Command injection.

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

• Command injection
• Information disclosure

>=0.8.41, <0.8.64 · fixed in 0.8.64

CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

• Path traversal
• Command injection

>=0.8.41, <0.8.64 · fixed in 0.8.64

OS command injection in Amazon log4j-cve-2021-44228-hotpatch

• Amazon log4j-cve-2021-44228-hotpatch
• Command injection

IBM i is Affected By Multiple Vulnerabilities in Debug Server

• i
• Command injection

IBM i is Affected By Multiple Vulnerabilities in Debug Server

• i
• Command injection

IBM i is Affected By Multiple Vulnerabilities in Debug Server

• i
• Command injection

SadTalker OS Command Injection via Audio Filename

• OpenTalker SadTalker
• Command injection

zerox 1.1.20 OS Command Injection via Document URL File Extension

• getomni-ai zerox
• Command injection

cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

• MladenSU cli-mcp-server
• Command injection

git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

• cyanheads git-mcp-server
• Command injection

GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client

• GFI Software GFI Exinda AI
• GFI Software GFI ClearView
• Command injection

OS command injection in Xing Inc. XING CPTrans-ME-X

• Xing Inc. XING CPTrans-ME-X
• Command injection

An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request.

• Command injection

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to inject arbitra…

• Command injection

MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

• moos-ivp
• Command injection

MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names

• moos-ivp
• Command injection

MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS

• moos-ivp
• Command injection

D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

• D-Link DNS-320 ShareCenter
• Command injection

D-Link DNS-340L CGI dropbox.cgi os command injection

• D-Link DNS-340L
• Command injection

D-Link DNS-340L Add-On Center addon_center.cgi os command injection

• D-Link DNS-340L
• Command injection

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

• Command injection
• Authentication bypass

<1.29.4 · fixed in 1.29.4

OS command injection in the Amazon CodeCatalyst blueprints SDK

• AWS @amazon-codecatalyst/blueprints.blueprint
• Command injection

Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection

• NousResearch hermes-agent
• Command injection

Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

• MongoDB for VS Code
• Command injection

Command injection in Dell SmartFabric OS10

• Dell SmartFabric OS10
• Command injection

OS command injection in Dell SmartFabric OS10 Software

• Dell SmartFabric OS10 Software
• Command injection

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

• WSO2 Open Banking AM
• WSO2 Open Banking IAM
• Command injection

n8n before 1.123.73 Remote Code Execution via Git Node

• n8n
• Command injection

OS command injection in privileged configuration handling

• SEPPmail AG Secure Email Gateway
• Command injection
• Privilege escalation

Unsafe deserialization in the REST interface

• SEPPmail AG SEPPmail Secure Email Gateway (SEG)
• Command injection
• Insecure deserialization

ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

• ZhongBangKeJi CRMEB
• Command injection

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

• Command injection

<1.0.4 || >=1.1.0, <1.1.4 || >=1.2.0-rc.1, <1.2.0-rc.2 · fixed in 1.0.4, 1.1.4, 1.2.0-rc.2

Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

• nuclio
• Command injection

Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

• nuclio
• Command injection

Nuclio: Kaniko build tempDir command injection

• nuclio
• Command injection

Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

• AS203038 looking-glass
• Command injection

OS command injection in Jenkins Project Jenkins TICS Plugin

• Jenkins Project Jenkins TICS Plugin
• Command injection

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

• coollabsio coolify
• Command injection

OS command injection in Westermo WeOS

• Westermo WeOS
• Command injection

OS command injection in SonicWall SMA1000

• SonicWall SMA1000
• Command injection

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

• Command injection

<3.10.3 · fixed in 3.10.3

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

• Hewlett Packard Enterprise (HPE) AOS-CX
• Command injection

Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Command injection

Unauthenticated Remote Command Execution in Management Component

• Hewlett Packard Enterprise (HPE) AOS-CX
• Command injection

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

• Hewlett Packard Enterprise (HPE) AOS-CX
• Command injection

Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

• Hewlett Packard Enterprise (HPE) AOS-CX
• Command injection

Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Command injection

Unauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Command injection

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Command injection

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer API

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Command injection

Unauthenticated Remote Code Execution during HPE Networking Fabric Composer Installation Process

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Command injection

Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Command injection

OS command injection in Dell PowerStore 500T and others

• Dell PowerStore 500T
• Dell PowerStore 1000T
• Command injection

FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

• fs-code FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
• Command injection

Command injection in Dell PowerStore 500T and others

• Dell PowerStore 500T
• Dell PowerStore 1000T
• Command injection

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Argument injection in Dell PowerStore 500T and others

• Dell PowerStore 500T
• Dell PowerStore 1000T
• Command injection

OS command injection in Dell PowerStore 500T and others

• Dell PowerStore 500T
• Dell PowerStore 1000T
• Command injection