Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-12398
Alta · 7.5
CWE-78 16/06/2026
Galaxy_ng: shell injection in legacy role import via unsanitized git ref names
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
CVE-2026-5416
Alta · 8.8
CWE-78 16/06/2026
Command Injection via name parameter
Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.
CVE-2026-12161
Alta · 8.8
CWE-78 15/06/2026
OS Command Injection em Devolutions Remote Desktop Manager
Improper input validation in the SSH Elevate Shell feature allows an authenticated user
with permission to create or modify a shared SSH entry to execute
arbitrary commands on a remote SSH host using stored elevation
credentials via a crafted alternate username and user interaction with
the Elevate Shell action.
This affects :
- Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0
- Remote Desktop Manager 2026.1.23.0 and earlier
CVE-2026-48723
Alta · 7.8
CWE-78 15/06/2026
BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json
The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, then executes it via child_process.execSync(). Shell metacharacters in the config path (specifically " and ;) allow breaking out of the quoted argument and injecting arbitrary commands. This issue has been fixed in version 1.36.6.
CVE-2026-50874
Alta · 8.1
CWE-78 15/06/2026
An OS command injection vulnerability in the /manage/features/media component of…
An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.
CVE-2026-38065
Crítica · 9.8
CWE-78 15/06/2026
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.
CVE-2026-38064
Crítica · 9.8
CWE-78 15/06/2026
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.
CVE-2026-38063
Crítica · 9.8
CWE-78 15/06/2026
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.
CVE-2026-38062
Crítica · 9.8
CWE-78 15/06/2026
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.
CVE-2026-38061
Crítica · 9.8
CWE-78 15/06/2026
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
CVE-2026-38060
Crítica · 9.8
CWE-78 15/06/2026
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.
CVE-2026-9863
Alta · 8.8
CWE-78 15/06/2026
Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
CVE-2026-9862
Crítica · 9.8
CWE-78 15/06/2026
Injeção de comando de SO no serviço de autorregistro do Core Privileged Access Manager (BoKS)
O Core Privileged Access Manager (BoKS), da Fortra, contém uma vulnerabilidade de injeção de comando do sistema operacional no serviço boks_autoregisterd. Um atacante remoto com acesso de rede ao serviço pode, possivelmente, causar a execução de comandos com os privilégios do serviço durante o processamento de autorregistro.
CVE-2026-46716
Crítica · 9.9
CWE-78 12/06/2026
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.
CVE-2026-42853
Média · 6.5
CWE-78 12/06/2026
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.
CVE-2026-48165
Alta · 7.2
CWE-78 12/06/2026
MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
CVE-2026-48163
Alta · 7.2
CWE-78 12/06/2026
MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
CVE-2026-44170
Crítica · 9.8
CWE-78 12/06/2026
MariaDB: injeção de argumento no REST xcurl do CONNECT no Windows
O MariaDB server é um fork do MySQL server desenvolvido pela comunidade. Das versões 10.6.1 até antes da 10.6.26, 10.11.1 até antes da 10.11.17, 11.4.1 até antes da 11.4.11, 11.8.1 até antes da 11.8.7, e 12.3.1, o MariaDB no Windows com o mecanismo CONNECT instalado e suporte REST habilitado interpolou o atributo HTTP da tabela na linha de comando do curl sem sanitização adequada. Isso permite que o usuário execute comandos de shell no servidor. Este problema foi corrigido nas versões 10.6.26, 10.11.17, 11.4.11, 11.8.7 e 12.3.2.
CVE-2026-44168
Alta · 8.0
CWE-78 12/06/2026
MariaDB: wsrep SST unsafe parameter handling on the donor side
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-11845
Alta · 7.2
CWE-78 12/06/2026
IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection
The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged remote attackers to inject arbitrary OS commands and execute them on the device.
CVE-2026-42846
Crítica · 9.8
CWE-78 11/06/2026
ClipBucket: Injeção de Comando via URL no Remote Play
ClipBucket v5 é uma plataforma de compartilhamento de vídeos de código aberto. Antes da versão 5.5.3 - #140, o recurso Remote Play do ClipBucket permite que qualquer usuário autenticado adicione um vídeo importando uma URL externa como origem. Alguns comandos de shell são executados tendo a URL como parâmetro. A URL é concatenada diretamente nos comandos de shell sem escape e depois executada, de modo que qualquer metacaractere de shell presente na URL é interpretado. Isso resulta em execução arbitrária de comandos. Este problema foi corrigido na versão 5.5.3 - #140.
CVE-2026-45172
Alta · 8.8
CWE-78 11/06/2026
Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command
Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18
CVE-2026-48547
Alta · 7.3
CWE-78 11/06/2026
KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.
CVE-2026-49261
Crítica · 9.8
CWE-78 11/06/2026
Injeção de comando de SO no MariaDB Server via nome de nó joiner em wsrep_notify_cmd
O servidor MariaDB é um fork de código aberto, desenvolvido pela comunidade, do servidor MySQL. As versões de 10.6.1 até 10.6.26, de 10.11.1 até 10.11.17, de 11.4.1 até 11.4.11, de 11.8.1 até 11.8.7 e a 12.3.1, com wsrep_notify_cmd habilitado, executariam comandos de shell incorporados no nome do nó joiner. Isso está corrigido nas versões 10.6.27, 10.11.18, 11.4.12, 11.8.8 e 12.3.2. Como solução provisória, quem não puder atualizar agora deve desativar wsrep_notify_cmd.
CVE-2026-42563
Alta · 7.7
CWE-78 10/06/2026
Dulwich Vulnerable to Command Injection via Merge Driver Path
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. Version 1.2.5 fixes the issue.