# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7.](https://agentprime.io/advisories/CVE-2026-36827.md) `CVE-2026-36827` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 19 May 2026 · Tags: Command injection - [Dokploy has Command Injection in its Service Operations](https://agentprime.io/advisories/CVE-2026-27130.md) `CVE-2026-27130` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 May 2026 · Tags: Command injection - [ngrok is Vulnerable to Command Injection](https://agentprime.io/advisories/GHSA-qr28-p3wr-mxq3.md) `GHSA-qr28-p3wr-mxq3`, `CVE-2025-57282` · npm `ngrok`: affected `=4.3.3 || =5.0.0-beta.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 18 May 2026 · Tags: Command injection - [Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter](https://agentprime.io/advisories/GHSA-9mvm-4gwg-v8mp.md) `GHSA-9mvm-4gwg-v8mp`, `CVE-2026-45626`, `GO-2026-5292` · Go `github.com/getarcaneapp/arcane/backend`: affected `<=1.18.1`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: Command injection - [Edimax BR-6428NS POST Request formStaDrvSetup command injection](https://agentprime.io/advisories/CVE-2026-8777.md) `CVE-2026-8777` · CVE record: Edimax BR-6428NS · CVSS 5.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6228NC POST Request mp command injection](https://agentprime.io/advisories/CVE-2026-8774.md) `CVE-2026-8774` · CVE record: Edimax BR-6228NC · CVSS 5.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, Command injection - [linlinjava litemall Database Setting DbUtil.java load argument injection](https://agentprime.io/advisories/CVE-2026-8773.md) `CVE-2026-8773` · CVE record: linlinjava litemall · CVSS 5.1 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, Command injection - [vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection](https://agentprime.io/advisories/CVE-2026-8767.md) `CVE-2026-8767` · CVE record: vercel ai · CVSS 2.3 Low · Not analysed yet · Published 17 May 2026 · Tags: Command injection - [kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection](https://agentprime.io/advisories/CVE-2026-8753.md) `CVE-2026-8753` · CVE record: kalcaddle Kodbox · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2026 · Tags: Other injection, Command injection - [AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL](https://agentprime.io/advisories/GHSA-xw67-cg5f-4m2r.md) `GHSA-xw67-cg5f-4m2r`, `CVE-2026-45578`, `PKSA-rjrh-w2j8-5qv7` · Packagist `WWBN/AVideo`: affected `<=29.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh](https://agentprime.io/advisories/CVE-2026-45036.md) `CVE-2026-45036` · CVE record: Eugeny tabby · CVSS 7.0 High · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [Tabby: RCE via \`tabby://run\` URL Scheme](https://agentprime.io/advisories/CVE-2026-45035.md) `CVE-2026-45035` · CVE record: Eugeny tabby · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [Turborepo: VSCode Extension command injection](https://agentprime.io/advisories/CVE-2026-46508.md) `CVE-2026-46508` · CVE record: vercel turborepo · CVSS 8.4 High · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag](https://agentprime.io/advisories/CVE-2026-46483.md) `CVE-2026-46483` · CVE record: vim vim · CVSS 3.6 Low · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [Remote Code Execution in PDF Export Module](https://agentprime.io/advisories/CVE-2026-41553.md) `CVE-2026-41553` · CVE record: DHTMLX PDF Export Module · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [OS command injection in Delphix Continuous data IBM Db2 Connector and others](https://agentprime.io/advisories/CVE-2026-8654.md) `CVE-2026-8654` · CVE record: Delphix Continuous data IBM Db2 Connector and 4 more · CVSS 8.7 High · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands.](https://agentprime.io/advisories/CVE-2026-39054.md) `CVE-2026-39054` · CVE record · CVSS 7.3 High · Not analysed yet · Published 15 May 2026 · Tags: Command injection - [HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution](https://agentprime.io/advisories/CVE-2026-44666.md) `CVE-2026-44666` · CVE record: zelon88 HRConvert2 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Command injection - [mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')](https://agentprime.io/advisories/CVE-2026-41315.md) `CVE-2026-41315` · CVE record: midoks mdserver-web · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Command injection, Broken access control - [dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters](https://agentprime.io/advisories/GHSA-xpww-f6pm-cfhq.md) `GHSA-xpww-f6pm-cfhq`, `CVE-2026-44968`, `PYSEC-2026-2444` · PyPI `dbt-mcp`: affected `<1.17.1`, fixed in `1.17.1` · CVSS 6.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: Command injection - [n8n Has an Arbitrary File Read via Git Node](https://agentprime.io/advisories/GHSA-57g9-58c2-xjg3.md) `GHSA-57g9-58c2-xjg3`, `CVE-2026-44790` · npm `n8n`: affected `<1.123.43 || >=2.0.0-rc.0, <2.20.7 || >=2.21.0, <2.22.1`, fixed in `1.123.43`, `2.20.7`, `2.22.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Command injection - [@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input](https://agentprime.io/advisories/GHSA-hcwq-x9fw-8cfq.md) `GHSA-hcwq-x9fw-8cfq`, `CVE-2026-42853` · npm `@apostrophecms/cli`: affected `<=3.6.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2026 · Tags: Command injection - [Flowise has an MCP Security Bypass that Enables RCE](https://agentprime.io/advisories/GHSA-m99r-2hxc-cp3q.md) `GHSA-m99r-2hxc-cp3q`, `CVE-2026-56274` · npm `flowise` and 1 more: affected `<3.1.2`, fixed in `3.1.2` · CVSS 8.7 High · Not analysed yet · Published 14 May 2026 · Tags: Command injection, CWE-184 - [Fleet vulnerable to OS command injection in software packages](https://agentprime.io/advisories/GHSA-9vcr-g537-3w5v.md) `GHSA-9vcr-g537-3w5v`, `CVE-2026-26191`, `GO-2026-5301` · Go `github.com/fleetdm/fleet/v4`: affected `<4.81.1`, fixed in `4.81.1` · CVSS 6.0 Medium · Not analysed yet · Published 14 May 2026 · Tags: Command injection - [Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.](https://agentprime.io/advisories/CVE-2026-24712.md) `CVE-2026-24712` · CVE record · CVSS 7.3 High · Not analysed yet · Published 14 May 2026 · Tags: Command injection - [Web::Passwd versions through 0.03 for Perl is vulnerable to RCE](https://agentprime.io/advisories/CVE-2026-8500.md) `CVE-2026-8500` · CVE record: EVANK Web::Passwd · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [OPNsense: Command Injection via Attacker-Controlled DHCP Config](https://agentprime.io/advisories/CVE-2026-45158.md) `CVE-2026-45158` · CVE record: opnsense core · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [OPNsense: RCE on user managment](https://agentprime.io/advisories/CVE-2026-44194.md) `CVE-2026-44194` · CVE record: opnsense core · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [OPNsense: RCE via XMLRPC endpoint using \`opnsense.restore_config_section\` method](https://agentprime.io/advisories/CVE-2026-44193.md) `CVE-2026-44193` · CVE record: opnsense core · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [PAN-OS: Authenticated Admin Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-0261.md) `CVE-2026-0261` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-qqq4-5773-pmw5.md) `GHSA-qqq4-5773-pmw5`, `CVE-2026-45152`, `GO-2026-5590` · Go `gitlab.com/uniget-org/cli`: affected `<0.27.1`, fixed in `0.27.1` · CVSS 7.8 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh](https://agentprime.io/advisories/GHSA-g3xq-3gmv-qq8g.md) `GHSA-g3xq-3gmv-qq8g`, `CVE-2026-45136` · npm `claude-code-cache-fix`: affected `>=3.5.0, <3.5.2`, fixed in `3.5.2` · CVSS 8.6 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection, Code injection - [Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name](https://agentprime.io/advisories/GHSA-hvx9-hwr7-wjj9.md) `GHSA-hvx9-hwr7-wjj9`, `CVE-2026-44724` · npm `systeminformation`: affected `>=4.17.0, <5.31.6`, fixed in `5.31.6` · CVSS 7.8 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [OS command injection in Lenovo Personal Cloud T2s and others](https://agentprime.io/advisories/CVE-2026-6281.md) `CVE-2026-6281` · CVE record: Lenovo Personal Cloud T2s and 4 more · CVSS 8.7 