Total
6740 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75363 | 1 Comfast | 1 Cf-wr630ax | 2026-09-01 | 6.8 Medium |
| An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n. | ||||
| CVE-2026-37751 | 1 23blocks-os | 1 Ai-maestro | 2026-09-01 | 9.8 Critical |
| An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input. | ||||
| CVE-2026-33606 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 4.8 Medium |
| Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-59680 | 1 Suse | 1 Yast2-users | 2026-09-01 | 8 High |
| An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping. Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry. This issue affects yast2-users through 5.0.8. | ||||
| CVE-2026-59681 | 1 Suse | 1 Yast2-auth-client | 2026-09-01 | 8.8 High |
| A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted. | ||||
| CVE-2026-25706 | 1 Suse | 1 Yast2-samba-client | 2026-09-01 | 7.5 High |
| Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain. This issue affects yast2-samba-client through 5.0.4. | ||||
| CVE-2026-44604 | 1 Redhat | 7 Enterprise Linux, Hardened Images, Hummingbird and 4 more | 2026-09-01 | 7 High |
| A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction. | ||||
| CVE-2026-55378 | 1 Shriyanss | 1 Js-recon | 2026-09-01 | N/A |
| JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github.head_ref and github.event.pull_request.head.repo.full_name into BRANCH_NAME and SOURCE_REPO and interpolates those untrusted values into a shell gh pr comment command. A remote user who opens a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2. | ||||
| CVE-2026-75364 | 2026-08-31 | 6.8 Medium | ||
| Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands | ||||
| CVE-2026-82703 | 1 Edimax | 1 Br-6214k | 2026-08-31 | 6.6 Medium |
| A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82668 | 2 Gitlist, Klaussilveira | 2 Gitlist, Gitlist | 2026-08-31 | 7.3 High |
| A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised. | ||||
| CVE-2026-19702 | 1 Tubitak Bilgem Software Technologies Research Institute | 1 Pardus Boot Repair | 2026-08-31 | 7.8 High |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8. | ||||
| CVE-2026-59111 | 1 Digitální A Informační Agentura (dia) | 1 Eobčanka-identifikace | 2026-08-31 | 9.3 Critical |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization. | ||||
| CVE-2026-75486 | 1 Snyk | 1 Sweater-comb | 2026-08-31 | 8 High |
| Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository. | ||||
| CVE-2026-10805 | 1 Redhat | 13 Enterprise Linux, Jboss Enterprise Application Platform Expansion Pack, Jbosseapxp and 10 more | 2026-08-31 | 6.7 Medium |
| A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager. | ||||
| CVE-2026-55673 | 1 Powsybl | 1 Powsybl-core | 2026-08-31 | N/A |
| PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching UnixLocalCommandExecutor.execute, WindowsLocalCommandExecutor.execute, LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync can break out of the intended command and execute arbitrary shell commands as the JVM user. The affected itools paths include action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward less-trusted contingency identifiers or computation parameters into these APIs can expose the injection remotely. This issue is fixed in version 7.2.2. | ||||
| CVE-2026-82636 | 1 Qubes Os | 1 Qubes Os | 2026-08-31 | 7.9 High |
| Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c. | ||||
| CVE-2026-82689 | 1 D-link | 4 Dns-320l, Dns-327l, Dns-340l and 1 more | 2026-08-31 | 9.9 Critical |
| A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. | ||||
| CVE-2026-82702 | 1 Edimax | 1 Br-6214k | 2026-08-31 | 6.6 Medium |
| A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82692 | 1 D-link | 2 Dns-340l, Dns-345 | 2026-08-31 | 9.9 Critical |
| A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. | ||||