# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection](https://agentprime.io/advisories/CVE-2026-91837.md) `CVE-2026-91837` · CVE record: GNOME NetworkManager-iodine · CVSS 7.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Command injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-85542.md) `CVE-2026-85542` · CVE record: IBM Guardium Data Protection · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Command injection - [misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values](https://agentprime.io/advisories/CVE-2026-97863.md) `CVE-2026-97863` · CVE record: misp misp-modules · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Command injection - [D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint.](https://agentprime.io/advisories/CVE-2025-51457.md) `CVE-2025-51457` · CVE record · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Command injection - [Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames](https://agentprime.io/advisories/CVE-2026-85082.md) `CVE-2026-85082` · CVE record: Maple Media Root Browser Classic · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection](https://agentprime.io/advisories/CVE-2026-97366.md) `CVE-2026-97366` · CVE record: jhen0409 react-native-debugger · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [OS command injection in Eufy Omni C20, Omni X10 Pro](https://agentprime.io/advisories/CVE-2026-93289.md) `CVE-2026-93289` · CVE record: Eufy Omni C20 and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface](https://agentprime.io/advisories/CVE-2026-13248.md) `CVE-2026-13248` · CVE record: Honeywell PD45 Industrial Printer · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal, Command injection, Unrestricted file upload - [Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040](https://agentprime.io/advisories/CVE-2026-13249.md) `CVE-2026-13249` · CVE record: Honeywell PD45 Industrial Printer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection, Authentication bypass, Unrestricted file upload - [Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email](https://agentprime.io/advisories/CVE-2026-79766.md) `CVE-2026-79766` · CVE record: Termix-SSH Termix · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Termix: Command injection in SSH key deployment verification](https://agentprime.io/advisories/CVE-2026-79761.md) `CVE-2026-79761` · CVE record: Termix-SSH Termix · CVSS 6.6 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root](https://agentprime.io/advisories/CVE-2026-93425.md) `CVE-2026-93425` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81552.md) `CVE-2026-81552` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81548.md) `CVE-2026-81548` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81545.md) `CVE-2026-81545` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81539.md) `CVE-2026-81539` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm](https://agentprime.io/advisories/CVE-2026-95521.md) `CVE-2026-95521` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Rpm: code execution via macro expansion of manifest entries in \`rpmgi\` (\`-q -p\` / verify manifest flows)](https://agentprime.io/advisories/CVE-2026-95519.md) `CVE-2026-95519` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [PaperCut NG/MF: Remote Code Execution via Scan2Fax](https://agentprime.io/advisories/CVE-2026-82077.md) `CVE-2026-82077` · CVE record: PaperCut PaperCut NG/MF · CVSS 7.3 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal, Command injection - [Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service](https://agentprime.io/advisories/CVE-2026-82370.md) `CVE-2026-82370` · CVE record: Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81537.md) `CVE-2026-81537` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-80425.md) `CVE-2026-80425` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-80412.md) `CVE-2026-80412` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-80379.md) `CVE-2026-80379` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-6721.md) `CVE-2026-6721` · CVE record: IBM Concert · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a](https://agentprime.io/advisories/CVE-2026-82369.md) `CVE-2026-82369` · CVE record: Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Argument injection in WebPros WP Toolkit for cPanel](https://agentprime.io/advisories/CVE-2026-87900.md) `CVE-2026-87900` · CVE record: WebPros WP Toolkit for cPanel · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [OS command injection in WebPros Plesk extension "Site Import"](https://agentprime.io/advisories/CVE-2026-87898.md) `CVE-2026-87898` · CVE record: WebPros Plesk extension "Site Import" · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process](https://agentprime.io/advisories/CVE-2026-84724.md) `CVE-2026-84724` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [OpenC3 COSMOS: Authenticated OS command injection via the \`pypi_url\` setting](https://agentprime.io/advisories/GHSA-vp3w-52v9-q57f.md) `GHSA-vp3w-52v9-q57f`, `CVE-2026-77601` · RubyGems `openc3`: affected `>=5.12.0, <7.3.0`, fixed in `7.3.0` · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into \`git ls-remote --upload-pack\` yields rce on the controller-task control-plane pod](https://agentprime.io/advisories/CVE-2026-84502.md) `CVE-2026-84502` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable](https://agentprime.io/advisories/CVE-2026-71465.md) `CVE-2026-71465` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 3.