# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Whisper-node through 1.1.1 OS Command Injection via filePath and language](https://agentprime.io/advisories/CVE-2026-110640.md) `CVE-2026-110640` · CVE record: ariym whisper-node · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir](https://agentprime.io/advisories/CVE-2026-110639.md) `CVE-2026-110639` · CVE record: mborne @mborne/extract · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [doc-recog through 1.1.6 OS Command Injection via DocData.\_readPDF File Path](https://agentprime.io/advisories/CVE-2026-110638.md) `CVE-2026-110638` · CVE record: zepspaiva doc-recog · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name](https://agentprime.io/advisories/CVE-2026-110637.md) `CVE-2026-110637` · CVE record: wastemobile buildebooks · CVSS 8.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [pypdftk through 0.5 OS Command Injection via PDF and Output Paths](https://agentprime.io/advisories/CVE-2026-110636.md) `CVE-2026-110636` · CVE record: revolunet pypdftk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [webp-converter before 3.0.0 OS Command Injection via File Names and Options](https://agentprime.io/advisories/CVE-2026-110635.md) `CVE-2026-110635` · CVE record: scionoftech webp-converter · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [office-converter through 1.0.2 OS Command Injection via fileName in generatePdf](https://agentprime.io/advisories/CVE-2020-37282.md) `CVE-2020-37282` · CVE record: vworld4u office-converter · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [OS command injection in Dell Unisphere for PowerMax vApp](https://agentprime.io/advisories/CVE-2026-101215.md) `CVE-2026-101215` · CVE record: Dell Unisphere for PowerMax vApp · CVSS 6.6 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [Command injection in Dell Unisphere for PowerMax vApp](https://agentprime.io/advisories/CVE-2026-101216.md) `CVE-2026-101216` · CVE record: Dell Unisphere for PowerMax vApp · CVSS 6.6 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [OS Command in TR7 Cyber Defense's TR7 ASP](https://agentprime.io/advisories/CVE-2026-16741.md) `CVE-2026-16741` · CVE record: TR7 Cyber Defense Inc. TR7 ASP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability](https://agentprime.io/advisories/CVE-2026-73792.md) `CVE-2026-73792` · CVE record: Hewlett Packard Enterprise HPE NonStop Java JToolkit · CVSS 3.8 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task](https://agentprime.io/advisories/CVE-2026-105106.md) `CVE-2026-105106` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [OS command injection in EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd and others](https://agentprime.io/advisories/CVE-2026-106931.md) `CVE-2026-106931` · CVE record: EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd and 4 more · CVSS 8.5 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution](https://agentprime.io/advisories/CVE-2026-105429.md) `CVE-2026-105429` · CVE record: NetBird NetBird · CVSS 8.9 High · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection, CWE-116 - [OS command injection in Collabora Online - Built-in CODE Server](https://agentprime.io/advisories/CVE-2026-110447.md) `CVE-2026-110447` · CVE record: Collabora Collabora Online - Built-in CODE Server · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.73 · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning](https://agentprime.io/advisories/CVE-2026-110392.md) `CVE-2026-110392` · CVE record: Samsung Open Source QA-Board · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [OS command injection in Akamai Guardicore Platform Agent](https://agentprime.io/advisories/CVE-2026-46449.md) `CVE-2026-46449` · CVE record: Akamai Guardicore Platform Agent · CVSS 6.7 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection - [Persistent Command Execution](https://agentprime.io/advisories/CVE-2026-53563.md) `CVE-2026-53563` · CVE record: Citrix UniconOS · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-103848.md) `CVE-2026-103848` · CVE record: Adobe Adobe Experience Manager 6.5 LTS and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Moghtech Komodo contains an OS command injection vulnerability](https://agentprime.io/advisories/CVE-2026-110005.md) `CVE-2026-110005` · CVE record: Komodo Komodo · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling](https://agentprime.io/advisories/CVE-2026-86022.md) `CVE-2026-86022` · CVE record: vnotex vnote · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [MultiTail: Shell injection in execute-on-match command handling](https://agentprime.io/advisories/CVE-2026-55601.md) `CVE-2026-55601` · CVE record: folkertvanheusden multitail · CVSS 7.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Microsoft Office OneNote Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-97781.md) `CVE-2026-97781` · CVE record: Microsoft Microsoft 365 Apps for Enterprise · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Windows Error Reporting Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-97798.md) `CVE-2026-97798` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Azure CycleCloud Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-100207.md) `CVE-2026-100207` · CVE record: Microsoft Azure CycleCloud 8.9.1 · CVSS 7.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Windows Shell Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-96951.md) `CVE-2026-96951` · CVE record: Microsoft Microsoft Edge (Chromium-based) and 4 more · CVSS 8.