# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Shell Command Injection in nnn](https://agentprime.io/advisories/CVE-2026-65612.md) `CVE-2026-65612` · CVE record: nnn nnn · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Shell Command Injection in nnn](https://agentprime.io/advisories/CVE-2026-65611.md) `CVE-2026-65611` · CVE record: nnn nnn · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [TRENDnet Router ping.cgi command injection](https://agentprime.io/advisories/CVE-2026-75985.md) `CVE-2026-75985` · CVE record: TRENDnet Router · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection - [TRENDnet TEW-823DRU admin.cgi command injection](https://agentprime.io/advisories/CVE-2026-75984.md) `CVE-2026-75984` · CVE record: TRENDnet TEW-823DRU · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection - [Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback](https://agentprime.io/advisories/CVE-2026-52876.md) `CVE-2026-52876` · CVE record: truelockmc streambert · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection, CWE-20 - [LibreNMS Vulnerable to Remote Code Execution via AboutController](https://agentprime.io/advisories/GHSA-jf24-8g2h-2wg7.md) `GHSA-jf24-8g2h-2wg7`, `CVE-2026-84190`, `PKSA-m3bp-hsvq-mjs5` · Packagist `librenms/librenms`: affected `<26.5.0`, fixed in `26.5.0` · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection - [Blueprint Studio Git credential helper command injection](https://agentprime.io/advisories/CVE-2026-53455.md) `CVE-2026-53455` · CVE record: ha-china blueprint-studio · CVSS 8.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection - [MONAI vulnerable to OS command injection](https://agentprime.io/advisories/GHSA-rghg-q7wp-9767.md) `GHSA-rghg-q7wp-9767`, `CVE-2026-100844`, `PYSEC-2026-4019` · PyPI `monai`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 8.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection - [Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist](https://agentprime.io/advisories/CVE-2026-71551.md) `CVE-2026-71551` · CVE record: super-productivity super-productivity · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection - [LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module](https://agentprime.io/advisories/GHSA-c9fv-cgmm-2wg7.md) `GHSA-c9fv-cgmm-2wg7`, `CVE-2026-55182`, `PKSA-8dtq-rfyc-264h` · Packagist `librenms/librenms`: affected `>=21.6.0, <26.5.0`, fixed in `26.5.0` · CVSS 8.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection - [Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)](https://agentprime.io/advisories/CVE-2026-68939.md) `CVE-2026-68939` · CVE record: pyenv pyenv · CVSS 2.0 Low · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection, CWE-155 - [Microsoft Copilot Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-24301.md) `CVE-2026-24301` · CVE record: Microsoft Copilot Web · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection - [COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection](https://agentprime.io/advisories/CVE-2026-75094.md) `CVE-2026-75094` · CVE record: COMFAST CF-N1-S · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Command injection - [Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution](https://agentprime.io/advisories/CVE-2026-71858.md) `CVE-2026-71858` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 5.4 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection, CWE-345, CWE-693 - [Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem](https://agentprime.io/advisories/CVE-2026-71472.md) `CVE-2026-71472` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [kylecui NetForensicMCP index.js execAsync command injection](https://agentprime.io/advisories/CVE-2026-75011.md) `CVE-2026-75011` · CVE record: kylecui NetForensicMCP · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, Command injection - [uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set](https://agentprime.io/advisories/GHSA-fhgh-wq4q-r37x.md) `GHSA-fhgh-wq4q-r37x`, `GO-2026-6246` · Go `gitlab.com/uniget-org/cli`: affected `>=0.27.4, <0.28.9`, fixed in `0.28.9` · CVSS 7.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection, Weak cryptography or TLS - [uniget CLI has an EDITOR Command Injection](https://agentprime.io/advisories/GHSA-qmcq-xw74-w667.md) `GHSA-qmcq-xw74-w667`, `CVE-2026-55061`, `GO-2026-6248` · Go `gitlab.com/uniget-org/cli`: affected `<0.27.6`, fixed in `0.27.6` · CVSS 1.0 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Glances: \`--disable-config-exec\` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)](https://agentprime.io/advisories/GHSA-59fj-m2j6-hcxh.md) `GHSA-59fj-m2j6-hcxh`, `CVE-2026-68519`, `PYSEC-2026-3665` · PyPI `glances`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection](https://agentprime.io/advisories/GHSA-73wf-9vmv-5pv9.md) `GHSA-73wf-9vmv-5pv9`, `CVE-2026-62982`, `PYSEC-2026-3666` · PyPI `glances`: affected `>=4.5.2, <4.5.6`, fixed in `4.5.6` · CVSS 8.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction](https://agentprime.io/advisories/GHSA-qcpp-8x79-hhp3.md) `GHSA-qcpp-8x79-hhp3`, `CVE-2026-68518`, `PYSEC-2026-3668` · PyPI `glances`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 8.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [OS command injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75056.md) `CVE-2026-75056` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Command injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75052.md) `CVE-2026-75052` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.6 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests](https://agentprime.io/advisories/CVE-2026-71567.md) `CVE-2026-71567` · CVE record: openshift-metal3 fakefish · CVSS 7.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [OS command injection in Dell ObjectScale](https://agentprime.io/advisories/CVE-2026-56685.md) `CVE-2026-56685` · CVE record: Dell ObjectScale · CVSS 7.3 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [OS command injection in Dell ObjectScale](https://agentprime.io/advisories/CVE-2026-59910.md) `CVE-2026-59910` · CVE record: Dell ObjectScale · CVSS 7.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [OS command injection in Dell ObjectScale](https://agentprime.io/advisories/CVE-2026-56686.md) `CVE-2026-56686` · CVE record: Dell ObjectScale · CVSS 7.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Command injection in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-75007.md) `CVE-2026-75007` · CVE record: Roundcube Webmail · CVSS 5.4 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Command injection in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-75004.md) `CVE-2026-75004` · CVE record: Roundcube Webmail · CVSS 4.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Command injection in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-75002.md) `CVE-2026-75002` · CVE record: Roundcube Webmail · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [OS command injection in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-74997.md) `CVE-2026-74997` · CVE record: Roundcube Webmail · CVSS 8.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe](https://agentprime.io/advisories/CVE-2026-74801.md) `CVE-2026-74801` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection](https://agentprime.io/advisories/CVE-2026-19983.md) `CVE-2026-19983` · CVE record: GL.iNet A1300 and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [GL.iNet BE9300/MT6000 Firewall-management RPC os command injection](https://agentprime.io/advisories/CVE-2026-19982.md) `CVE-2026-19982` · CVE record: GL.iNet BE9300 and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection](https://agentprime.io/advisories/CVE-2026-19981.md) `CVE-2026-19981` · CVE record: GL.iNet A1300 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection](https://agentprime.io/advisories/CVE-2026-19978.md) `CVE-2026-19978` · CVE record: jiantao88 android-mcp-server · CVSS 4.8 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [COMFAST CF-N1-S mbox-config sub_44A968 command injection](https://agentprime.io/advisories/CVE-2026-19976.md) `CVE-2026-19976` · CVE record: COMFAST CF-N1-S · CVSS 5.1 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Other injection, Command injection - [An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function](https://agentprime.io/advisories/CVE-2026-67965.md) `CVE-2026-67965` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection - [Edimax EW-7478APC stainfo command injection](https://agentprime.io/advisories/CVE-2026-19963.md) `CVE-2026-19963` · CVE record: Edimax EW-7478APC · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, Command injection - [Edimax EW-7478APC setWAN command injection](https://agentprime.io/advisories/CVE-2026-19962.md) `CVE-2026-19962` · CVE record: Edimax EW-7478APC · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, Command injection - [Edimax EW-7478APC formWlbasic command injection](https://agentprime.io/advisories/CVE-2026-19960.md) `CVE-2026-19960` · CVE record: Edimax EW-7478APC · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Other injection, Command injection - [Token Optimizer MCP: OS command injection in smart_user via username in get-user-info](https://agentprime.io/advisories/GHSA-49mq-fc6q-3h46.md) `GHSA-49mq-fc6q-3h46`, `CVE-2026-55157` · npm `@ooples/token-optimizer-mcp`: affected `<5.1.0`, fixed in `5.1.0` · CVSS 8.4 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Microsoft PowerShell Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-50523.md) `CVE-2026-50523` · CVE record: Microsoft PowerShell 7.4 and 2 more · CVSS 7.8 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename](https://agentprime.io/advisories/CVE-2026-73680.md) `CVE-2026-73680` · CVE record: Cockpit HQ Cockpit CMS · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [IBM Db2 Mirror for i is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-17186.md) `CVE-2026-17186` · CVE record: IBM Db2 Mirror for i · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [IBM Db2 Mirror for i is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-17179.md) `CVE-2026-17179` · CVE record: IBM Db2 Mirror for i · CVSS 8.5 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Haiwell IoT Cloud HMI Gateway OS Command Injection](https://agentprime.io/advisories/CVE-2026-19188.md) `CVE-2026-19188` · CVE record: Haiwell Haiwell IoT Cloud HMI Gateway · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Command Injection](https://agentprime.io/advisories/CVE-2026-19682.md) `CVE-2026-19682` · CVE record: Tenable, Inc. Security Center · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Command Injection](https://agentprime.io/advisories/CVE-2026-19681.md) `CVE-2026-19681` · CVE record: Tenable, Inc. Security Center · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Improper Input Validation](https://agentprime.io/advisories/CVE-2026-19679.md) `CVE-2026-19679` · CVE record: Tenable, Inc. Security Center · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-19635.md) `CVE-2026-19635` · CVE record: Tenable, Inc. Security Center · CVSS 8.5 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Remote Code Execution](https://agentprime.io/advisories/CVE-2026-19628.md) `CVE-2026-19628` · CVE record: Tenable, Inc. Security Center · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Baicells EG3661M LuCI Web luci os command injection](https://agentprime.io/advisories/CVE-2026-19771.md) `CVE-2026-19771` · CVE record: Baicells EG3661M · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: Command injection - [Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files](https://agentprime.io/advisories/CVE-2026-73662.md) `CVE-2026-73662` · CVE record: FreePBX music · CVSS 7.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Command injection - [FreePBX: Authenticated TTS AGI Command Injection Through TTS Name](https://agentprime.io/advisories/CVE-2026-73660.md) `CVE-2026-73660` · CVE record: FreePBX tts · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Command injection - [Tenda CH7 ATE Module Kylin HandleCmd command injection](https://agentprime.io/advisories/CVE-2026-19747.md) `CVE-2026-19747` · CVE record: Tenda CH7 and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Other injection, Command injection - [OS command injection in Zimbra Collaboration](https://agentprime.io/advisories/CVE-2026-73570.md) `CVE-2026-73570` · CVE record: Zimbra Collaboration · CVSS 8.9 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.77 · Not analysed yet · Published 13 Aug 2026 · Tags: Command injection - [rsync < 3.5.0 Command Injection via Multiple Code Paths](https://agentprime.io/advisories/CVE-2026-53790.md) `CVE-2026-53790` · CVE record: RsyncProject rsync · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Command injection - [rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync](https://agentprime.io/advisories/CVE-2026-53783.md) `CVE-2026-53783` · CVE record: RsyncProject rsync · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Command injection - [Duplicate Advisory: Flowise contains an unauthenticated sandbox escape](https://agentprime.io/advisories/GHSA-6j9g-8fxc-25hq.md) `GHSA-6j9g-8fxc-25hq` · npm `flowise` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 13 Aug 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .