Advisories · Weakness
Command injection.
Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.8 High
Argument injection in David-Crty databasement
- David-Crty databasement
- Command injection
- CVSS 7.3 High
pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync
- MinaSaad1 pbi-cli
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
TOZED X300 IPPingDiagnostics process_ping os command injection
- TOZED X300
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
OpenSpug File Transfer transfer os command injection
- Spug
- Command injection
- CVSS 7.7 High
Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
- spotweb
- Command injection
- CVSS 7.7 High
FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
- fusionpbx
- Command injection
- CVSS 8.4 High
ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export
- CellHubs ExifTool for photo and video
- Command injection
- CVSS 8.8 High
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
- Command injection
>=2.11.0, <=2.14.21 · no fixed version yet
GHSA-j6cw-g6p4-7hch · CVE-2026-55797 - CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade file
- Command injection
- CVSS 7.1 High
SumatraPDF — Windows command-line argument injection in AI selection-translate
- sumatrapdf
- Command injection
- CVSS 7.1 High
SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors
- sumatrapdf
- Command injection
- CWE-20
- CVSS 8.7 High
PraisonAI: Shell command allowlist bypass via find -exec built-in action
- Command injection
- CWE-693
<4.6.78 · fixed in 4.6.78
GHSA-cv3g-hj65-pcfh · CVE-2026-61434 - CVSS 9.4 CriticalCritical · CVSS 9+
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
- Path traversal
- Command injection
<4.6.78 · fixed in 4.6.78
GHSA-9mp3-24cc-77mg · CVE-2026-61445 - CVSS 8.1 High
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Command injection
- CVSS 2.7 Low
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Command injection
- CVSS 8.8 High
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Command injection
- CVSS 8.8 High
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
- dromara skyeye
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Command Injection
- Tenable, Inc. Tenable Identity Exposure (SaaS)
- Command injection
- CVSS 7.2 High
IBM Guardium Data Protection Command Injection
- IBM Guardium Data Protection
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
- jtescher image_optimizer
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
- @enmaso/node-convert
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
ppt2png through 0.0.6 OS Command Injection via input and output paths
- tzwm ppt2png
- Command injection
- CVSS 8.7 High
OS command injection in OpenStack Mistral
- OpenStack Mistral
- Command injection
- CVSS 8.6 High
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
- Path traversal
- Command injection
<1.6.78 · fixed in 1.6.78
GHSA-c44f-37qr-gw3f · CVE-2026-61443 - CVSS 8.7 High
ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
- ILIAS
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Authenticated argument injection in NIOS command line leading to privilege escalation
- Infoblox NIOS
- Command injection
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
- Iskratel Innbox
- Command injection
- Authentication bypass
- CVSS 8.5 High
Argument injection in WebPros WP Toolkit
- WebPros WP Toolkit
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Openfind｜SecuShare Pro - OS Command Injection
- Openfind SecuShare Pro
- Command injection
- CVSS 5.4 Medium
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 5.4 Medium
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.5 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.5 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 7.0 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.4 High
Argument injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.6 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 7.3 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.5 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 7.0 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.5 High
Argument injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.5 High
Command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.6 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 8.5 High
OS command injection in Brocade Fabric OS
- Brocade Fabric OS
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
- Command injection
>=1.1.2, <1.10.3 · fixed in 1.10.3
GHSA-w794-rj3p-xv45 · CVE-2026-105697 - CVSS 9.4 CriticalCritical · CVSS 9+
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
- Command injection
- CWE-749
<3.1.3 · fixed in 3.1.3
GHSA-9gvv-qjj3-2p6g · CVE-2026-119978 - CVSS 4.9 Medium
Cisco Smart Software Manager On-Prem Command Injection Vulnerability
- Cisco License On-Prem
- Command injection
- CVSS 7.7 High
Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
- backstage
- @backstage plugin-techdocs-node
- Command injection
- CWE-184
- CVSS 9.1 CriticalCritical · CVSS 9+
CVE-2026-107202
- jonssonyan h-ui
- Command injection
- CVSS 7.8 High
OS command injection in SonicWall SMA1000
- SonicWall SMA1000
- Command injection
- CVSS 8.7 High
GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript
- gitahead
- Command injection
- CVSS 7.7 High
GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames
- gitahead
- Command injection
- CVSS 8.5 High
patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt
- wummel patool
- Command injection
- CVSS 7.7 High
Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
- rundeck
- Command injection
- CVSS 7.5 High
Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET
- BugTracker.NET
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.
- Command injection
- CVSS 8.6 High
Security Advisory 0190
- Arista Networks CloudVision CUE
- Command injection
- CVSS 6.5 Medium
Authenticated Command Injection Vulnerability in the ClearPass Policy Manager OnGuard Agent
- Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
- Command injection
- CVSS 8.8 High
Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manager API
- Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
- Command injection