CWE-78 · OS Command Injection (page 5)
Page 5 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57499 | Critical | 9.1 | 2026-08-27 | Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows… |
CVE-2026-26899 | High | 8.8 | 2026-08-27 | An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allo… |
CVE-2026-81562 | Medium | 5.3 | 2026-08-27 | A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a mani… |
CVE-2026-74233 | Critical | 9.8 | 2026-08-27 | Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC… |
CVE-2026-75364 | Medium | 6.8 | 2026-08-26 | Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name… |
CVE-2026-75363 | Medium | 6.8 | 2026-08-26 | An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters… |
CVE-2026-74770 | High | 8.8 | 2026-08-26 | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulne… |
CVE-2026-68861 | High | 8.8 | 2026-08-26 | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulne… |
CVE-2026-71171 | High | 7.2 | 2026-08-26 | Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vu… |
CVE-2026-70419 | Critical | 9.1 | 2026-08-26 | Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vu… |
CVE-2026-19042 | High | 8.8 | 2026-08-26 | A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands… |
CVE-2026-80214 | | 2026-08-26 | LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server. | |
CVE-2026-80138 | Critical | 9.8 | 2026-08-25 | ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attacke… |
CVE-2026-79792 | Medium | 5.6 | 2026-08-25 | A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py… |
CVE-2026-65099 | High | 7.8 | 2026-08-25 | NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of t… |
CVE-2026-65096 | High | 7.8 | 2026-08-25 | NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection. A successful exploi… |
CVE-2026-65091 | High | 8.8 | 2026-08-25 | NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerabil… |
CVE-2026-65090 | High | 7.8 | 2026-08-25 | NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of… |
CVE-2026-65089 | High | 7.8 | 2026-08-25 | NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exp… |
CVE-2026-65086 | Medium | 6.8 | 2026-08-25 | NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of… |
CVE-2026-77585 | Medium | 5.3 | 2026-08-25 | The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a com… |
CVE-2026-45018 | Critical | 9.8 | 2026-08-25 | Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp… |
CVE-2026-79992 | High | 7.8 | 2026-08-25 | A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP conca… |
CVE-2026-76197 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that co… |
CVE-2026-76195 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that co… |
CVE-2026-55582 | High | 8.4 | 2026-08-25 | mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while… |
CVE-2026-55581 | High | 8.4 | 2026-08-25 | mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash i… |
CVE-2026-55580 | | 2026-08-25 | mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and… | |
CVE-2026-79623 | Medium | 6.3 | 2026-08-25 | A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of… |
CVE-2026-63586 | Critical | 9.8 | 2026-08-25 | The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Author… |
CVE-2026-78430 | Medium | 5.3 | 2026-08-24 | A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the… |
CVE-2026-78541 | | 2026-08-24 | A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administra… | |
CVE-2026-9254 | | 2026-08-24 | An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper f… | |
CVE-2026-71943 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering… |
CVE-2026-71931 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filteri… |
CVE-2026-71930 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of… |
CVE-2026-71929 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filterin… |
CVE-2026-71928 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering… |
CVE-2026-71927 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering… |
CVE-2026-71926 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitizati… |
CVE-2026-71925 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering… |
CVE-2026-71924 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of… |
CVE-2026-71923 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering o… |
CVE-2026-71921 | Critical | 9.8 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by in… |
CVE-2026-71919 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering… |
CVE-2026-71918 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filt… |
CVE-2026-71917 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation… |
CVE-2026-71916 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering… |
CVE-2026-71915 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering… |
CVE-2026-71914 | Critical | 9.8 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of… |
CVE-2026-71913 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient fil… |
CVE-2026-71910 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of… |
CVE-2026-71909 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of… |
CVE-2026-71908 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sa… |
CVE-2026-71907 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of t… |
CVE-2026-71906 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the… |
CVE-2026-71905 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering… |
CVE-2026-71904 | High | 7.2 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filterin… |
CVE-2026-16348 | | 2026-08-24 | An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands… | |
CVE-2026-76055 | | 2026-08-24 | Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor a… | |
CVE-2026-59561 | High | 7.8 | 2026-08-24 | Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a… |
CVE-2026-78211 | Critical | 9.8 | 2026-08-24 | 4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious comma… |
CVE-2026-78177 | Medium | 4.5 | 2026-08-24 | A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src… |
CVE-2026-57998 | High | 7.8 | 2026-08-22 | better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a comman… |
CVE-2026-41451 | High | 7.8 | 2026-08-21 | UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh w… |
CVE-2026-41450 | High | 7.8 | 2026-08-21 | UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command… |
CVE-2026-41449 | High | 7.8 | 2026-08-21 | UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to exe… |
CVE-2026-50112 | High | 8.8 | 2026-08-21 | SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal… |
CVE-2026-47359 | High | 8.8 | 2026-08-21 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The… |
CVE-2026-76156 | | 2026-08-21 | OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrar… | |
CVE-2026-18835 | Critical | 9.9 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of speci… |
CVE-2026-18824 | High | 8.4 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of speci… |
CVE-2026-53804 | High | 7.2 | 2026-08-20 | OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrar… |
CVE-2026-19586 | Critical | 9.8 | 2026-08-20 | A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient va… |
CVE-2026-18284 | High | 7.8 | 2026-08-20 | Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2026-18272 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affec… |
CVE-2026-18268 | High | 7.0 | 2026-08-20 | Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2026-18264 | High | 8.8 | 2026-08-20 | NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected insta… |
CVE-2026-61898 | High | 7.8 | 2026-08-20 | The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled L… |
CVE-2026-16932 | High | 8.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment v… |
CVE-2026-18482 | Critical | 9.8 | 2026-08-20 | Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSynta… |
CVE-2026-77084 | High | 8.8 | 2026-08-20 | n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local gi… |
CVE-2026-77080 | High | 8.8 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes fre… |
CVE-2026-76761 | High | 7.3 | 2026-08-19 | A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Manage… |
CVE-2026-75616 | Medium | 6.8 | 2026-08-19 | An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operat… |
CVE-2026-53545 | Critical | 9.8 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect… |
CVE-2026-53542 | High | 8.8 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in… |
CVE-2026-68560 | | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured… | |
CVE-2026-16882 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-16875 | High | 7.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection. |
CVE-2026-16865 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection. |
CVE-2026-16848 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacter… |
CVE-2026-16844 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-16842 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-71961 | High | 8.8 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS comma… |
CVE-2026-49255 | High | 8.8 | 2026-08-19 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in sr… |
CVE-2026-23501 | High | 7.2 | 2026-08-19 | Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') v… |
CVE-2026-16816 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of speci… |
CVE-2026-15068 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of s… |
CVE-2026-76228 | Medium | 6.7 | 2026-08-19 | Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper ar… |