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [Knowledge Appliance mode iControl REST vulnerability](https://agentprime.io/advisories/CVE-2026-34176.md) `CVE-2026-34176` · CVE record: F5 BIG-IP · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [BIG-IP Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-41953.md) `CVE-2026-41953` · CVE record: F5 BIG-IP · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [iControl REST and TMSH vulnerability](https://agentprime.io/advisories/CVE-2026-40698.md) `CVE-2026-40698` · CVE record: F5 BIG-IP and 1 more · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [BIG-IP iControl SOAP vulnerability](https://agentprime.io/advisories/CVE-2026-42924.md) `CVE-2026-42924` · CVE record: F5 BIG-IP · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [iControl REST and tmsh vulnerability](https://agentprime.io/advisories/CVE-2026-40061.md) `CVE-2026-40061` · CVE record: F5 BIG-IP · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [OS command injection in ELECOM CO.,LTD. WRC-BE72XSD-B and others](https://agentprime.io/advisories/CVE-2026-42062.md) `CVE-2026-42062` · CVE record: ELECOM CO.,LTD. WRC-BE72XSD-B and 3 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [OS command injection in ELECOM CO.,LTD. WRC-BE72XSD-B and others](https://agentprime.io/advisories/CVE-2026-35506.md) `CVE-2026-35506` · CVE record: ELECOM CO.,LTD. WRC-BE72XSD-B and 3 more · CVSS 8.6 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection.](https://agentprime.io/advisories/CVE-2026-36741.md) `CVE-2026-36741` · CVE record · CVSS 7.2 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection - [OS command injection in Claris FileMaker Cloud](https://agentprime.io/advisories/CVE-2026-43685.md) `CVE-2026-43685` · CVE record: Claris FileMaker Cloud · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [efw4.X: RCE via zipslip](https://agentprime.io/advisories/CVE-2026-44257.md) `CVE-2026-44257` · CVE record: efwGrp efw4.X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems](https://agentprime.io/advisories/CVE-2026-44871.md) `CVE-2026-44871` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-44258.md) `CVE-2026-44258` · CVE record: efwGrp efw4.X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-44872.md) `CVE-2026-44872` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems](https://agentprime.io/advisories/CVE-2026-44870.md) `CVE-2026-44870` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10](https://agentprime.io/advisories/CVE-2026-44869.md) `CVE-2026-44869` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10](https://agentprime.io/advisories/CVE-2026-44868.md) `CVE-2026-44868` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10](https://agentprime.io/advisories/CVE-2026-44867.md) `CVE-2026-44867` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10](https://agentprime.io/advisories/CVE-2026-44866.md) `CVE-2026-44866` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10](https://agentprime.io/advisories/CVE-2026-44865.md) `CVE-2026-44865` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-44854.md) `CVE-2026-44854` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-44853.md) `CVE-2026-44853` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Authenticated Command Injection leads to RCE in AOS-10 CLI Command](https://agentprime.io/advisories/CVE-2026-23823.md) `CVE-2026-23823` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Ops Manager RCE via webhook body](https://agentprime.io/advisories/CVE-2026-8431.md) `CVE-2026-8431` · CVE record: MongoDB, Inc. Ops Manager · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI](https://agentprime.io/advisories/CVE-2026-23821.md) `CVE-2026-23821` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI](https://agentprime.io/advisories/CVE-2026-23820.md) `CVE-2026-23820` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection - [Microsoft Outlook for iOS Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-42893.md) `CVE-2026-42893` · CVE record: Microsoft Microsoft Outlook for iOS · CVSS 7.4 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .