# Command injection. Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection](https://agentprime.io/advisories/CVE-2026-120275.md) `CVE-2026-120275` · CVE record: Shanghai Xi Yu Ji Zhi Technology Minimax Code · CVSS 5.1 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection](https://agentprime.io/advisories/CVE-2026-120240.md) `CVE-2026-120240` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection](https://agentprime.io/advisories/CVE-2026-120239.md) `CVE-2026-120239` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection](https://agentprime.io/advisories/CVE-2026-120238.md) `CVE-2026-120238` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection](https://agentprime.io/advisories/CVE-2026-120231.md) `CVE-2026-120231` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection](https://agentprime.io/advisories/CVE-2026-120230.md) `CVE-2026-120230` · CVE record: WAVLINK WN701AE · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN553X1-B ioos sub_416B50 os command injection](https://agentprime.io/advisories/CVE-2026-120229.md) `CVE-2026-120229` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN553X1-B ioos Service sub_416D88 os command injection](https://agentprime.io/advisories/CVE-2026-120228.md) `CVE-2026-120228` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection](https://agentprime.io/advisories/CVE-2026-120227.md) `CVE-2026-120227` · CVE record: WAVLINK WN701AE · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection](https://agentprime.io/advisories/CVE-2026-120198.md) `CVE-2026-120198` · CVE record: WAVLINK WL-WN530BE1-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Other injection, Command injection - [WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection](https://agentprime.io/advisories/CVE-2026-120197.md) `CVE-2026-120197` · CVE record: WAVLINK WL-WN530HG4B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WN579X3-D wapi.cgi port_forward os command injection](https://agentprime.io/advisories/CVE-2026-120196.md) `CVE-2026-120196` · CVE record: WAVLINK WN579X3-D · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection](https://agentprime.io/advisories/CVE-2026-120195.md) `CVE-2026-120195` · CVE record: WAVLINK WL-WN579A3-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection - [SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields](https://agentprime.io/advisories/CVE-2026-116755.md) `CVE-2026-116755` · CVE record: SoftIron HyperCloud · CVSS 7.4 High · Not analysed yet · Published 31 Oct 2026 · Tags: Command injection - [Dream Displays has command-line argument injection in yt-dlp invocation](https://agentprime.io/advisories/CVE-2026-62968.md) `CVE-2026-62968` · CVE record: arsmotorin dreamdisplays · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks](https://agentprime.io/advisories/CVE-2026-62853.md) `CVE-2026-62853` · CVE record: mqttsnet thinglinks · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection, Code injection - [Pi-hole: Local privilege escalation from \`pihole\` user to root via CVE-2026-41489 fix bypass](https://agentprime.io/advisories/CVE-2026-119335.md) `CVE-2026-119335` · CVE record: pi-hole pi-hole · CVSS 7.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name](https://agentprime.io/advisories/CVE-2026-116252.md) `CVE-2026-116252` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection, Hard-coded credentials, Server-side request forgery (SSRF) - [pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier](https://agentprime.io/advisories/CVE-2026-116241.md) `CVE-2026-116241` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection, CWE-115 - [Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line](https://agentprime.io/advisories/CVE-2026-119288.md) `CVE-2026-119288` · CVE record: zuke-build zuke · CVSS 7.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [CVE-2026-118238](https://agentprime.io/advisories/CVE-2026-118238.md) `CVE-2026-118238` · CVE record: Tenda W18E · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [@nx/maven and @nx/gradle have OS command injection via nx.json plugin options](https://agentprime.io/advisories/GHSA-qm8w-vx34-5j9j.md) `GHSA-qm8w-vx34-5j9j`, `CVE-2026-119282` · npm `@nx/gradle` and 1 more: affected `>=21.0.0, <22.7.9 || >=23.0.0, <23.1.2`, fixed in `22.7.9`, `23.1.2` · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [OS command injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91913.md) `CVE-2026-91913` · CVE record: Dell OpenManage Enterprise · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup](https://agentprime.io/advisories/CVE-2026-118992.md) `CVE-2026-118992` · CVE record · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [Argument injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-111504.md) `CVE-2026-111504` · CVE record: Dell OpenManage Enterprise · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [OS command injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-101210.md) `CVE-2026-101210` · CVE record: Dell OpenManage Enterprise · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [OS command injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-101214.md) `CVE-2026-101214` · CVE record: Dell OpenManage Enterprise · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [OS command injection in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-111505.md) `CVE-2026-111505` · CVE record: Dell OpenManage Enterprise · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [SQLite CLI through 3.54.1 Command Injection via .recover Output](https://agentprime.io/advisories/CVE-2026-119586.md) `CVE-2026-119586` · CVE record: SQLite SQLite · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting](https://agentprime.io/advisories/CVE-2026-119409.md) `CVE-2026-119409` · CVE record: opnsense core · CVSS 8.6 High · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [Dahua Intelligent Connection Center command injection](https://agentprime.io/advisories/CVE-2025-31704.md) `CVE-2025-31704` · CVE record: Dahua Intelligent Connection Center · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220](https://agentprime.io/advisories/CVE-2026-114523.md) `CVE-2026-114523` · CVE record: Drupal Ffmpeg Image Toolkit · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection - [Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path](https://agentprime.io/advisories/CVE-2026-115805.md) `CVE-2026-115805` · CVE record: Rapid7 Insight Agent · CVSS 7.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox](https://agentprime.io/advisories/GHSA-26mh-57q7-jfvr.md) `GHSA-26mh-57q7-jfvr`, `CVE-2026-61438` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 7.0 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection, CWE-184, CWE-693 - [OS Command Injection in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90868.md) `CVE-2026-90868` · CVE record: Progress Software WS_FTP Server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [Command Injection via FTP Notification Variables in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90865.md) `CVE-2026-90865` · CVE record: Progress Software WS_FTP Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104308.md) `CVE-2026-104308` · CVE record: IBM Langflow OSS · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-107326.md) `CVE-2026-107326` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [OS command injection in Yamaha Corporation NWR100](https://agentprime.io/advisories/CVE-2026-97854.md) `CVE-2026-97854` · CVE record: Yamaha Corporation NWR100 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows](https://agentprime.io/advisories/CVE-2026-119025.md) `CVE-2026-119025` · CVE record: sindresorhus open and 2 more · CVSS 7.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [Authenticated RCE in update functionality in Guardian/CMC before 26.4.0](https://agentprime.io/advisories/CVE-2026-33924.md) `CVE-2026-33924` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection - [nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed](https://agentprime.io/advisories/CVE-2026-118905.md) `CVE-2026-118905` · CVE record: nvm-sh nvm · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection, Code injection - [Unrestricted Command Execution via system.execute](https://agentprime.io/advisories/CVE-2026-66088.md) `CVE-2026-66088` · CVE record: Apereo Foundation openEQUELLA · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection, CWE-749 - [systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks](https://agentprime.io/advisories/GHSA-3f7j-7jwc-fxfj.md) `GHSA-3f7j-7jwc-fxfj`, `CVE-2026-116576` · npm `systeminformation`: affected `<5.33.16`, fixed in `5.33.16` · CVSS 7.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [AVideo-Encoder: unauthenticated command execution through streamer login trust](https://agentprime.io/advisories/CVE-2026-61567.md) `CVE-2026-61567` · CVE record: WWBN AVideo-Encoder · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path](https://agentprime.io/advisories/CVE-2026-118755.md) `CVE-2026-118755` · CVE record: Volmarg personal-management-system · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action](https://agentprime.io/advisories/CVE-2026-118692.md) `CVE-2026-118692` · CVE record: giuspen cherrytree · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution](https://agentprime.io/advisories/CVE-2026-78674.md) `CVE-2026-78674` · CVE record: WSO2 Enterprise Integrator (BPS profile) and 1 more · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-118615.md) `CVE-2026-118615` · CVE record: Ultralytics Ultralytics · CVSS 7.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [Alpine iLX-F511 diagapp Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-118607.md) `CVE-2026-118607` · CVE record: Alpine iLX-F511 · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration](https://agentprime.io/advisories/CVE-2026-106079.md) `CVE-2026-106079` · CVE record: Juniper Networks Session Smart Router and 1 more · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.](https://agentprime.io/advisories/CVE-2026-103406.md) `CVE-2026-103406` · CVE record: Juniper Networks Session Smart Conductor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules](https://agentprime.io/advisories/CVE-2026-103403.md) `CVE-2026-103403` · CVE record: Juniper Networks Session Smart Router and 1 more · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution](https://agentprime.io/advisories/CVE-2026-116778.md) `CVE-2026-116778` · CVE record: FOGProject fogproject · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection, Broken access control - [Topluyo Desktop for Linux has an OS Command Injection issue](https://agentprime.io/advisories/CVE-2026-115904.md) `CVE-2026-115904` · CVE record: topluyo App · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67074.md) `CVE-2026-67074` · CVE record: HCL Software BigFix AEX · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection, Code injection - [Unauthenticated Command Injection via kubeconfig Username in che-machine-exec](https://agentprime.io/advisories/CVE-2026-114278.md) `CVE-2026-114278` · CVE record: Eclipse Foundation Eclipse Che · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [KaliFast Project Management Platform ei_git_repo_url OS Command Injection](https://agentprime.io/advisories/CVE-2026-118477.md) `CVE-2026-118477` · CVE record: EISGE Kalifast · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [OS command injection in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-110541.md) `CVE-2026-110541` · CVE record: Dell PowerProtect Data Domain · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection - [OS command injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-86379.md) `CVE-2026-86379` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .