Advisories · Weakness

Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-7608 CVE record

CVSS 5.1 Medium

TRENDnet TEW-821DAP tools_diagnostic os command injection
- TRENDnet TEW-821DAP
- Command injection
Not analysed yet 2 May 2026
yii2-mcp-server npm

CVSS 5.3 Medium

yii2-mcp-server has a Command Injection Issue
- Command injection
<=1.0.2 · no fixed version yet

GHSA-gc8w-x73w-p4rh · CVE-2026-7600 Not analysed yet 2 May 2026
CVE-2026-7593 CVE record

CVSS 6.9 Medium

Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection
- Sunwood-ai-labs command-executor-mcp-server
- Command injection
Not analysed yet 1 May 2026
CVE-2026-7590 CVE record

CVSS 6.9 Medium

eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection
- eyal-gor p_69_branch_monkey_mcp
- Command injection
Not analysed yet 1 May 2026
ironic-python-agent PyPI

CVSS 8.0 High

OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
- Command injection
- CWE-829
>=1.0.0, <11.6.0 · fixed in 11.6.0

GHSA-rmxr-45gj-889w · CVE-2026-43003 Not analysed yet 1 May 2026
CVE-2026-42994 CVE record

CVSS 8.8 High

OS command injection in Bitwarden CLI
- Bitwarden CLI
- Command injection
Not analysed yet 1 May 2026
CVE-2026-7548 CVE record

CVSS 8.7 High

Totolink NR1800X cstecgi.cgi sub_41A68C command injection
- Totolink NR1800X
- Other injection
- Command injection
Not analysed yet 1 May 2026
CVE-2026-7538 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 1 May 2026
CVE-2026-26461 CVE record

CVSS 6.5 Medium

A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request.
- Command injection
Not analysed yet 1 May 2026
CVE-2026-7551 CVE record

CVSS 8.7 High

HKUDS OpenHarness Remote Command Execution via /bridge Slash Command
- HKUDS OpenHarness
- Command injection
Not analysed yet 30 Apr 2026
github.com/gotenberg/gotenberg/v8 Go

CVSS 10.0 CriticalCritical · CVSS 9+

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)
- Command injection
<8.31.0 · fixed in 8.31.0

GHSA-q7r4-hc83-hf2q · CVE-2026-40281 Not analysed yet 30 Apr 2026
CVE-2025-71284 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Synway SMG Gateway Management Software OS Command Injection via radius_address
- Synway Information Engineering Co., Ltd. Synway SMG Gateway Management Software
- Command injection
Not analysed yet 30 Apr 2026
click PyPI

CVSS 7.2 High

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Command injection
<8.3.3 · fixed in 8.3.3

GHSA-47fr-3ffg-hgmw · CVE-2026-7246 Withdrawn Not analysed yet 30 Apr 2026
CVE-2026-7469 CVE record

CVSS 5.3 Medium

Tenda 4G300 DelFil sub_425A28 command injection
- Tenda 4G300
- Other injection
- Command injection
Not analysed yet 30 Apr 2026
mcp-server-semgrep npm

CVSS 6.9 Medium

mcp-server-semgrep has a Command Injection issue
- Command injection
<1.0.1 · fixed in 1.0.1

GHSA-86hp-qxqp-w9wv · CVE-2026-7446 Not analysed yet 30 Apr 2026
CVE-2026-7443 CVE record

CVSS 6.9 Medium

BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection
- BurtTheCoder mcp-dnstwist
- Command injection
Not analysed yet 29 Apr 2026
CVE-2026-7416 CVE record

CVSS 6.9 Medium

PolarVista xcode-mcp-server MCP index.ts run_tests os command injection
- PolarVista xcode-mcp-server
- Command injection
Not analysed yet 29 Apr 2026
CVE-2026-26015 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Unauthenticated RCE in DocsGPT MCP STDIO Configuration
- arc53 DocsGPT
- Command injection
Not analysed yet 29 Apr 2026
CVE-2026-6849 CVE record

CVSS 8.8 High

OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer
- TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer
- Command injection
Not analysed yet 29 Apr 2026
CVE-2026-36841 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function.
- Command injection
Not analysed yet 29 Apr 2026
CVE-2026-7316 CVE record

CVSS 6.9 Medium

eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection
- eiliyaabedini aider-mcp
- Other injection
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7244 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7243 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7242 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7241 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7240 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 28 Apr 2026
CVE-2024-54012 CVE record

CVSS 8.5 High

Command Injection
- Hanwha Vision QND-8080R
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7220 CVE record

CVSS 6.9 Medium

jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection
- jackwrichards FastlyMCP
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-1460 CVE record

CVSS 7.2 High

OS command injection in Zyxel DX3301-T0 firmware and others
- Zyxel DX3301-T0 firmware
- Zyxel EX3301-T0 firmware
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7215 CVE record

CVSS 6.9 Medium

egtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection
- egtai gmx-vmd-mcp
- Other injection
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-0711 CVE record

CVSS 6.8 Medium

OS command injection in Zyxel DX3300-T0 firmware
- Zyxel DX3300-T0 firmware
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7211 CVE record

CVSS 6.9 Medium

dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection
- dvladimirov MCP
- Other injection
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7204 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7203 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 28 Apr 2026
CVE-2026-7202 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-32649 CVE record

CVSS 7.3 High

Milesight Cameras OS Command Injection
- Milesight MS-Cxx63-PD
- Milesight MS-Cxx64-xPD
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7160 CVE record

CVSS 8.7 High

Tenda HG3 formTracert command injection
- Tenda HG3
- Other injection
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7157 CVE record

CVSS 6.9 Medium

disler aider-mcp-server aider_ai_code server.py command injection
- disler aider-mcp-server
- Other injection
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7156 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7155 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7154 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7153 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7152 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7140 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7139 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7138 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7137 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7136 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7125 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7124 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7123 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7122 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7121 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection
- Totolink A8000RU
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7119 CVE record

CVSS 8.7 High

Tenda HG3 formCountrystr os command injection
- Tenda HG3
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7102 CVE record

CVSS 5.3 Medium

Tenda F456 httpd WriteFacMac FromWriteFacMac command injection
- Tenda F456
- Other injection
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7096 CVE record

CVSS 8.7 High

Tenda HG3 formgponConf os command injection
- Tenda HG3
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-33277 CVE record

CVSS 8.7 High

OS command injection in Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)…
- Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) LogonTracer
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-31255 CVE record

CVSS 5.4 Medium

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi.
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-30352 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.
- Command injection
Not analysed yet 27 Apr 2026
CVE-2026-7067 CVE record

CVSS 6.9 Medium

D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection
- D-Link DIR-822
- Other injection
- Command injection
Not analysed yet 26 Apr 2026