# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Edimax BR-6478AC POST Request formiNICbasic command injection](https://agentprime.io/advisories/CVE-2026-9441.md) `CVE-2026-9441` · CVE record: Edimax BR-6478AC · CVSS 5.3 Medium · EPSS 0.15 · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6478AC POST Request formAccept command injection](https://agentprime.io/advisories/CVE-2026-9440.md) `CVE-2026-9440` · CVE record: Edimax BR-6478AC · CVSS 5.3 Medium · EPSS 0.17 · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6675nD stainfo command injection](https://agentprime.io/advisories/CVE-2026-9439.md) `CVE-2026-9439` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [DTStack Taier REST API Runtime.exec os command injection](https://agentprime.io/advisories/CVE-2026-9437.md) `CVE-2026-9437` · CVE record: DTStack Taier · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection](https://agentprime.io/advisories/CVE-2026-9436.md) `CVE-2026-9436` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection](https://agentprime.io/advisories/CVE-2026-9435.md) `CVE-2026-9435` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection](https://agentprime.io/advisories/CVE-2026-9434.md) `CVE-2026-9434` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection](https://agentprime.io/advisories/CVE-2026-9433.md) `CVE-2026-9433` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection](https://agentprime.io/advisories/CVE-2026-9432.md) `CVE-2026-9432` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Edimax EW-7438RPn Content-Type formWlanMP os command injection](https://agentprime.io/advisories/CVE-2026-9424.md) `CVE-2026-9424` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Edimax BR-6675nD POST Request mp command injection](https://agentprime.io/advisories/CVE-2026-9423.md) `CVE-2026-9423` · CVE record: Edimax BR-6675nD · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2026 · Tags: Other injection, Command injection - [OS command injection in NEC Platforms, Ltd. Aterm MR51FN and others](https://agentprime.io/advisories/CVE-2026-8652.md) `CVE-2026-8652` · CVE record: NEC Platforms, Ltd. Aterm MR51FN and 1 more · CVSS 8.5 High · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection](https://agentprime.io/advisories/CVE-2026-9408.md) `CVE-2026-9408` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection](https://agentprime.io/advisories/CVE-2026-9407.md) `CVE-2026-9407` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection](https://agentprime.io/advisories/CVE-2026-9406.md) `CVE-2026-9406` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection](https://agentprime.io/advisories/CVE-2026-9405.md) `CVE-2026-9405` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection](https://agentprime.io/advisories/CVE-2026-9404.md) `CVE-2026-9404` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Edimax BR-6675nD POST Request formWlanMP command injection](https://agentprime.io/advisories/CVE-2026-9402.md) `CVE-2026-9402` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6675nD POST Request formUSBStorage command injection](https://agentprime.io/advisories/CVE-2026-9400.md) `CVE-2026-9400` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection](https://agentprime.io/advisories/CVE-2026-9388.md) `CVE-2026-9388` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection](https://agentprime.io/advisories/CVE-2026-9387.md) `CVE-2026-9387` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection](https://agentprime.io/advisories/CVE-2026-9386.md) `CVE-2026-9386` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection](https://agentprime.io/advisories/CVE-2026-9385.md) `CVE-2026-9385` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection](https://agentprime.io/advisories/CVE-2026-9384.md) `CVE-2026-9384` · CVE record: Totolink A8000RU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Edimax BR-6675nD POST Request formWpsStart command injection](https://agentprime.io/advisories/CVE-2026-9379.md) `CVE-2026-9379` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6675nD POST Request formHwSet command injection](https://agentprime.io/advisories/CVE-2026-9378.md) `CVE-2026-9378` · CVE record: Edimax BR-6675nD · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection](https://agentprime.io/advisories/CVE-2026-9367.md) `CVE-2026-9367` · CVE record: NousResearch hermes-agent · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection](https://agentprime.io/advisories/CVE-2026-9363.md) `CVE-2026-9363` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax EW-7438RPn Setting formConnectionSetting command injection](https://agentprime.io/advisories/CVE-2026-9362.md) `CVE-2026-9362` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax EW-7438RPn POST Request formAccep formAccept command injection](https://agentprime.io/advisories/CVE-2026-9361.md) `CVE-2026-9361` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax EW-7438RPn POST Request formHwSet command injection](https://agentprime.io/advisories/CVE-2026-9359.md) `CVE-2026-9359` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Other injection, Command injection - [Edimax EW-7438RPn webs formWizSurvey os command injection](https://agentprime.io/advisories/CVE-2026-9347.md) `CVE-2026-9347` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Command injection - [Edimax EW-7438RPn webs formWpsStart os command injection](https://agentprime.io/advisories/CVE-2026-9343.md) `CVE-2026-9343` · CVE record: Edimax EW-7438RPn · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Command injection - [Edimax BR-6428NS POST Request formWlbasic command injection](https://agentprime.io/advisories/CVE-2026-9297.md) `CVE-2026-9297` · CVE record: Edimax BR-6428NS · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, Command injection - [Edimax BR-6428NS POST Request formWlanM system command injection](https://agentprime.io/advisories/CVE-2026-9296.md) `CVE-2026-9296` · CVE record: Edimax BR-6428NS · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Other injection, Command injection - [Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron](https://agentprime.io/advisories/GHSA-99gv-2m7h-3hh9.md) `GHSA-99gv-2m7h-3hh9`, `CVE-2026-46716`, `GO-2026-5282` · Go `github.com/nezhahq/nezha`: affected `>=1.4.0, <1.14.15-0.20260517022419-d7526351cf97`, fixed in `1.14.15-0.20260517022419-d7526351cf97` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 May 2026 · Tags: Command injection, Privilege escalation, Broken access control - [Microsoft Copilot Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-41090.md) `CVE-2026-41090` · CVE record: Microsoft Microsoft 365 Copilot for iOS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2026 · Tags: Command injection - [M365 Copilot Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-42827.md) `CVE-2026-42827` · CVE record: Microsoft Microsoft 365 Copilot · CVSS 6.5 Medium · Not analysed yet · Published 22 May 2026 · Tags: Command injection - [Microsoft Power Pages Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-23652.md) `CVE-2026-23652` · CVE record: Microsoft Microsoft Power Pages · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2026 · Tags: Command injection - [Snappy: Binary path is never shell-escaped due to an inverted is_executable check](https://agentprime.io/advisories/GHSA-vpr4-p6fq-85jc.md) `GHSA-vpr4-p6fq-85jc`, `CVE-2026-46643`, `PKSA-13wp-m816-mvdd` · Packagist `KnpLabs/knp-snappy`: affected `<1.7.1`, fixed in `1.7.1` · CVSS 7.5 High · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables](https://agentprime.io/advisories/GHSA-7pjr-qpvh-m339.md) `GHSA-7pjr-qpvh-m339`, `CVE-2026-46618`, `GO-2026-5230` · Go `github.com/fission/fission`: affected `<1.23.0`, fixed in `1.23.0` · CVSS 6.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: Command injection, Privilege escalation - [IINA < 1.4.3 Command Execution via iina://open URL Scheme](https://agentprime.io/advisories/CVE-2026-47114.md) `CVE-2026-47114` · CVE record: iina iina · CVSS 8.6 High · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [Remote Code Execution](https://agentprime.io/advisories/CVE-2026-2740.md) `CVE-2026-2740` · CVE record: Zohocorp ManageEngine ADSelfService Plus and 2 more · CVSS 8.4 High · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [Remote code execution via installer Wi-Fi access point scans](https://agentprime.io/advisories/CVE-2026-45255.md) `CVE-2026-45255` · CVE record: FreeBSD FreeBSD · CVSS 7.5 High · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [Insufficient Validation of Names During AXFR](https://agentprime.io/advisories/CVE-2026-42000.md) `CVE-2026-42000` · CVE record: PowerDNS Authoritative · CVSS 6.8 Medium · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [Improper sanitization](https://agentprime.io/advisories/CVE-2026-5433.md) `CVE-2026-5433` · CVE record: Honeywell International Inc. Control Network Module (CNM) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [Shell injection via volume path](https://agentprime.io/advisories/CVE-2026-44076.md) `CVE-2026-44076` · CVE record: Netatalk Netatalk · CVSS 6.7 Medium · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [system() after failed chdir()](https://agentprime.io/advisories/CVE-2026-44072.md) `CVE-2026-44072` · CVE record: Netatalk Netatalk · CVSS 2.5 Low · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [Bitwise OR logic bug enables shell injection](https://agentprime.io/advisories/CVE-2026-44055.md) `CVE-2026-44055` · CVE record: Netatalk Netatalk · CVSS 7.5 High · Not analysed yet · Published 21 May 2026 · Tags: Command injection - [HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-8632.md) `CVE-2026-8632` · CVE record: HP Inc HP Linux Imaging and Printing Software · CVSS 8.5 High · Not analysed yet · Published 20 May 2026 · Tags: Command injection - [Cisco ThousandEyes BrowserBot Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20206.md) `CVE-2026-20206` · CVE record: Cisco Cisco ThousandEyes Enterprise Agent · CVSS 6.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: Command injection - [Command injection in Dell SmartFabric Storage Software](https://agentprime.io/advisories/CVE-2026-35070.md) `CVE-2026-35070` · CVE record: Dell SmartFabric Storage Software · CVSS 6.4 Medium · Not analysed yet · Published 20 May 2026 · Tags: Command injection - [Windows BitLocker Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-45585.md) `CVE-2026-45585` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Command injection - [CtrlPanel: Unauthenticated RCE using installer script](https://agentprime.io/advisories/CVE-2026-34234.md) `CVE-2026-34234` · CVE record: Ctrlpanel-gg panel · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Command injection, Broken access control - [Diesel: Command injection in Diesel's implementation of \`COPY FROM\`/\`COPY TO\`](https://agentprime.io/advisories/GHSA-m9p2-fxp5-v3fp.md) `GHSA-m9p2-fxp5-v3fp`, `RUSTSEC-2026-0136` · crates.io `diesel`: affected `<2.3.8`, fixed in `2.3.8` · CVSS 4.0, no score published · Not analysed yet · Published 19 May 2026 · Tags: Command injection - [9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes](https://agentprime.io/advisories/GHSA-fhh6-4qxv-rpqj.md) `GHSA-fhh6-4qxv-rpqj`, `CVE-2026-46339` · npm `9router`: affected `>=0.4.30, <0.4.37`, fixed in `0.4.37` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Command injection, Authentication bypass - [Kopia: RCE via SSH ProxyCommand Injection](https://agentprime.io/advisories/GHSA-2q4c-3mrw-63c3.md) `GHSA-2q4c-3mrw-63c3`, `CVE-2026-45695`, `GO-2026-5009` · Go `github.com/kopia/kopia`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Command injection, Authentication bypass - [Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR](https://agentprime.io/advisories/CVE-2026-8603.md) `CVE-2026-8603` · CVE record: ScadaBR ScadaBR · CVSS 8.7 High · Not analysed yet · Published 19 May 2026 · Tags: Command injection - [An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter.](https://agentprime.io/advisories/CVE-2026-37281.md) `CVE-2026-37281` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Command injection - [A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7.](https://agentprime.io/advisories/CVE-2026-36828.md) `CVE-2026-36828` · CVE record · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .