188601 matches found
CVE-2026-103848
Adobe Experience Manager is vulnerable to an OS Command Injection (CWE-78) caused by the improper neutralization of special elements used in an OS command. A low-privileged attacker can exploit this vulnerability to achieve arbitrary code execution in the context of the current user. This exploit...
CVE-2026-103848 Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...
CVE-2026-110005 Moghtech Komodo contains an OS command injection vulnerability
The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...
CVE-2026-110005
The Komodo server management platform, specifically the periphery agent's container-management functionality, contains an OS command injection vulnerability (CWE-78) in versions prior to 2.3.0 (verified in v2.2.0, v2.1.2, v2.1.1, v2.1.0, v2.0.0, and v1.19.1). The root cause is the lack of proper ...
CVE-2026-110005 Moghtech Komodo contains an OS command injection vulnerability
The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...
CVE-2026-97781
Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...
CVE-2026-96951
Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69370
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
DEBIAN-CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...
CVE-2026-110233
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...
CVE-2026-110206
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...
CVE-2026-110205
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that discards command substitutions placed next to or ? glob characters. Attackers using indirect prompt injection can craft commands like echo $... that match allowlisted prefixes, executing denied...
CVE-2026-110202
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision that allows attackers to auto-approve denied shell commands by prefixing them with a bare & redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo...
CVE-2026-110204
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine treats $ command; substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted...
CVE-2026-110203
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...
CVE-2026-109429
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...
CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...
UBUNTU-CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...
CVE-2026-104584
reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...