CWE-78 · OS Command Injection (page 19)
Page 19 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1427 | High | 8.8 | 2026-01-26 | Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS c… |
CVE-2025-67264 | High | 7.8 | 2026-01-23 | An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local attacker to execute a… |
CVE-2021-47903 | High | 8.8 | 2026-01-23 | LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated adm… |
CVE-2026-0796 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0795 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0787 | Critical | 9.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0786 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0785 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0784 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0783 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0782 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0781 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0780 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0779 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-0759 | Critical | 9.8 | 2026-01-23 | Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2026-0758 | High | 7.8 | 2026-01-23 | mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges o… |
CVE-2026-0757 | High | 8.8 | 2026-01-23 | MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox… |
CVE-2026-0756 | Critical | 9.8 | 2026-01-23 | github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0755 | Critical | 9.8 | 2026-01-23 | gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect… |
CVE-2025-15063 | Critical | 9.8 | 2026-01-23 | Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2025-15061 | Critical | 9.8 | 2026-01-23 | Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-24129 | High | 8.0 | 2026-01-22 | Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authentica… |
CVE-2025-56590 | Critical | 9.8 | 2026-01-22 | An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary… |
CVE-2026-1324 | High | 8.8 | 2026-01-22 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionController of… |
CVE-2026-23699 | High | 7.2 | 2026-01-22 | AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary… |
CVE-2021-47851 | Critical | 9.8 | 2026-01-21 | Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. A… |
CVE-2021-47748 | Critical | 9.8 | 2026-01-21 | Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. A… |
CVE-2025-33230 | High | 7.3 | 2026-01-20 | NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious… |
CVE-2025-33228 | High | 7.3 | 2026-01-20 | NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string… |
CVE-2026-22844 | Critical | 9.9 | 2026-01-20 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execu… |
CVE-2021-47816 | High | 8.8 | 2026-01-16 | Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands th… |
CVE-2026-20759 | High | 8.8 | 2026-01-16 | OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the l… |
CVE-2021-47794 | High | 8.8 | 2026-01-16 | ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payload… |
CVE-2026-23520 | Critical | 9.0 | 2026-01-15 | Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle… |
CVE-2026-22265 | High | 7.5 | 2026-01-15 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log view… |
CVE-2025-62193 | Critical | 9.8 | 2026-01-15 | Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By l… |
CVE-2025-33206 | High | 7.8 | 2026-01-14 | NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection. A successful exploit of this vulnerability might lea… |
CVE-2026-22708 | Critical | 9.8 | 2026-01-14 | Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shel… |
CVE-2026-22718 | Medium | 6.8 | 2026-01-14 | The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine. |
CVE-2023-54339 | Critical | 9.8 | 2026-01-13 | Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index… |
CVE-2022-50919 | Critical | 9.8 | 2026-01-13 | Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands… |
CVE-2022-50909 | High | 8.8 | 2026-01-13 | Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arb… |
CVE-2025-37172 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37171 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37170 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2026-21267 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2025-64155 | Critical | 9.8 | 2026-01-13 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 throug… |
CVE-2025-13447 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-13444 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2026-0507 | High | 8.4 | 2026-01-13 | Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access… |
CVE-2026-22781 | Critical | 9.8 | 2026-01-12 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDE… |
CVE-2026-0855 | High | 8.8 | 2026-01-12 | Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS comm… |
CVE-2026-0854 | High | 8.8 | 2026-01-12 | Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS comman… |
CVE-2025-69269 | Critical | 9.8 | 2026-01-12 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allow… |
CVE-2025-15502 | High | 7.3 | 2026-01-10 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController of th… |
CVE-2025-15501 | Critical | 9.8 | 2026-01-09 | A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /is… |
CVE-2025-15500 | Critical | 9.8 | 2026-01-09 | A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-pro… |
CVE-2025-15499 | High | 8.8 | 2026-01-09 | A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function uploadCN of the file… |
CVE-2026-0830 | High | 7.8 | 2026-01-09 | Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before vers… |
CVE-2025-46645 | Medium | 6.5 | 2026-01-09 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10… |
CVE-2025-46644 | Medium | 6.0 | 2026-01-09 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10… |
CVE-2025-66052 | High | 7.2 | 2026-01-09 | Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint i… |
CVE-2025-64091 | High | 8.6 | 2026-01-09 | This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device. |
CVE-2026-22035 | High | 7.7 | 2026-01-08 | Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing… |
CVE-2019-25289 | High | 8.8 | 2026-01-08 | SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'te… |
CVE-2017-20216 | Critical | 9.8 | 2026-01-08 | FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem… |
CVE-2017-20215 | High | 8.8 | 2026-01-08 | FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell comma… |
CVE-2025-69262 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc config… |
CVE-2025-6225 | | 2026-01-07 | Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. Th… | |
CVE-2025-15472 | High | 7.2 | 2026-01-07 | A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation… |
CVE-2025-15471 | Critical | 9.8 | 2026-01-07 | A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the ar… |
CVE-2020-36910 | High | 8.8 | 2026-01-06 | Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploi… |
CVE-2025-59157 | Critical | 9.9 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field… |
CVE-2025-59156 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution… |
CVE-2025-5965 | High | 7.2 | 2026-01-05 | In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Element… |
CVE-2025-64124 | High | 8.8 | 2026-01-03 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-64120 | High | 8.8 | 2026-01-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-66398 | Critical | 9.6 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal sta… |
CVE-2025-68700 | High | 8.8 | 2025-12-31 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account)… |
CVE-2015-10145 | High | 8.8 | 2025-12-31 | Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/run_commands.sh. The application fail… |
CVE-2021-47747 | High | 8.8 | 2025-12-31 | meterN 1.2.3 contains an authenticated remote code execution vulnerability in admin_meter2.php and admin_indicator2.php scripts. Attackers can exploit the 'COM… |
CVE-2021-47745 | High | 8.8 | 2025-12-31 | Cypress Solutions CTM-200 2.7.1 contains an authenticated command injection vulnerability in the firmware upgrade script that allows remote attackers to execut… |
CVE-2025-15389 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |
CVE-2025-15388 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |
CVE-2024-58338 | Critical | 10.0 | 2025-12-30 | Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute comm… |
CVE-2022-50795 | High | 7.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in t… |
CVE-2022-50794 | Critical | 9.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploi… |
CVE-2022-50793 | High | 8.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows attackers to injec… |
CVE-2022-50791 | High | 7.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in t… |
CVE-2022-50789 | High | 7.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp dire… |
CVE-2022-50691 | Critical | 9.8 | 2025-12-30 | MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'com… |
CVE-2025-15254 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a man… |
CVE-2025-66203 | Critical | 9.9 | 2025-12-27 | StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault applicati… |
CVE-2025-68922 | High | 7.4 | 2025-12-25 | OpenOps before 0.6.11 allows remote code execution in the Terraform block. |
CVE-2019-25255 | Medium | 4.3 | 2025-12-24 | VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute system commands with… |
CVE-2019-25243 | High | 8.8 | 2025-12-24 | FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitize… |
CVE-2018-25143 | High | 8.8 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user. At… |
CVE-2025-43876 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-43875 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-66213 | High | 8.8 | 2025-12-23 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command i… |