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard](https://agentprime.io/advisories/CVE-2026-71464.md) `CVE-2026-71464` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 3.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [NetworkManager-l2tp Privilege Escalation via pppd Username Injection](https://agentprime.io/advisories/CVE-2026-75131.md) `CVE-2026-75131` · CVE record: nm-l2tp NetworkManager-l2tp · CVSS 8.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Frictionless OS Command Injection via explore Console Command](https://agentprime.io/advisories/CVE-2026-93349.md) `CVE-2026-93349` · CVE record: frictionlessdata frictionless-py · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Remote Code Execution vulnerability](https://agentprime.io/advisories/CVE-2026-19599.md) `CVE-2026-19599` · CVE record: Zohocorp ManageEngine OpManager · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Command Injection vulnerability](https://agentprime.io/advisories/CVE-2026-76978.md) `CVE-2026-76978` · CVE record: Zohocorp ManageEngine OpManager and 1 more · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Changing｜CGServiSign - OS Command Injection](https://agentprime.io/advisories/CVE-2026-15027.md) `CVE-2026-15027` · CVE record: Changing CGServiSign · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [MQTT WebSocket Command Execution Vulnerability in NitroSense](https://agentprime.io/advisories/CVE-2026-50227.md) `CVE-2026-50227` · CVE record: Acer NitroSense V5 · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection, Authentication bypass - [OS command injection in OpenEye Apex Network Video Recorder (NVR)](https://agentprime.io/advisories/CVE-2026-94367.md) `CVE-2026-94367` · CVE record: OpenEye Apex Network Video Recorder (NVR) · CVSS 7.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-17102.md) `CVE-2026-17102` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-16672.md) `CVE-2026-16672` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-16469.md) `CVE-2026-16469` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-16468.md) `CVE-2026-16468` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass](https://agentprime.io/advisories/GHSA-jpf4-98qj-qr67.md) `GHSA-jpf4-98qj-qr67`, `CVE-2026-76802`, `GO-2026-6570` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 4.7 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API](https://agentprime.io/advisories/GHSA-5jpj-293f-rhvj.md) `GHSA-5jpj-293f-rhvj`, `CVE-2026-62371`, `GO-2026-6557` · Go `github.com/kubeedge/kubeedge`: affected `>=1.12.0, <1.21.2 || >=1.22.0, <1.22.2 || >=1.23.0, <1.23.1`, fixed in `1.21.2`, `1.22.2`, `1.23.1` · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes](https://agentprime.io/advisories/GHSA-m3c6-2p7h-cfr3.md) `GHSA-m3c6-2p7h-cfr3`, `CVE-2026-62182`, `GO-2026-6573` · Go `github.com/kubeedge/kubeedge`: affected `>=1.21.0, <1.21.2 || >=1.22.0, <1.22.2 || >=1.23.0, <1.23.1`, fixed in `1.21.2`, `1.22.2`, `1.23.1` · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE)](https://agentprime.io/advisories/CVE-2026-76714.md) `CVE-2026-76714` · CVE record: Hewlett Packard Enterprise (HPE) ALE · CVSS 7.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection](https://agentprime.io/advisories/CVE-2026-95660.md) `CVE-2026-95660` · CVE record: Moonshot AI Kimi Code · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Softaculous Virtualizor OS Command Injection via Billing Module Handler](https://agentprime.io/advisories/CVE-2026-43641.md) `CVE-2026-43641` · CVE record: Softaculous Virtualizor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog](https://agentprime.io/advisories/CVE-2026-85288.md) `CVE-2026-85288` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 6.7 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection, CWE-345, CWE-693 - [Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule](https://agentprime.io/advisories/CVE-2026-80152.md) `CVE-2026-80152` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download](https://agentprime.io/advisories/CVE-2026-80151.md) `CVE-2026-80151` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password](https://agentprime.io/advisories/CVE-2026-80145.md) `CVE-2026-80145` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write](https://agentprime.io/advisories/CVE-2026-80144.md) `CVE-2026-80144` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read](https://agentprime.io/advisories/CVE-2026-80143.md) `CVE-2026-80143` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [OS command injection in NVIDIA Infrastructure Controller](https://agentprime.io/advisories/CVE-2026-65130.md) `CVE-2026-65130` · CVE record: NVIDIA Infrastructure Controller · CVSS 8.0 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Command injection in NVIDIA NeMo Speech](https://agentprime.io/advisories/CVE-2026-65111.md) `CVE-2026-65111` · CVE record: NVIDIA NeMo Speech · CVSS 7.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface](https://agentprime.io/advisories/CVE-2026-95675.md) `CVE-2026-95675` · CVE record: D-LINK DAP-1360 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection - [Remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-74849.md) `CVE-2026-74849` · CVE record: Zohocorp ManageEngine ADSelfService Plus · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .