Command injection.

UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd

• seriousm4x UpSnap
• Command injection
• Privilege escalation

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

• MITHALDU PDF::WebKit
• Path traversal
• Command injection

PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document

• MITHALDU PDF::WebKit
• Command injection

UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd

• seriousm4x UpSnap
• Command injection

IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution

• IBM Informix Dynamic Server
• Command injection

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

• IBM i Access Client Solutions
• Command injection

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• Command injection

IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

• i
• Command injection

IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

• i
• Command injection

LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration

• Canonical LXD
• Command injection

IBM i is Affected By Multiple Vulnerabilities in the Debug Server

• i
• Command injection

IBM Db2 Mirror for i is vulnerable to OS command injection []

• IBM Db2 Mirror for i
• Command injection

IBM i is Affected By Multiple Vulnerabilities in Domain Name System

• i
• Command injection

IBM i is Affected By Multiple Vulnerabilities in Domain Name System

• i
• Command injection

IBM i is Affected By Multiple Vulnerabilities in SQL

• i
• Command injection

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

• i
• Command injection

IBM i is Affected By privilege escalation in Navigator for i

• i
• Command injection

Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

• Nagios Enterprises, LLC. Nagios Core
• Nagios Enterprises, LLC. Nagios XI
• Command injection

Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection

• Nagios Enterprises, LLC. Nagios Core
• Nagios Enterprises, LLC. Nagios XI
• Command injection

Apache Allura: Git command injection

• Apache Software Foundation Apache Allura
• Command injection

Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path

• prowler
• Command injection

cloudflare/pages-action is deprecated — migration required by September 18th, 2026

• https://github.com/cloudflare/pages-action
• Command injection
• CWE-1104

Notepad++: Install-time PowerShell command injection through installation path

• notepad-plus-plus
• Command injection

libgit2 Shell Command Injection via ssh_libssh2 Backend

• libgit2
• Command injection

FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection

• FileRun
• Command injection

Electerm check folder size function may get attacked by unsafe folder name

• electerm
• Command injection

GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability

• Microsoft Visual Studio Code
• Command injection

Visual Studio Code Remote Code Execution Vulnerability

• Microsoft Visual Studio Code
• Command injection

Microsoft Office Elevation of Privilege Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Command injection

Microsoft Office Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Command injection

Visual Studio Code Information Disclosure Vulnerability

• Microsoft Visual Studio Code
• Command injection

Azure Monitor Agent Elevation of Privilege Vulnerability

• Microsoft Azure Monitor Agent Linux Extension
• Command injection

Windows Active Directory Domain Services Remote Code Execution Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Command injection

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Command injection

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Command injection

Activepieces: Remote Code Execution via Command Injection in Code Step Name

• activepieces
• Command injection

Google Turbinia arbitrary command execution

• Google Turbinia
• Command injection

Vim: Arbitrary Code Execution via Netrw Menu Construction

• vim
• Command injection
• CWE-184

Vim: Arbitrary Code Execution via Shell Keyword Lookup

• vim
• Command injection

Command injection vulnerability in some NETGEAR Nighthawk devices

• NETGEAR MR60
• NETGEAR MR70
• Command injection

wg-easy wg-easy - OS Command Injection

• wg-easy
• Command injection

ZoneMinder ZoneMinder - Remote Code Execution

• ZoneMinder
• Command injection

Apioo Fusio - Remote Code Execution

• Apioo Fusio
• Command injection

PrefectHQ Prefect - Argument Injection

• Prefect
• Command injection

OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

• SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform
• Command injection

OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

• TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6
• TP-Link Systems Inc. HB810(EU1) V2.0
• Command injection

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

• kovidgoyal kitty
• Command injection
• Other injection

Firecrawl: Arbitrary file read via JSON Schema $ref expansion

• firecrawl
• Command injection
• Code injection

Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById

• dokploy
• Command injection

Dokploy: Remote Code Execution via volume-backup

• dokploy
• Command injection

Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

• dokploy
• Command injection

Dokploy: Command Injection via Compose Custom Command

• dokploy
• Command injection

Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers

• dokploy
• Command injection

Dokploy: Command Injection via database credentials in backup/restore commands

• dokploy
• Command injection

Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

• dokploy
• Command injection

Dokploy: Command Injection via Registry Credentials in Swarm Upload

• dokploy
• Command injection

Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments

• dokploy
• Command injection

Dokploy: Command Injection via dockerImage in buildRemoteDocker

• dokploy
• Command injection

Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

• dokploy
• Command injection
• Broken access control

Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile

• dokploy
• Command injection