Base de CVEs

CVE-2026-3227 Média · 6.8 CWE-78 16/03/2026

Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

CVE-2026-31386 Alta · 7.2 CWE-78 16/03/2026

OS Command Injection em Litespeedtech Litespeed Web Server

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

CVE-2025-15060 Crítica · 9.8 CWE-78 16/03/2026

claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability

claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of claude-hovercraft. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the executeClaudeCode method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27785.

CVE-2026-32260 Crítica · 9.8 CWE-78 12/03/2026

Injeção de comando no node:child_process do Deno via lista incompleta de metacaracteres de shell

O Deno é um runtime de JavaScript, TypeScript e WebAssembly. De 2.7.0 a 2.7.1, existe uma vulnerabilidade de injeção de comando no polyfill node:child_process do Deno (modo shell: true) que contorna a correção do CVE-2026-27190. A sanitização de argumentos em duas etapas em transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) tem um erro de prioridade: quando um argumento contém um padrão $VAR, ele é envolvido em aspas duplas (L1290) em vez de aspas simples. Aspas duplas no POSIX sh não suprimem a substituição de comando por crase, permitindo que comandos injetados sejam executados. Um atacante que controla argumentos passados a spawnSync ou spawn com shell: true pode executar comandos arbitrários do sistema operacional, contornando o sistema de permissões do Deno. Esta vulnerabilidade está corrigida na versão 2.7.2.

CVE-2026-3841 Alta · 8.8 CWE-78 12/03/2026

Command Injection Vulnerability in Telnet CLI on TP-Link TL-MR6400

A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by insufficient sanitization of data processed during specific CLI operations. An authenticated attacker with elevated privileges may be able to execute arbitrary system commands. Successful exploitation may lead to full device compromise, including potential loss of confidentiality, integrity, and availability.

CVE-2026-28384 Crítica · 9.9 CWE-78 12/03/2026

Authenticated RCE via unsanitized compression_algorithm

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

CVE-2026-31975 Crítica · 9.8 CWE-78 11/03/2026

Cloud CLI WebSocket shell injection

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.

CVE-2026-31862 Alta · 8.8 CWE-78 11/03/2026

Cloud CLI has Command Injection via Multiple Parameters

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, multiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, commit), allowing authenticated attackers to execute arbitrary OS commands. This vulnerability is fixed in 1.24.0.

CVE-2026-31854 Alta · 8.8 CWE-78 11/03/2026

Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass

Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections could result in commands being executed automatically, without the user’s explicit intent, thereby posing a significant security risk. This vulnerability is fixed in 2.0.

CVE-2026-20040 Alta · 8.8 CWE-78 11/03/2026

Cisco IOS XR Software CLI Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.

CVE-2025-67041 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS3000PS OS Command Injection

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

CVE-2025-67038 Crítica · 9.8 KEV Alta · 69 Exploit público CWE-78 11/03/2026

Lantronix EDS5000 Code Injection Vulnerability

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

CVE-2025-67037 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.

CVE-2025-67036 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.

CVE-2025-67035 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.

CVE-2025-67034 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

CVE-2024-14026 Alta · 7.8 CWE-78 11/03/2026

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.3.3006 build 20250108 and later

CVE-2026-23816 Alta · 8.8 CWE-78 11/03/2026

Authenticated Command Injection found in admin AOS-CX CLI command

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-28292 Crítica · 9.8 CWE-78 10/03/2026

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

CVE-2026-25836 Alta · 7.2 CWE-78 10/03/2026

OS Command Injection em Fortinet FortiSandbox Cloud

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests.

CVE-2025-66178 Alta · 7.2 CWE-78 10/03/2026

A improper neutralization of special elements used in an os command ('os command injection')...

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.

CVE-2025-41709 Crítica · 9.8 CWE-78 10/03/2026

Command injection in power analyzer via Modbus-TCP and Modbus-RTU

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.

CVE-2026-26982 Alta · 8.8 CWE-78 10/03/2026

Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operations

Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop malicious text. The attack requires user interaction to be triggered, but the dangerous characters are invisible in most GUI environments so it isn't trivially detected, especially if the string contents are complex. Fixed in Ghostty v1.3.0.

CVE-2026-25041 Alta · 7.2 CWE-78 09/03/2026

Budibase has a Command Injection in PostgreSQL Dump Command

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.

CVE-2025-70039 Crítica · 9.8 CWE-78 09/03/2026

OS Command Injection em Linagora Twake

An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223.