CVE-2026-39054

Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. The method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization. In affected deployments, this can result in arbitrary...

BIT-JUPYTER-NOTEBOOK-2026-42557 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all cli...

CVE-2026-46508: Improper Neutralization of Special Elements used in a Command

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and...

CVE-2026-7373: Inclusion of Functionality from Untrusted Control Sphere

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a stat...

Turborepo 命令注入漏洞

Turborepo is a high-performance JavaScript and TypeScript build system open source by Vercel. Versions of Turborepo 2.9.14000 and earlier contained a command injection vulnerability. This vulnerability stemmed from the LSP VS Code extension using string-based commands to execute Turborepo’s daemo...

CVE-2026-45803: Improper Neutralization of Escape, Meta, or Control Sequences

gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...

GitHub CLI 安全漏洞

GitHub CLI is an open-source command-line interface for GitHub. Versions of GitHub CLI from 1.6.0 to 2.92.0 contained a security vulnerability. This vulnerability stemmed from the lack of cleaning terminal control sequences when processing GitHub Actions workflow logs. It could allow attackers to...

WS-2020-0440

In imagickal in versions 0.1.0 to 5.0.0 is vulnerable to RCE, it allows to execute arbitrary commands on the victim's PC...

WS-2020-0439

In arpping in versions 1.0.0 to 2.0.0 is vulnerable to RCE, it allows to execute arbitrary commands on the victim's PC...

WS-2020-0435

In windows-edge in versions 1.0.0 and 1.0.1 is vulnerable to RCE, It allows to execute arbitrary commands remotely inside the victim's PC...

CVE-2026-26191

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root macOS/Linux or SYSTEM Windows on managed endpoints when an uninstall is triggered. When a...

Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection

A flaw was found in Apache Camel's camel-coap component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted CoAP Constrained Application Protocol UDP User Datagram Protocol packet. The camel-coap component improperly processes URI query parameters,...

WS-2019-0309

There is a Command Injection vulnerability found in all versions of marsdb. Attacker my run arbitrary command when function is executed...

WS-2019-0224

local-devices all versions are vulnerable to command injection when not validating input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system...

WS-2017-0129

Affected versions of the package are vulnerable to Arbitrary Command Execution...

PT-2026-41135

Name of the Vulnerable Software and Affected Versions @apostrophecms/cli versions prior to 3.6.1 Description The @apostrophecms/cli package contains a command injection issue within the apos create command. User-supplied input provided during the password prompt is embedded directly into a shell...

Fortinet FortiAP Command Execution

The vulnerability of the command-line interface CLI of Fortinet’s FortiAP and FortiAP-W2 microprogramming solutions lies in the lack of measures taken to neutralize the special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary comman...

Fortinet FortiAP Command Execution

The vulnerability of the command-line interface CLI of Fortinet’s FortiAP and FortiAP-W2 microprogramming solutions lies in the lack of measures taken to neutralize the special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary comman...

CVE-2026-45714

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the...

EUVD-2026-29983

A vulnerability exists in an undisclosed BIG-IP TMOS Shell tmsh command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacke...