# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Argument injection in David-Crty databasement](https://agentprime.io/advisories/CVE-2026-108963.md) `CVE-2026-108963` · CVE record: David-Crty databasement · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Command injection - [pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync](https://agentprime.io/advisories/CVE-2026-108744.md) `CVE-2026-108744` · CVE record: MinaSaad1 pbi-cli · CVSS 7.3 High · Not analysed yet · Published 11 Oct 2026 · Tags: Command injection - [TOZED X300 IPPingDiagnostics process_ping os command injection](https://agentprime.io/advisories/CVE-2026-108576.md) `CVE-2026-108576` · CVE record: TOZED X300 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2026 · Tags: Command injection - [OpenSpug File Transfer transfer os command injection](https://agentprime.io/advisories/CVE-2026-108540.md) `CVE-2026-108540` · CVE record: OpenSpug Spug · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2026 · Tags: Command injection - [Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration](https://agentprime.io/advisories/CVE-2026-108546.md) `CVE-2026-108546` · CVE record: spotweb spotweb · CVSS 7.7 High · Not analysed yet · Published 10 Oct 2026 · Tags: Command injection - [FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download](https://agentprime.io/advisories/CVE-2026-108161.md) `CVE-2026-108161` · CVE record: fusionpbx fusionpbx · CVSS 7.7 High · Not analysed yet · Published 10 Oct 2026 · Tags: Command injection - [ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export](https://agentprime.io/advisories/CVE-2026-101947.md) `CVE-2026-101947` · CVE record: CellHubs ExifTool for photo and video · CVSS 8.4 High · Not analysed yet · Published 10 Oct 2026 · Tags: Command injection - [Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL](https://agentprime.io/advisories/GHSA-j6cw-g6p4-7hch.md) `GHSA-j6cw-g6p4-7hch`, `BIT-argo-cd-2026-55797`, `CVE-2026-55797`, `GO-2026-6701` · Go `github.com/argoproj/argo-cd/v2` and 1 more: affected `>=2.11.0, <=2.14.21`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Command injection - [An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade file](https://agentprime.io/advisories/CVE-2026-78796.md) `CVE-2026-78796` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Command injection - [SumatraPDF — Windows command-line argument injection in AI selection-translate](https://agentprime.io/advisories/CVE-2026-107802.md) `CVE-2026-107802` · CVE record: sumatrapdfreader sumatrapdf · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors](https://agentprime.io/advisories/CVE-2026-107734.md) `CVE-2026-107734` · CVE record: sumatrapdfreader sumatrapdf · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, CWE-20 - [PraisonAI: Shell command allowlist bypass via find -exec built-in action](https://agentprime.io/advisories/GHSA-cv3g-hj65-pcfh.md) `GHSA-cv3g-hj65-pcfh`, `CVE-2026-61434`, `PYSEC-2026-4254` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, CWE-693 - [PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls](https://agentprime.io/advisories/GHSA-9mp3-24cc-77mg.md) `GHSA-9mp3-24cc-77mg`, `CVE-2026-61445`, `PYSEC-2026-4253` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Command injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84057.md) `CVE-2026-84057` · CVE record: IBM Guardium Data Protection · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-11939.md) `CVE-2026-11939` · CVE record: IBM Security Verify Access and 3 more · CVSS 2.7 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-18740.md) `CVE-2026-18740` · CVE record: IBM Security Verify Access and 3 more · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-19482.md) `CVE-2026-19482` · CVE record: IBM Security Verify Access and 3 more · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter](https://agentprime.io/advisories/CVE-2026-107780.md) `CVE-2026-107780` · CVE record: dromara skyeye · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Command Injection](https://agentprime.io/advisories/CVE-2026-106126.md) `CVE-2026-106126` · CVE record: Tenable, Inc. Tenable Identity Exposure (SaaS) · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [IBM Guardium Data Protection Command Injection](https://agentprime.io/advisories/CVE-2026-84278.md) `CVE-2026-84278` · CVE record: IBM Guardium Data Protection · CVSS 7.2 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format](https://agentprime.io/advisories/CVE-2026-107704.md) `CVE-2026-107704` · CVE record: jtescher image_optimizer · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo](https://agentprime.io/advisories/CVE-2026-107703.md) `CVE-2026-107703` · CVE record: enmaso @enmaso/node-convert · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [ppt2png through 0.0.6 OS Command Injection via input and output paths](https://agentprime.io/advisories/CVE-2026-107699.md) `CVE-2026-107699` · CVE record: tzwm ppt2png · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in OpenStack Mistral](https://agentprime.io/advisories/CVE-2026-93858.md) `CVE-2026-93858` · CVE record: OpenStack Mistral · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [PraisonAI: SkillTools Executes Scripts Without Path Containment Validation](https://agentprime.io/advisories/GHSA-c44f-37qr-gw3f.md) `GHSA-c44f-37qr-gw3f`, `CVE-2026-61443`, `PYSEC-2026-4270` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Command injection - [ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename](https://agentprime.io/advisories/CVE-2026-107639.md) `CVE-2026-107639` · CVE record: ILIAS-eLearning e.V. ILIAS · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Authenticated argument injection in NIOS command line leading to privilege escalation](https://agentprime.io/advisories/CVE-2026-107510.md) `CVE-2026-107510` · CVE record: Infoblox NIOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, Privilege escalation, Broken access control - [Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter](https://agentprime.io/advisories/CVE-2026-105110.md) `CVE-2026-105110` · CVE record: Iskratel Innbox · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, Authentication bypass - [Argument injection in WebPros WP Toolkit](https://agentprime.io/advisories/CVE-2026-93699.md) `CVE-2026-93699` · CVE record: WebPros WP Toolkit · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Openfind｜SecuShare Pro - OS Command Injection](https://agentprime.io/advisories/CVE-2026-107459.md) `CVE-2026-107459` · CVE record: Openfind SecuShare Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94579.md) `CVE-2026-94579` · CVE record: Brocade Fabric OS · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87677.md) `CVE-2026-87677` · CVE record: Brocade Fabric OS · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94586.md) `CVE-2026-94586` · CVE record: Brocade Fabric OS · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94581.md) `CVE-2026-94581` · CVE record: Brocade Fabric OS · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87662.md) `CVE-2026-87662` · CVE record: Brocade Fabric OS · CVSS 7.0 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Argument injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87667.md) `CVE-2026-87667` · CVE record: Brocade Fabric OS · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87666.md) `CVE-2026-87666` · CVE record: Brocade Fabric OS · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87675.md) `CVE-2026-87675` · CVE record: Brocade Fabric OS · CVSS 7.3 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87674.md) `CVE-2026-87674` · CVE record: Brocade Fabric OS · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87673.md) `CVE-2026-87673` · CVE record: Brocade Fabric OS · CVSS 7.0 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Argument injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87687.md) `CVE-2026-87687` · CVE record: Brocade Fabric OS · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87688.md) `CVE-2026-87688` · CVE record: Brocade Fabric OS · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87682.md) `CVE-2026-87682` · CVE record: Brocade Fabric OS · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [OS command injection in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87680.md) `CVE-2026-87680` · CVE record: Brocade Fabric OS · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection - [Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration](https://agentprime.io/advisories/GHSA-w794-rj3p-xv45.md) `GHSA-w794-rj3p-xv45`, `CVE-2026-105697`, `PYSEC-2026-4237`, `PYSEC-2026-4239`, `PYSEC-2026-4241` · PyPI `langflow` and 2 more: affected `>=1.1.2, <1.10.3`, fixed in `1.10.3` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium](https://agentprime.io/advisories/GHSA-9gvv-qjj3-2p6g.md) `GHSA-9gvv-qjj3-2p6g`, `CVE-2026-119978`, `CVE-2026-73483` · npm `flowise` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection, CWE-749 - [Cisco Smart Software Manager On-Prem Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76437.md) `CVE-2026-76437` · CVE record: Cisco Cisco License On-Prem · CVSS 4.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization](https://agentprime.io/advisories/CVE-2026-106556.md) `CVE-2026-106556` · CVE record: backstage backstage and 1 more · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection, CWE-184 - [CVE-2026-107202](https://agentprime.io/advisories/CVE-2026-107202.md) `CVE-2026-107202` · CVE record: jonssonyan h-ui · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [OS command injection in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-102256.md) `CVE-2026-102256` · CVE record: SonicWall SMA1000 · CVSS 7.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript](https://agentprime.io/advisories/CVE-2026-106059.md) `CVE-2026-106059` · CVE record: gitahead gitahead · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames](https://agentprime.io/advisories/CVE-2026-106058.md) `CVE-2026-106058` · CVE record: gitahead gitahead · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt](https://agentprime.io/advisories/CVE-2026-106057.md) `CVE-2026-106057` · CVE record: wummel patool · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting](https://agentprime.io/advisories/CVE-2026-106056.md) `CVE-2026-106056` · CVE record: rundeck rundeck · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET](https://agentprime.io/advisories/CVE-2026-92531.md) `CVE-2026-92531` · CVE record: BugTracker.NET BugTracker.NET · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.](https://agentprime.io/advisories/CVE-2025-70521.md) `CVE-2025-70521` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.](https://agentprime.io/advisories/CVE-2025-70518.md) `CVE-2025-70518` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection - [Security Advisory 0190](https://agentprime.io/advisories/CVE-2026-102160.md) `CVE-2026-102160` · CVE record: Arista Networks CloudVision CUE · CVSS 8.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Command injection - [Authenticated Command Injection Vulnerability in the ClearPass Policy Manager OnGuard Agent](https://agentprime.io/advisories/CVE-2026-79815.md) `CVE-2026-79815` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Command injection - [Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manager API](https://agentprime.io/advisories/CVE-2026-79803.md) `CVE-2026-79803` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .