CWE-15.

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

• IBM MQ
• CWE-15

Docker Sandboxes host Git executes repository-controlled programs

• Docker Sandboxes
• CWE-15

AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

• AzuraCast
• CWE-15

Inadequate Steps to Confirm Vulnerability in QuRouter

• QNAP Systems Inc. QuRouter
• CWE-15

n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation

• n8n
• CWE-15

Microsoft PowerToys Elevation of Privilege Vulnerability

• Microsoft PowerToys
• CWE-15

Windows Setup Files Cleanup Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-15

Windows Update Stack Tampering Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-15

MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

• MariaDB server
• CWE-15

Origin validation error in Eclipse Ditto Ditto Explorer UI

• Eclipse Ditto Ditto Explorer UI
• Hard-coded credentials
• CWE-15

Brocade Fabric OS: A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI)…

• Brocade Fabric OS
• CWE-15

Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig

• Legcord
• CWE-15

MergeAccount PHP object injection via session-key substitution

• The Wikimedia Foundation MediaWiki CentralAuth extension
• CWE-15

NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI

• netbox-community devicetype-library
• Server-side request forgery (SSRF)
• CWE-15

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands.

• mistralai mistral-vibe
• CWE-15

Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop

• Autodesk Fusion
• CWE-15

Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME

• Google Cloud Gemini CLI
• CWE-15
• CWE-829

OpenAI Codex CLI: OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS…

• OpenAI Codex CLI
• OpenAI Codex Desktop
• CWE-15

OpenAI Codex Desktop: OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and…

• OpenAI Codex Desktop
• OpenAI Codex Desktop (Microsoft Store package)
• CWE-15

IBM Db2 Mirror for i is affected by multiple vulnerabilities

• IBM Db2 Mirror for i
• CWE-15

Eclipse Foundation Eclipse Theia: In Eclipse Theia versions up to and including 1.69.0…

• Eclipse Foundation Eclipse Theia
• CWE-15
• CWE-829

FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

• FreePBX framework
• CWE-15

HCL iControl is affected by multiple security vulnerabilities.

• HCL Software HCL iControl
• CWE-15

Dash: Users can write to config despire permissions (OIDC tested)

• lissy93 dashy
• Broken access control
• Authentication bypass

Security misconfiguration in SAP CRM (WebClient UI)

• SAP_SE SAP CRM (WebClient UI)
• CWE-15

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

• Code injection
• CWE-15

<0.42.1 · fixed in 0.42.1

Certain NETGEAR devices allow administrators to tamper with system

• NETGEAR CBR750
• NETGEAR EX6120
• CWE-15

Authenticated Remote Code Execution via File Overwrite

• haxtheweb haxcms-nodejs
• haxtheweb haxcms-php
• Path traversal
• Command injection

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.13
• CWE-15

Dräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network Packet

• Dräger Infinity Delta
• Dräger Infinity Delta XL
• CWE-15

Apache CXF: Untrusted JMS configuration can lead to RCE

• CWE-15
• CWE-20

>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11 · fixed in 4.2.1, 4.1.6, 3.6.11

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

• Broken access control
• CWE-15

<=1.7.34 · no fixed version yet

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

• Command injection
• Authentication bypass

<2.13.0 · fixed in 2.13.0

Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks

• pi-hole
• Privilege escalation
• Broken access control

OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

• Hard-coded credentials
• CWE-15

>=2026.4.5, <2026.4.20 · fixed in 2026.4.20

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

• Authentication bypass
• CWE-15

>=1.45.0, <1.73.5 · fixed in 1.73.5

OpenClaw: Workspace .env could inject OpenClaw runtime-control variables

• CWE-15

<2026.4.9 · fixed in 2026.4.9

Cortex XDR Agent: Local Administrator can disable the agent on Windows

• Palo Alto Networks Cortex XDR Agent
• CWE-15

Local privilege escalation due to improper handling of environment variables.

• Acronis True Image OEM
• Acronis True Image
• CWE-15

Spring Cloud Gateway's SSL bundle configuration silently bypassed

• CWE-15

>=4.2.0, <4.2.1 · fixed in 4.2.1

Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53

• TP-Link Systems Inc. AX53 v1.0
• CWE-15

Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53

• TP-Link Systems Inc. AX53 v1.0
• CWE-15

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

• CWE-15
• CWE-426

<2026.3.24 · fixed in 2026.3.24

OpenClaw: Workspace `.env` can override the bundled plugin trust root

• CWE-15
• CWE-829

<2026.3.31 · fixed in 2026.3.31

OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

• CWE-15
• CWE-829

<2026.3.31 · fixed in 2026.3.31

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

• CWE-15
• CWE-426

<2026.3.28 · fixed in 2026.3.28

OpenClaw has Inconsistent Host Exec Environment Override Sanitization

• CWE-15
• CWE-693

<2026.3.22 · fixed in 2026.3.22

OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

• Broken access control
• CWE-15

<2026.3.7 · fixed in 2026.3.7

Dell PowerScale OneFS: Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0…

• Dell PowerScale OneFS
• CWE-15

OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)

• Command injection
• CWE-15

<2026.2.22 · fixed in 2026.2.22

OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

• Command injection
• CWE-15

<2026.2.21 · fixed in 2026.2.21

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

• Command injection
• CWE-15

<2026.2.22 · fixed in 2026.2.22

OpenClaw's config env vars allowed startup env injection into service runtime

• CWE-15

<2026.2.21 · fixed in 2026.2.21

OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints

• Command injection
• CWE-15

<2026.2.22 · fixed in 2026.2.22

OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)

• Command injection
• CWE-15

<2026.2.22 · fixed in 2026.2.22

OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows

• Broken access control
• CWE-15

<2026.2.26 · fixed in 2026.2.26

OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

• Other injection
• Code injection

<2026.2.21 · fixed in 2026.2.21

eBay API MCP Server Affected by Environment Variable Injection

• Other injection
• CWE-15

<=1.7.2 · no fixed version yet

Shopire <= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install

• wpfable Shopire
• CWE-15

Cursor has a Terminal Tool Allowlist Bypass via Environment Variables

• cursor
• Other injection
• Command injection