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Windows Update Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69718.md) `CVE-2026-69718` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Visual Studio Code Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69370.md) `CVE-2026-69370` · CVE record: Microsoft Visual Studio Code · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name](https://agentprime.io/advisories/CVE-2026-110236.md) `CVE-2026-110236` · CVE record: KDE Dolphin · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe](https://agentprime.io/advisories/CVE-2026-110233.md) `CVE-2026-110233` · CVE record: NSPC911 rovr · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Potential command execution on the host running JFrog CLI.](https://agentprime.io/advisories/CVE-2026-92892.md) `CVE-2026-92892` · CVE record: jfrog jfrog-cli · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [OS command injection in Fortinet FortiManager and others](https://agentprime.io/advisories/CVE-2026-106171.md) `CVE-2026-106171` · CVE record: Fortinet FortiManager and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [odt2spip < 4.4.0 OS Command Injection via Document Filename](https://agentprime.io/advisories/CVE-2026-104085.md) `CVE-2026-104085` · CVE record: odt2spip odt2spip · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [heym Python Tool Sandbox Escape](https://agentprime.io/advisories/CVE-2026-55376.md) `CVE-2026-55376` · CVE record: heymrun heym · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection, Code injection, CWE-693 - [CVFS Command Execution](https://agentprime.io/advisories/CVE-2026-77099.md) `CVE-2026-77099` · CVE record: Commvault Commvault Cloud and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method](https://agentprime.io/advisories/CVE-2026-109966.md) `CVE-2026-109966` · CVE record: marcopiovanello yt-dlp-web-ui · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection](https://agentprime.io/advisories/CVE-2026-109409.md) `CVE-2026-109409` · CVE record: HBAI-Ltd Toonflow-app · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Command injection - [Wavlink WL-WN592AX6 wmapd system os command injection](https://agentprime.io/advisories/CVE-2026-109110.md) `CVE-2026-109110` · CVE record: Wavlink WL-WN592AX6 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection](https://agentprime.io/advisories/CVE-2026-109108.md) `CVE-2026-109108` · CVE record: Wavlink WL-WN530BE1-A · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Teltonika Command Injection in Backup function](https://agentprime.io/advisories/CVE-2026-75826.md) `CVE-2026-75826` · CVE record: Teltonika Networks RUT and 4 more · CVSS 8.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code](https://agentprime.io/advisories/CVE-2026-89116.md) `CVE-2026-89116` · CVE record: SAP_SE SAP yeoman-ui · CVSS 5.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.](https://agentprime.io/advisories/CVE-2026-104585.md) `CVE-2026-104585` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/re…](https://agentprime.io/advisories/CVE-2026-104584.md) `CVE-2026-104584` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection - [DataStage on Cloud Pak for Data Command Injection](https://agentprime.io/advisories/CVE-2026-82096.md) `CVE-2026-82096` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [IBM Maximo Application Suite - Location Service for Esri Component Code Execution](https://agentprime.io/advisories/CVE-2026-18529.md) `CVE-2026-18529` · CVE record: IBM Maximo Application Suite - Location Service for Esri Component · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py](https://agentprime.io/advisories/CVE-2025-71429.md) `CVE-2025-71429` · CVE record: RVC-Boss GPT-SoVITS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function](https://agentprime.io/advisories/CVE-2020-37279.md) `CVE-2020-37279` · CVE record: karuppiah7890 easy-pdf-merge · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [Netcore NR268 DDNS DDNSset.cgi execvp argument injection](https://agentprime.io/advisories/CVE-2026-108929.md) `CVE-2026-108929` · CVE record: Netcore NR268 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection - [Edimax BR-6208AC formWlanMP command injection](https://agentprime.io/advisories/CVE-2026-108918.md) `CVE-2026-108918` · CVE record: Edimax BR-6208AC · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection - [Edimax BR-6208AC formAutoFWupgrade command injection](https://agentprime.io/advisories/CVE-2026-108917.md) `CVE-2026-108917` · CVE record: Edimax BR-6208AC · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection - [Edimax BR-6208AC formAccept command injection](https://agentprime.io/advisories/CVE-2026-108916.md) `CVE-2026-108916` · CVE record: Edimax BR-6208AC · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Command injection - [Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author](https://agentprime.io/advisories/CVE-2026-109318.md) `CVE-2026-109318` · CVE record: trilbymedia grav-plugin-git-sync · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [Linksys E1700 setLinksysIpv6 os command injection](https://agentprime.io/advisories/CVE-2026-108896.md) `CVE-2026-108896` · CVE record: Linksys E1700 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [Linksys E1700 setDMZ os command injection](https://agentprime.io/advisories/CVE-2026-108895.md) `CVE-2026-108895` · CVE record: Linksys E1700 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [Linksys E1700 Static Route addStaticRoute os command injection](https://agentprime.io/advisories/CVE-2026-108894.md) `CVE-2026-108894` · CVE record: Linksys E1700 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [Command Injection in Ministry of Justice's UYAP Document Editor](https://agentprime.io/advisories/CVE-2026-18390.md) `CVE-2026-18390` · CVE record: Ministry of Justice General Directorate of Information Technology UYAP Document Editor · CVSS 7.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments](https://agentprime.io/advisories/CVE-2026-108953.md) `CVE-2026-108953` · CVE record: cfdude mac-shell-mcp · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5](https://agentprime.io/advisories/CVE-2026-105407.md) `CVE-2026-105407` · CVE record: Dassault Systèmes Tuleap Enterprise Edition · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [agno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection](https://agentprime.io/advisories/CVE-2026-108817.md) `CVE-2026-108817` · CVE record: agno-agi agno · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection - [TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection](https://agentprime.io/advisories/CVE-2026-108804.md) `CVE-2026-108804` · CVE record: TRENDnet TEW-751DR and 2 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .