← Back to feed Search feed

CWE-78 OS Command Injection vulnerabilities

131 CVEs — updated 2026-11-02 · vulnfeed

CVE / IDTitleSeverityCVSSEPSSSourceDate
CVE-2026-61567AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an aCRITICAL10.044%ileNVD2026-10-28
CVE-2026-104353Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS CoCRITICAL9.970%ileNVD2026-10-27
CVE-2026-90868An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on WindCRITICAL9.974%ileNVD2026-10-29
CVE-2026-62853ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-sCRITICAL9.935%ileNVD2026-10-30
CVE-2026-82119OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HCRITICAL9.864%ileNVD2026-10-27
CVE-2026-114278The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespaCRITICAL9.860%ileNVD2026-10-28
CVE-2026-103406An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in JunipeCRITICAL9.844%ileNVD2026-10-28
CVE-2025-31704A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafCRITICAL9.872%ileNVD2026-10-30
CVE-2026-115904Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.241CRITICAL9.655%ileNVD2026-10-28
CVE-2026-66088In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating syCRITICAL9.453%ileNVD2026-10-29
CVE-2026-116241pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the queCRITICAL9.425%ileNVD2026-10-30
CVE-2026-97854Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. ArbitraCRITICAL9.372%ileNVD2026-10-29
CVE-2026-120195A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the functCRITICAL9.381%ileNVD2026-11-01
CVE-2026-120198A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the fCRITICAL9.381%ileNVD2026-11-01
CVE-2026-120276A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 oCRITICAL9.3—NVD2026-11-02
CVE-2026-120277A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1CRITICAL9.3—NVD2026-11-02
CVE-2026-120279A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.cCRITICAL9.3—NVD2026-11-02
CVE-2026-120280A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group hCRITICAL9.3—NVD2026-11-02
CVE-2026-120344A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the fiCRITICAL9.3—NVD2026-11-02
CVE-2026-120345A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the filCRITICAL9.3—NVD2026-11-02
CVE-2026-77876Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_dirCRITICAL9.3—NVD2026-11-02
CVE-2026-67074HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the prCRITICAL9.140%ileNVD2026-10-28
CVE-2026-8450HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()CRITICAL9.172%ileMicrosoft2026-05-12
CVE-2026-90865An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on WindCRITICAL9.067%ileNVD2026-10-29
CVE-2026-111422In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` paraHIGH8.851%ileNVD2026-10-27
CVE-2026-116838A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) HIGH8.832%ileNVD2026-10-27
CVE-2026-116676Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0HIGH8.840%ileNVD2026-10-27
CVE-2026-86396Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7HIGH8.882%ileNVD2026-10-28
CVE-2026-116778FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1,HIGH8.840%ileNVD2026-10-28
CVE-2026-103403An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManHIGH8.868%ileNVD2026-10-28
CVE-2026-106079An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManHIGH8.868%ileNVD2026-10-28
CVE-2026-78674The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted HIGH8.863%ileNVD2026-10-28
CVE-2026-107326IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improHIGH8.853%ileNVD2026-10-29
CVE-2026-111505Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an HIGH8.873%ileNVD2026-10-30
CVE-2026-91913Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an HIGH8.886%ileNVD2026-10-30
CVE-2026-18199Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an auHIGH8.8—NVD2026-11-02
CVE-2026-82412ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIHIGH8.851%ileMicrosoft2026-09-08
CVE-2026-6893Dracut: dracut: root code execution via dhcp options command injectionHIGH8.870%ileMicrosoft2026-06-09
CVE-2024-5585Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)HIGH8.898%ileMicrosoft2024-06-11
CVE-2026-102814An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivableHIGH8.730%ileNVD2026-10-27
CVE-2026-112351Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allowHIGH8.786%ileNVD2026-10-27
CVE-2026-118477The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command InjectionHIGH8.766%ileNVD2026-10-28
CVE-2026-119713Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders HIGH8.756%ileNVD2026-10-30
CVE-2026-8923Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated ReHIGH8.7—NVD2026-11-02
CVE-2026-73697Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerabiHIGH8.7—NVD2026-11-02
CVE-2026-116504A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW ofHIGH8.675%ileNVD2026-10-26
CVE-2026-116506A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the fileHIGH8.679%ileNVD2026-10-26
CVE-2013-20007Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to exHIGH8.681%ileNVD2026-10-28
CVE-2026-118755Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticateHIGH8.673%ileNVD2026-10-28
CVE-2026-119409OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: FirmwHIGH8.685%ileNVD2026-10-30
CVE-2026-120196A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wHIGH8.677%ileNVD2026-11-01
CVE-2026-120197A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapHIGH8.677%ileNVD2026-11-01
CVE-2026-120227A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file statHIGH8.683%ileNVD2026-11-01
CVE-2026-120228A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the fileHIGH8.676%ileNVD2026-11-01
CVE-2026-120230A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web BHIGH8.683%ileNVD2026-11-01
CVE-2026-120231A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of thHIGH8.677%ileNVD2026-11-01
CVE-2026-120238A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/HIGH8.677%ileNVD2026-11-01
CVE-2026-120239A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the HIGH8.677%ileNVD2026-11-01
CVE-2026-120240A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the filHIGH8.677%ileNVD2026-11-01
CVE-2026-120282A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocolHIGH8.6—NVD2026-11-02
CVE-2026-111560Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance produHIGH8.6—NVD2026-11-02
CVE-2026-104080Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API HIGH8.6—NVD2026-11-02
CVE-2026-77878Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API HIGH8.6—NVD2026-11-02
CVE-2026-77880Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API HIGH8.6—NVD2026-11-02
CVE-2026-116505A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the fileHIGH8.586%ileNVD2026-10-26
CVE-2026-117558The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to exeHIGH8.553%ileNVD2026-10-27
CVE-2026-117559DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command aHIGH8.553%ileNVD2026-10-27
CVE-2026-117560ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackerHIGH8.551%ileNVD2026-10-27
CVE-2026-117561Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell comHIGH8.551%ileNVD2026-10-27
CVE-2026-117567esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary comHIGH8.551%ileNVD2026-10-27
CVE-2026-117569Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_sHIGH8.552%ileNVD2026-10-27
CVE-2026-117573hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell coHIGH8.553%ileNVD2026-10-27
CVE-2026-119586SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits aHIGH8.558%ileNVD2026-10-30
CVE-2026-120229A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the fileHIGH8.587%ileNVD2026-11-01
CVE-2026-118992CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configurHIGH8.414%ileNVD2026-10-30
CVE-2026-87864IMAP APPEND plus CRLF conversion command injectionHIGH8.258%ileMicrosoft2026-10-13
CVE-2026-53790rsync < 3.5.0 Command Injection via Multiple Code PathsHIGH8.150%ileMicrosoft2026-08-11
CVE-2026-94349Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an HIGH8.0—NVD2026-11-02
CVE-2026-116576systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js iHIGH7.84%ileNVD2026-10-26
CVE-2026-118615Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attaHIGH7.836%ileNVD2026-10-28
CVE-2026-115805Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local useHIGH7.86%ileNVD2026-10-29
CVE-2026-119335Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. PriorHIGH7.814%ileNVD2026-10-30
CVE-2026-108976GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp hasHIGH7.851%ileMicrosoft2026-10-13
CVE-2026-84838Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()HIGH7.866%ileMicrosoft2026-09-08
CVE-2026-95521Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpmHIGH7.848%ileMicrosoft2026-09-08
CVE-2026-79992Emacs: local shell command injection through the user field in emacs trampHIGH7.812%ileMicrosoft2026-08-11
CVE-2026-40034gitoxide - Command Injection via Partial .gitmodules Override in gix-submoduleHIGH7.851%ileMicrosoft2026-05-12
CVE-2026-13162An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbiHIGH7.78%ileNVD2026-10-27
CVE-2026-119025open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell codeHIGH7.773%ileNVD2026-10-29
CVE-2026-111461An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enablHIGH7.572%ileNVD2026-10-27
CVE-2026-33924Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient vaHIGH7.566%ileNVD2026-10-29
CVE-2026-116755Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SofHIGH7.461%ileNVD2026-10-31
CVE-2026-117568mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by sHIGH7.348%ileNVD2026-10-27
CVE-2026-119282Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and HIGH7.33%ileNVD2026-10-29
CVE-2026-85013Environment-modules: command injection in environment-modules bash completion via malicious module names containing shelHIGH7.314%ileMicrosoft2026-09-08
CVE-2026-16521An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command pHIGH7.259%ileNVD2026-10-27
CVE-2026-86395Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.HIGH7.282%ileNVD2026-10-28
CVE-2026-86399Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7HIGH7.282%ileNVD2026-10-28
CVE-2026-86379Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions HIGH7.287%ileNVD2026-10-28
CVE-2026-86394Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7HIGH7.282%ileNVD2026-10-28
CVE-2026-110541Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7HIGH7.279%ileNVD2026-10-28
CVE-2026-101210Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an HIGH7.287%ileNVD2026-10-30
CVE-2026-101214Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an HIGH7.287%ileNVD2026-10-30
CVE-2026-118238The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature dueHIGH7.275%ileNVD2026-10-30
CVE-2026-118692CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackersHIGH7.148%ileNVD2026-10-28
CVE-2026-118905Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.HIGH7.13%ileNVD2026-10-29
CVE-2026-119288Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved WinHIGH7.08%ileNVD2026-10-30
CVE-2026-102815An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runMEDIUM6.949%ileNVD2026-10-27
CVE-2026-118607Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execuMEDIUM6.859%ileNVD2026-10-28
CVE-2026-65213This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMMEDIUM6.646%ileNVD2026-10-27
CVE-2026-57453Vim: PowerShell Command Injection via Unescaped Filename in zip.vim ExtractionMEDIUM6.511%ileMicrosoft2026-06-09
CVE-2026-113644In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certifiMEDIUM5.58%ileNVD2026-10-27
CVE-2026-117511A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function proceMEDIUM5.576%ileNVD2026-10-27
CVE-2026-120275A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown partMEDIUM5.1—NVD2026-11-01
CVE-2026-104308IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to imMEDIUM4.327%ileNVD2026-10-29
CVE-2026-11526GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments MEDIUM4.272%ileMicrosoft2026-06-09
CVE-2026-46483Vim: Command injection in tar#Vimuntar via missing shellescape {special} flagLOW3.646%ileMicrosoft2026-05-12
CVE-2026-114523Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal FfmpeUNKNOWN—45%ileNVD2026-10-30
CVE-2026-13575HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::SessioUNKNOWN—61%ileNVD2026-11-01
CVE-2026-86108Security Advisory 0181UNKNOWN—49%ileArista2026-09-09
CVE-2026-73454Security Advisory 0165UNKNOWN—33%ileArista2026-09-09
CVE-2026-73447Security Advisory 0162UNKNOWN—53%ileArista2026-09-09
CVE-2026-102937virtualenv: Command injection via --prompt in activate.bat (batch activator)UNKNOWN—11%ileMicrosoft2026-09-08
CVE-2026-47240Net::IMAP: Command Injection via non-synchronizing literal in "raw" argumentUNKNOWN—58%ileMicrosoft2026-06-09
CVE-2026-47242Net::IMAP: Command Injection via ID command argumentUNKNOWN—8%ileMicrosoft2026-06-09
CVE-2026-44656Vim: OS Command Injection via 'path' completionUNKNOWN—60%ileMicrosoft2026-05-12
CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commandsUNKNOWN—37%ileMicrosoft2026-05-12
CVE-2026-42258net-imap: Command Injection via unvalidated Symbol inputsUNKNOWN—56%ileMicrosoft2026-05-12
FG-IR-26-184SQL command injection in webmailUNKNOWN——Fortinet2026-10-13
FG-IR-26-177arbitrary command execution in fgfmsd daemonUNKNOWN——Fortinet2026-10-13
FG-IR-26-167Cron Job Injection in Remote BackupUNKNOWN——Fortinet2026-09-08