CWE-78 · OS Command Injection (page 3)
Page 3 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67324 | Critical | 9.8 | 2026-08-01 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-opt… |
CVE-2026-67308 | Critical | 10.0 | 2026-08-01 | Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull… |
CVE-2026-9044 | High | 8.0 | 2026-07-31 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to ex… |
CVE-2026-17566 | Critical | 9.9 | 2026-07-31 | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the ren… |
CVE-2026-17347 | High | 7.5 | 2026-07-31 | The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with… |
CVE-2026-16843 | High | 7.2 | 2026-07-31 | Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can… |
CVE-2026-12943 | Critical | 9.8 | 2026-07-30 | IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could all… |
CVE-2026-12940 | Critical | 9.8 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Pro… |
CVE-2026-14522 | High | 8.8 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improp… |
CVE-2026-22622 | High | 8.8 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate pr… |
CVE-2026-22621 | High | 8.3 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to e… |
CVE-2026-44106 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulti… |
CVE-2026-44099 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full sy… |
CVE-2026-44098 | High | 8.6 | 2026-07-30 | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulti… |
CVE-2026-44096 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise. |
CVE-2026-44095 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resul… |
CVE-2026-44093 | High | 7.8 | 2026-07-30 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, r… |
CVE-2026-16524 | High | 7.8 | 2026-07-30 | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets… |
CVE-2026-67438 | Medium | 6.6 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellAr… |
CVE-2026-56389 | | 2026-07-29 | GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A… | |
CVE-2026-14959 | Critical | 9.1 | 2026-07-28 | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection. |
CVE-2026-14958 | Critical | 9.1 | 2026-07-28 | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. |
CVE-2026-61376 | High | 7.2 | 2026-07-28 | ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an… |
CVE-2026-59764 | High | 7.2 | 2026-07-28 | ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary… |
CVE-2026-55578 | High | 8.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomple… |
CVE-2026-54540 | High | 8.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The term… |
CVE-2026-48030 | Critical | 9.9 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the term… |
CVE-2026-24252 | High | 7.8 | 2026-07-27 | NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code ex… |
CVE-2026-16812 | Critical | 10.0 | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2025-59172 | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execu… | |
CVE-2026-59688 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59687 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59686 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-17497 | High | 8.3 | 2026-07-26 | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default deskto… |
CVE-2026-16766 | Critical | 9.8 | 2026-07-25 | Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkht… |
CVE-2026-65711 | High | 7.2 | 2026-07-24 | sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web… |
CVE-2026-66138 | High | 7.2 | 2026-07-24 | In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Ag… |
CVE-2026-63732 | Critical | 9.9 | 2026-07-23 | 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass… |
CVE-2026-16763 | Medium | 5.3 | 2026-07-23 | A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the com… |
CVE-2026-47670 | | 2026-07-23 | DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate cre… | |
CVE-2026-6516 | Critical | 10.0 | 2026-07-23 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API. |
CVE-2026-16735 | Medium | 5.3 | 2026-07-23 | A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of… |
CVE-2026-16733 | Medium | 5.3 | 2026-07-23 | A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the co… |
CVE-2026-16287 | High | 7.8 | 2026-07-23 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Insti… |
CVE-2026-16631 | Medium | 5.3 | 2026-07-23 | A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager… |
CVE-2026-16630 | Medium | 5.3 | 2026-07-22 | A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file pack… |
CVE-2026-16629 | Medium | 5.3 | 2026-07-22 | A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileA… |
CVE-2026-16628 | Medium | 5.3 | 2026-07-22 | A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handle… |
CVE-2026-14881 | High | 7.8 | 2026-07-22 | When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular… |
CVE-2026-44191 | High | 7.8 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ans… |
CVE-2026-65590 | Critical | 9.8 | 2026-07-22 | n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was ap… |
CVE-2026-44190 | High | 7.8 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unau… |
CVE-2026-3821 | High | 8.8 | 2026-07-22 | Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability… |
CVE-2026-16492 | Medium | 5.5 | 2026-07-22 | A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitI… |
CVE-2026-16489 | Medium | 5.3 | 2026-07-22 | A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX… |
CVE-2026-16488 | Medium | 5.0 | 2026-07-22 | A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of t… |
CVE-2026-8986 | Critical | 9.8 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromi… |
CVE-2026-8985 | Critical | 9.8 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated at… |
CVE-2026-64881 | High | 8.8 | 2026-07-21 | The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure e… |
CVE-2026-30631 | Critical | 9.8 | 2026-07-21 | An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted… |
CVE-2026-64879 | Critical | 9.9 | 2026-07-21 | A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharac… |
CVE-2026-64878 | Critical | 9.9 | 2026-07-21 | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privi… |
CVE-2026-59846 | Low | 3.9 | 2026-07-21 | A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables a… |
CVE-2026-16445 | High | 7.5 | 2026-07-21 | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a mal… |
CVE-2026-6952 | High | 7.2 | 2026-07-21 | A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7… |
CVE-2026-64625 | Critical | 9.8 | 2026-07-20 | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitut… |
CVE-2026-63766 | Critical | 9.8 | 2026-07-20 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitiz… |
CVE-2026-54051 | Critical | 9.9 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy… |
CVE-2026-40187 | | 2026-07-20 | In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML… | |
CVE-2026-14448 | High | 7.2 | 2026-07-20 | An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralizati… |
CVE-2026-50289 | High | 8.8 | 2026-07-17 | systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection throu… |
CVE-2026-46420 | Medium | 5.6 | 2026-07-17 | setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup… |
CVE-2026-42168 | Critical | 9.1 | 2026-07-17 | django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly… |
CVE-2026-15069 | Medium | 5.4 | 2026-07-17 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during we… |
CVE-2026-14499 | High | 8.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to im… |
CVE-2026-58195 | High | 8.8 | 2026-07-17 | Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/clau… |
CVE-2026-55173 | High | 8.1 | 2026-07-16 | WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomple… |
CVE-2026-47751 | | 2026-07-16 | Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out… | |
CVE-2026-14371 | | 2026-07-16 | The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection… | |
CVE-2026-45695 | Critical | 9.8 | 2026-07-16 | Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data ded… |
CVE-2026-63305 | High | 8.1 | 2026-07-16 | AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated in… |
CVE-2026-63304 | High | 8.1 | 2026-07-16 | AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates… |
CVE-2023-49900 | Critical | 9.8 | 2026-07-16 | An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command. |
CVE-2026-55576 | | 2026-07-15 | MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker… | |
CVE-2026-52891 | Critical | 9.9 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child… |
CVE-2026-62312 | High | 8.8 | 2026-07-15 | 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating… |
CVE-2026-55410 | Medium | 6.7 | 2026-07-15 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-bac… |
CVE-2026-46339 | Critical | 10.0 | 2026-07-15 | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing un… |
CVE-2026-15895 | High | 7.8 | 2026-07-15 | OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands… |
CVE-2026-46709 | High | 7.8 | 2026-07-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts in… |
CVE-2026-61438 | High | 7.3 | 2026-07-15 | PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workf… |
CVE-2026-48347 | High | 7.7 | 2026-07-14 | Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitra… |
CVE-2026-48345 | High | 8.2 | 2026-07-14 | Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitra… |
CVE-2026-15428 | High | 8.8 | 2026-07-14 | An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who… |
CVE-2026-15427 | High | 8.1 | 2026-07-14 | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitizati… |
CVE-2026-58479 | Critical | 9.8 | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthen… |
CVE-2026-62392 | Critical | 9.8 | 2026-07-14 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config pa… |
CVE-2026-3014 | Critical | 9.1 | 2026-07-14 | Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vuln… |
CVE-2026-14852 | | 2026-07-14 | Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user t… | |
CVE-2026-15669 | Medium | 5.3 | 2026-07-14 | A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the com… |