Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-38820
High · 8.3
CWE-78 Aug 27, 2026
OS Command Injection in openNDS
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.
CVE-2026-78037
High · 8.8
CWE-78 Aug 27, 2026
Xiiaozet LK100W OS Command Injection
Xiiaozet LK100W is vulnerable to OS command injection through its
web-based management interface. An authenticated attacker may be able to
execute arbitrary operating system commands with elevated privileges,
potentially resulting in unauthorized access to sensitive information or
complete device compromise.
CVE-2026-76060
High · 8.8
CWE-78 Aug 27, 2026
OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
CVE-2026-81698
High · 8.8
CWE-78 Aug 27, 2026
openssl_encrypt before 1.4.9 Shell Injection via info command
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
CVE-2026-81097
High · 8.4
CWE-78 Aug 27, 2026
rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded methods. The denylist was introduced with the tool in 1.4.0 and never covered those entry points through 1.6.0. Version 1.6.1 restricts the requires the sandbox permits to a data-only list and blocks dynamic dispatch to execution entry points; 2.0.0 removes the tool.
CVE-2026-26899
High · 8.8
CWE-78 Aug 27, 2026
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17)…
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
CVE-2026-74233
Critical · 9.8
CWE-78 Aug 27, 2026
Zbtlink MQWrt infosrvd Command Injection
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
CVE-2026-75364
Medium · 6.8
CWE-78 Aug 26, 2026
Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the…
Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands
CVE-2026-75363
Medium · 6.8
CWE-78 Aug 26, 2026
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary…
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n.
CVE-2026-74770
High · 8.8
CWE-78 Aug 26, 2026
OS Command Injection in Dell Powerprotect One
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVE-2026-68861
High · 8.8
CWE-78 Aug 26, 2026
OS Command Injection in Dell Powerprotect One
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
CVE-2026-71171
High · 7.2
CWE-78 Aug 26, 2026
OS Command Injection in Dell Cloud Disaster Recovery
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
CVE-2026-70419
Critical · 9.1
CWE-78 Aug 26, 2026
OS Command Injection in Dell Cloud Disaster Recovery
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-19042
High · 8.8
CWE-78 Aug 26, 2026
Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
A command injection vulnerability in TeamViewer Full
Client and Host for Linux prior to version 15.81.5 allows a remote attacker to
execute arbitrary commands in the context of the current user via a specially
crafted URL sent through the out-of-session chat feature. Exploitation requires
user interaction by clicking the malicious link.
CVE-2026-80214
High · 8.6
CWE-78 Aug 26, 2026
LibreNMS Virtualisation Discovery Module RCE
LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
CVE-2026-80138
Critical · 9.8
CWE-78 Aug 25, 2026
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
CVE-2026-65099
High · 7.8
CWE-78 Aug 25, 2026
OS Command Injection in NVIDIA Nemoclaw
NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.
CVE-2026-65096
High · 7.8
CWE-78 Aug 25, 2026
OS Command Injection in NVIDIA Nemoclaw
NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVE-2026-65091
High · 8.8
CWE-78 Aug 25, 2026
OS Command Injection in NVIDIA Openshell
NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
CVE-2026-65090
High · 7.8
CWE-78 Aug 25, 2026
OS Command Injection in NVIDIA Nemoclaw
NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.
CVE-2026-65089
High · 7.8
CWE-78 Aug 25, 2026
OS Command Injection in NVIDIA Nemoclaw
NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.
CVE-2026-65086
Medium · 6.8
CWE-78 Aug 25, 2026
OS Command Injection in NVIDIA Openshell
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.
CVE-2026-77585
Medium · 5.3
CWE-78 Aug 25, 2026
Improper Validation of SSH Target in Okta Privileged Access Client
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.
CVE-2026-45018
Critical · 9.8
CWE-78 Aug 25, 2026
Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.
CVE-2026-79992
High · 7.8
CWE-78 Aug 25, 2026
Emacs: emacs: command injection via crafted filenames in tramp
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.