-0756 | Critical | 9.8 | 2026-01-23 | github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0755 | Critical | 9.8 | 2026-01-23 | gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect… |
CVE-2025-15063 | Critical | 9.8 | 2026-01-23 | Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2025-15061 | Critical | 9.8 | 2026-01-23 | Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-24129 | High | 8.0 | 2026-01-22 | Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authentica… |
CVE-2025-56590 | Critical | 9.8 | 2026-01-22 | An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary… |
CVE-2026-1324 | High | 8.8 | 2026-01-22 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionController of… |
CVE-2026-23699 | High | 7.2 | 2026-01-22 | AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary… |
CVE-2021-47851 | Critical | 9.8 | 2026-01-21 | Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. A… |
CVE-2021-47748 | Critical | 9.8 | 2026-01-21 | Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. A… |
CVE-2025-33230 | High | 7.3 | 2026-01-20 | NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious… |
CVE-2025-33228 | High | 7.3 | 2026-01-20 | NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string… |
CVE-2026-22844 | Critical | 9.9 | 2026-01-20 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execu… |
CVE-2021-47816 | High | 8.8 | 2026-01-16 | Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands th… |
CVE-2026-20759 | High | 8.8 | 2026-01-16 | OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the l… |
CVE-2021-47794 | High | 8.8 | 2026-01-16 | ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payload… |
CVE-2026-23520 | Critical | 9.0 | 2026-01-15 | Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle… |
CVE-2026-22265 | High | 7.5 | 2026-01-15 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log view… |
CVE-2025-62193 | Critical | 9.8 | 2026-01-15 | Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By l… |
CVE-2025-33206 | High | 7.8 | 2026-01-14 | NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection. A successful exploit of this vulnerability might lea… |
CVE-2026-22708 | Critical | 9.8 | 2026-01-14 | Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shel… |
CVE-2026-22718 | Medium | 6.8 | 2026-01-14 | The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine. |
CVE-2023-54339 | Critical | 9.8 | 2026-01-13 | Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index… |
CVE-2022-50919 | Critical | 9.8 | 2026-01-13 | Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands… |
CVE-2022-50909 | High | 8.8 | 2026-01-13 | Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arb… |
CVE-2025-37172 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37171 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37170 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2026-21267 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2025-64155 | Critical | 9.8 | 2026-01-13 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 throug… |
CVE-2025-13447 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-13444 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2026-0507 | High | 8.4 | 2026-01-13 | Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access… |
CVE-2026-22781 | Critical | 9.8 | 2026-01-12 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDE… |
CVE-2026-0855 | High | 8.8 | 2026-01-12 | Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS comm… |
CVE-2026-0854 | High | 8.8 | 2026-01-12 | Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS comman… |
CVE-2025-69269 | Critical | 9.8 | 2026-01-12 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allow… |
CVE-2025-15502 | High | 7.3 | 2026-01-10 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController of th… |
CVE-2025-15501 | Critical | 9.8 | 2026-01-09 | A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /is… |
CVE-2025-15500 | Critical | 9.8 | 2026-01-09 | A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-pro… |
CVE-2025-15499 | High | 8.8 | 2026-01-09 | A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function uploadCN of the file… |
CVE-2026-0830 | High | 7.8 | 2026-01-09 | Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before vers… |
CVE-2025-46645 | Medium | 6.5 | 2026-01-09 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10… |
CVE-2025-46644 | Medium | 6.0 | 2026-01-09 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10… |
CVE-2025-66052 | High | 7.2 | 2026-01-09 | Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint i… |
CVE-2025-64091 | High | 8.6 | 2026-01-09 | This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device. |
CVE-2026-22035 | High | 7.7 | 2026-01-08 | Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing… |
CVE-2019-25289 | High | 8.8 | 2026-01-08 | SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'te… |
CVE-2017-20216 | Critical | 9.8 | 2026-01-08 | FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem… |
CVE-2017-20215 | High | 8.8 | 2026-01-08 | FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell comma… |
CVE-2025-69262 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc config… |
CVE-2025-6225 | | 2026-01-07 | Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. Th… | |
CVE-2025-15472 | High | 7.2 | 2026-01-07 | A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation… |
CVE-2025-15471 | Critical | 9.8 | 2026-01-07 | A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the ar… |
CVE-2020-36910 | High | 8.8 | 2026-01-06 | Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploi… |
CVE-2025-59157 | Critical | 9.9 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field… |
CVE-2025-59156 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution… |
CVE-2025-5965 | High | 7.2 | 2026-01-05 | In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Element… |
CVE-2025-64124 | High | 8.8 | 2026-01-03 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-64120 | High | 8.8 | 2026-01-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-66398 | Critical | 9.6 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal sta… |
CVE-2025-68700 | High | 8.8 | 2025-12-31 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account)… |
CVE-2015-10145 | High | 8.8 | 2025-12-31 | Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/run_commands.sh. The application fail… |
CVE-2021-47747 | High | 8.8 | 2025-12-31 | meterN 1.2.3 contains an authenticated remote code execution vulnerability in admin_meter2.php and admin_indicator2.php scripts. Attackers can exploit the 'COM… |
CVE-2021-47745 | High | 8.8 | 2025-12-31 | Cypress Solutions CTM-200 2.7.1 contains an authenticated command injection vulnerability in the firmware upgrade script that allows remote attackers to execut… |
CVE-2025-15389 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |
CVE-2025-15388 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |