Advisories · Weakness
Command injection.
Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.7 Medium
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 6.7 Medium
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 7.2 High
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 7.2 High
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 7.2 High
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 8.4 High
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- Progress Software LoadMaster
- Progress Software ECS Connections Manager
- Command injection
- CVSS 8.4 High
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- Progress Software LoadMaster
- Progress Software ECS Connections Manager
- Command injection
- CVSS 8.4 HighCritical · CVSS 7+ and EPSS
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- Progress Software LoadMaster
- Progress Software ECS Connections Manager
- Command injection
- CVSS 8.4 HighCritical · CVSS 7+ and EPSS
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- Progress Software LoadMaster
- Progress Software ECS Connections Manager
- Command injection
- CVSS 8.7 High
TeamT5｜ThreatSonar Anti-Ransomware - Privilege Escalation
- TeamT5 ThreatSonar Anti-Ransomware
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
A command injection vulnerability was found in the PPTP VPN Clients on the ADM
- ASUSTOR Inc. ADM
- Command injection
- CVSS 5.3 Medium
liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection
- liangliangyy DjangoBlog
- Other injection
- Command injection
- CVSS 8.8 High
Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
- Apache Software Foundation Apache Airflow
- Command injection
- CVSS 6.9 Medium
Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields
- Command injection
<1.7.8-0.20260416142831-51806c22c575 · fixed in 1.7.8-0.20260416142831-51806c22c575
GHSA-mph4-q2vm-w2pw · CVE-2026-6437 - CVSS 7.8 High
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
- Command injection
- Other injection
>=12.5.21, <12.5.22 || >=13.1.5, <13.1.6 · fixed in 12.5.22, 13.1.6
GHSA-qrr6-mg7r-m243 · CVE-2026-41570 - CVSS 9.2 CriticalCritical · CVSS 9+
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
- Command injection
- CWE-184
<3.1.0 · fixed in 3.1.0
GHSA-v38x-c887-992f · CVE-2026-41265 - CVSS 8.9 High
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
- Command injection
<2.1.67 · fixed in 2.1.67
GHSA-8q4h-8crm-5cvc · CVE-2026-41247 - CVSS 8.7 High
OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms
- Command injection
- CWE-184
>=2026.2.22, <2026.4.12 · fixed in 2026.4.12
GHSA-j6c7-3h5x-99g9 · CVE-2026-42435 - CVSS 9.4 CriticalCritical · CVSS 9+
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
- Command injection
<=22.0.4 · no fixed version yet
GHSA-w5j3-8fcr-h87w · CVE-2026-23500 - CVSS 8.5 High
radare2 Command Injection via DWARF Parameter Names
- radareorg radare2
- Command injection
- CVSS 6.3 Medium
xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman
- neutrinolabs xrdp
- Command injection
- CVSS 8.8 High
Anviz CX2 Lite Command Injection
- Anviz CX2 Lite Firmware
- Command injection
- CVSS 6.7 Medium
Command injection in Veeam Backup and Replication and others
- Veeam Backup and Replication
- Veeam Software Appliance
- Command injection
- CVSS 5.8 Medium
Command injection in JetBrains Junie
- JetBrains Junie
- Command injection
- CVSS 6.7 Medium
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 6.7 Medium
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 6.7 Medium
OS command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 6.7 Medium
Argument injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Wavlink WL-WN530H4 internet.cgi snprintf os command injection
- Wavlink WL-WN530H4
- Command injection
- CVSS 6.7 Medium
Command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 7.2 High
Command injection in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Command injection
- CVSS 8.6 High
OS command injection in CubeCart
- CubeCart
- Command injection
- CVSS 8.7 High
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
- Command injection
<2026.416.0 · fixed in 2026.416.0
GHSA-vr7g-88fq-vhq3 · CVE-2026-119713 - CVSS 7.3 High
Paperclip: Malicious skills able to exfiltrate and destroy all user data
- Command injection
<2026.416.0 · fixed in 2026.416.0
GHSA-w8hx-hqjv-vjcq - CVSS 8.8 High
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
- Command injection
<2026.416.0 · fixed in 2026.416.0
GHSA-265w-rf2w-cjh4 · CVE-2026-41208 - CVSS 8.1 High
OS command injection in sagredo qmail
- sagredo qmail
- Command injection
- CVSS 8.9 High
WWBN AVideo: RCE cause by clonesite plugin
- Command injection
<=29.0 · no fixed version yet
GHSA-xr6f-h4x7-r6qp · CVE-2026-41304 - CVSS 9.8 CriticalCritical · CVSS 9+
electerm: electerm_install_script_CommandInjection Vulnerability Report
- Command injection
<3.3.8 · fixed in 3.3.8
GHSA-wxw2-rwmh-vr8f · CVE-2026-41500 - CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Flowise: Authenticated RCE Via MCP Adapters
- Command injection
<3.1.0 · fixed in 3.1.0
GHSA-c9gw-hvqq-f33r · CVE-2026-40933 - CVSS 7.4 High
OS command injection in radare2
- radare2
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
HGiga｜iSherlock - OS Command Injection
- HGiga iSherlock-base-4.5
- HGiga iSherlock-audit-4.5
- Command injection
- CVSS 6.8 Medium
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
- Command injection
- Code injection
>=43.65.0, <43.102.11 · fixed in 43.102.11
GHSA-5vjq-5jmg-39xq · CVE-2026-76226 - CVSS 9.9 CriticalCritical · CVSS 9+
Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability
- Cisco Identity Services Engine Software
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Cisco Identity Services Engine Remote Code Execution Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- Command injection
- CVSS 8.4 High
NietThijmen ShoppingCart: Command injection in the connect function
- Command injection
<=0.0.0-20241101155353-3dd137080276 · no fixed version yet
GHSA-ggmw-mjhv-75rm · CVE-2024-53412 - CVSS 8.5 High
Argument injection in Lenovo Software Fix
- Lenovo Software Fix
- Command injection
- CVSS 8.4 High
radare2 < 6.1.4 Command Injection via PDB Parser print_gvars()
- radareorg radare2
- Command injection
- CVSS 8.6 High
Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature.
- Command injection
- CVSS 8.6 High
LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling.
- Command injection
- CVSS 7.3 High
Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling.
- Command injection
- CVSS 8.0 High
A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system.
- Command injection
- CVSS 8.3 High
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
- Command injection
<=29.0 · no fixed version yet
GHSA-pq8p-wc4f-vg7j · CVE-2026-41064 - CVSS 8.3 High
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
- Command injection
<3.5.0 · fixed in 3.5.0
GHSA-4xqg-gf5c-ghwq · CVE-2026-39884 - CVSS 4.0 Medium
PowerShell Command Injection in Podman HyperV Machine
- Command injection
- Code injection
>=4.8.0, <=4.9.5 · no fixed version yet
GHSA-hc8w-h2mf-hp59 · CVE-2026-33414 - CVSS 9.3 CriticalCritical · CVSS 9+
Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
- jellyfin
- Command injection
- Broken access control
- CVSS 8.8 High
Chamilo LMS has OS Command Injection via export_all_certificates action
- chamilo-lms
- Command injection
- CVSS 8.8 High
openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion
- openITCOCKPIT
- Command injection
- CWE-20
- CVSS 7.8 High
Composer has a command injection via malicious perforce repository
- Command injection
- CWE-20
>=1.0.0, <2.2.27 || >=2.3.0, <2.9.6 · fixed in 2.2.27, 2.9.6
GHSA-wg36-wvj6-r67p · CVE-2026-40176 - CVSS 8.8 High
Composer has a command injection via malicious perforce reference
- Command injection
- CWE-20
>=1.0.0, <2.2.27 || >=2.3.0, <2.9.6 · fixed in 2.2.27, 2.9.6
GHSA-gqw4-4w2p-838q · CVE-2026-40261