# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [better-npm-audit OS Command Injection via registry flag](https://agentprime.io/advisories/CVE-2026-57998.md) `CVE-2026-57998` · CVE record: jeemok better-npm-audit · CVSS 8.5 High · Not analysed yet · Published 22 Aug 2026 · Tags: Command injection - [TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injection](https://agentprime.io/advisories/CVE-2026-77988.md) `CVE-2026-77988` · CVE record: TRENDnet TEW-823DRU · CVSS 5.1 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Other injection, Command injection - [TRENDnet TEW-821DAP ssi upload.cgi command injection](https://agentprime.io/advisories/CVE-2026-77945.md) `CVE-2026-77945` · CVE record: TRENDnet TEW-821DAP · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Other injection, Command injection - [UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh](https://agentprime.io/advisories/CVE-2026-41451.md) `CVE-2026-41451` · CVE record: tclahr uac · CVSS 8.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [UAC < 3.3.0 Command Injection via command_collector.sh](https://agentprime.io/advisories/CVE-2026-41450.md) `CVE-2026-41450` · CVE record: tclahr uac · CVSS 8.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [UAC < 3.3.0 Command Injection via run_command.sh](https://agentprime.io/advisories/CVE-2026-41449.md) `CVE-2026-41449` · CVE record: tclahr uac · CVSS 8.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution](https://agentprime.io/advisories/CVE-2026-62867.md) `CVE-2026-62867` · CVE record: lxc incus · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [Comfast CF-N1-S mbox-config system command injection](https://agentprime.io/advisories/CVE-2026-77683.md) `CVE-2026-77683` · CVE record: Comfast CF-N1-S · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection, Command injection - [CVE-2026-47827 – BOSH CLI Powershell Injection](https://agentprime.io/advisories/CVE-2026-47827.md) `CVE-2026-47827` · CVE record: Cloud Foundry Foundation BOSH CLI · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials](https://agentprime.io/advisories/CVE-2026-63046.md) `CVE-2026-63046` · CVE record: Apache Software Foundation Apache InLong · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [Apache CloudStack: OS Command Injection due to unsanitized mount command](https://agentprime.io/advisories/CVE-2026-47359.md) `CVE-2026-47359` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates](https://agentprime.io/advisories/CVE-2026-50112.md) `CVE-2026-50112` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection, Server-side request forgery (SSRF) - [Apache CloudStack: Get and Run Diagnostics Command Injection](https://agentprime.io/advisories/CVE-2026-61400.md) `CVE-2026-61400` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command](https://agentprime.io/advisories/CVE-2026-76156.md) `CVE-2026-76156` · CVE record: Datiphy Inc. Data Management Center · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-18835.md) `CVE-2026-18835` · CVE record: IBM AIX and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-18824.md) `CVE-2026-18824` · CVE record: IBM AIX and 1 more · CVSS 8.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65770.md) `CVE-2026-65770` · CVE record: Microsoft Azure Managed Instance for Apache Cassandra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [OTRS Community Edition OS Command Injection via PGP Configuration](https://agentprime.io/advisories/CVE-2026-53804.md) `CVE-2026-53804` · CVE record: Centuran Consulting OTRS Community Edition · CVSS 8.6 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)](https://agentprime.io/advisories/GHSA-mrc5-3mm3-45c5.md) `GHSA-mrc5-3mm3-45c5`, `CVE-2026-54182`, `PKSA-qrrt-7bj6-f81q` · Packagist `backpack/crud`: affected `>=4.1.0, <4.1.72 || >=5.0.0, <5.6.2 || >=6.0.0, <6.8.13 || >=7.0.0, <7.0.36`, fixed in `4.1.72`, `5.6.2`, `6.8.13`, `7.0.36` · CVSS 8.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection, CWE-20, CWE-116 - [Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways](https://agentprime.io/advisories/CVE-2026-19586.md) `CVE-2026-19586` · CVE record: TP-Link Systems Inc. ER7212PC v2 and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [NocoBase backup restore schema name allows command injection](https://agentprime.io/advisories/GHSA-p853-83gj-wjj3.md) `GHSA-p853-83gj-wjj3`, `CVE-2026-55410` · npm `@nocobase/plugin-backups`: affected `<2.1.19`, fixed in `2.1.19` · CVSS 6.7 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [Tenda CH22 formcreateFileName command injection](https://agentprime.io/advisories/CVE-2026-77031.md) `CVE-2026-77031` · CVE record: Tenda CH22 · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, Command injection - [Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-18284.md) `CVE-2026-18284` · CVE record: Sony XAV-9500ES · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-18272.md) `CVE-2026-18272` · CVE record: Kenwood DNR1007XR · CVSS 6.8 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-18268.md) `CVE-2026-18268` · CVE record: Kenwood DNR1007XR · CVSS 7.0 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [NoMachine getstat Command Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-18264.md) `CVE-2026-18264` · CVE record: NoMachine NoMachine · CVSS 8.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [Comfast CF-N1-S mbox-config sprintf command injection](https://agentprime.io/advisories/CVE-2026-77004.md) `CVE-2026-77004` · CVE record: Comfast CF-N1-S · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16932.md) `CVE-2026-16932` · CVE record: IBM AIX and 1 more · CVSS 8.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [accountsservice: shell injection via attacker-controlled \~/.pam_environment in Ubuntu language helper scripts](https://agentprime.io/advisories/CVE-2026-61898.md) `CVE-2026-61898` · CVE record: Canonical accountsservice · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [CVE-2026-18482](https://agentprime.io/advisories/CVE-2026-18482.md) `CVE-2026-18482` · CVE record: Klarso GmbH neo-mjs · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values](https://agentprime.io/advisories/CVE-2026-77084.md) `CVE-2026-77084` · CVE record: n8n-io n8n · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [n8n before 1.123.69 Arbitrary File Read and Write via Snowflake](https://agentprime.io/advisories/CVE-2026-77080.md) `CVE-2026-77080` · CVE record: n8n-io n8n · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection - [chenhg5 cc-connect Management API engine.go shellExecCommand os command injection](https://agentprime.io/advisories/CVE-2026-76761.md) `CVE-2026-76761` · CVE record: chenhg5 cc-connect · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [TRENDnet TEW-755AP ssi email.cgi log_email_server command injection](https://agentprime.io/advisories/CVE-2026-76591.md) `CVE-2026-76591` · CVE record: TRENDnet TEW-755AP · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection - [SPL Injection through the geostats Command in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76339.md) `CVE-2026-76339` · CVE record: Splunk Splunk Enterprise · CVSS 5.4 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [SPL Injection through Splunk Web in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76328.md) `CVE-2026-76328` · CVE record: Splunk Splunk Enterprise · CVSS 6.7 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [SPL Injection through Nearby Event Searches in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76321.md) `CVE-2026-76321` · CVE record: Splunk Splunk Enterprise · CVSS 7.3 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [TRENDnet TV-IP751WIC alphapd set_time.cgi command injection](https://agentprime.io/advisories/CVE-2026-76583.md) `CVE-2026-76583` · CVE record: TRENDnet TV-IP751WIC · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection - [Command Injection in Router Web Management Interface](https://agentprime.io/advisories/CVE-2026-75616.md) `CVE-2026-75616` · CVE record: TP-Link Systems Inc. Archer C20 v6 · CVSS 8.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection](https://agentprime.io/advisories/CVE-2026-53545.md) `CVE-2026-53545` · CVE record: Termix-SSH Termix · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts](https://agentprime.io/advisories/CVE-2026-53542.md) `CVE-2026-53542` · CVE record: Termix-SSH Termix · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [TRENDnet TEW-821DAP ssi ping.cgi system command injection](https://agentprime.io/advisories/CVE-2026-76582.md) `CVE-2026-76582` · CVE record: TRENDnet TEW-821DAP · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16882.md) `CVE-2026-16882` · CVE record: IBM AIX and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16875.md) `CVE-2026-16875` · CVE record: IBM AIX and 1 more · CVSS 7.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16865.md) `CVE-2026-16865` · CVE record: IBM AIX and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16848.md) `CVE-2026-16848` · CVE record: IBM AIX and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16844.md) `CVE-2026-16844` · CVE record: IBM AIX and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16842.md) `CVE-2026-16842` · CVE record: IBM AIX and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Wekan:hell Injection in External Antivirus Scanner Path via asyncExec](https://agentprime.io/advisories/CVE-2026-68560.md) `CVE-2026-68560` · CVE record: wekan wekan · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution](https://agentprime.io/advisories/GHSA-wv46-xpj8-pw53.md) `GHSA-wv46-xpj8-pw53` · PyPI `gitpython`: affected `<=3.1.57`, no fixed version yet · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite](https://agentprime.io/advisories/GHSA-7jx3-jqcp-hhgc.md) `GHSA-7jx3-jqcp-hhgc` · PyPI `gitpython`: affected `<=3.1.57`, no fixed version yet · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks](https://agentprime.io/advisories/GHSA-298h-jpq4-m665.md) `GHSA-298h-jpq4-m665` · PyPI `gitpython`: affected `<=3.1.57`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16816.md) `CVE-2026-16816` · CVE record: IBM AIX and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')](https://agentprime.io/advisories/CVE-2026-48711.md) `CVE-2026-48711` · CVE record: libfuse sshfs · CVSS 7.0 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [OS command injection in Dell RecoverPoint for Virtual Machines](https://agentprime.io/advisories/CVE-2026-23501.md) `CVE-2026-23501` · CVE record: Dell RecoverPoint for Virtual Machines · CVSS 7.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-15068.md) `CVE-2026-15068` · CVE record: IBM AIX and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler](https://agentprime.io/advisories/CVE-2026-71961.md) `CVE-2026-71961` · CVE record: Shenzhen Cudy Technology Co., Ltd. WR3000 2.0 · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL](https://agentprime.io/advisories/CVE-2026-76212.md) `CVE-2026-76212` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [OS command injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-54795.md) `CVE-2026-54795` · CVE record: Dell OpenManage Enterprise · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection - [OS command injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-54796.md) `CVE-2026-54796` · CVE record: Dell OpenManage Enterprise · CVSS 7.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .