CVE-2025-24817

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application...

CVE-2025-24817

Nokia MantaRay NM (Symptom Collector) is reported to be vulnerable to an OS command injection caused by improper neutralization of special elements in an OS command. CVSS v3.1 base score 8.0 (HIGH) with adjacent attack vector, low attack complexity, and low privileges required, no user interactio...

CVE-2026-5528

A security vulnerability has been detected in MoussaabBadla code-screenshot-mcp up to 0.1.0. This affects an unknown part of the component HTTP Interface. Such manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may...

Docker MCP Server 操作系统命令注入漏洞

Docker MCP Server is an MCP protocol server developed by Suvarchal Kumar Cheedela for Docker operations. Versions of Docker MCP Server prior to 0.1.0 have a vulnerability related to operating system command injection. This vulnerability stems from incorrect operations on the functions...

Nokia MantaRay NM 安全漏洞

Nokia MantaRay NM is a telecommunications network management platform developed by Finnish company Nokia. Nokia MantaRay NM has a security vulnerability, which stems from OS command injection in the Log Search application...

CVE-2026-5692

A vulnerability was found in Totolink A7100RU 7.4cu.2313b20191024. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-5692 Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection

A vulnerability was found in Totolink A7100RU 7.4cu.2313b20191024. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-5679

A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument stunpass leads to os command injection. The exploit has been disclosed publicly and may be used...

CVE-2026-35021

Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority CNA. It was determined that the affected code path cannot be triggered through normal usage of Claude Code...

CVE-2026-35022

Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority CNA. It was determined that the -p flag behavior is documented in Anthropic's claude -h output with an explicit warning that non-interactive mode should only be used in trusted directories, making this intended and...

CVE-2026-5679

The vulnerability affects Totolink A3300R firmware 17.0.0cu.557_B20221024. The issue resides in the function vsetTr069Cfg in /cgi-bin/cstecgi.cgi where manipulation of the stun_pass argument leads to an OS command injection. An exploit has been disclosed publicly. According to the CVSS-like metri...

CVE-2026-35022

Anthropic Claude Code CLI and Claude Agent SDK are cited in multiple sources as vulnerable to an OS command injection in authentication helper execution. The underlying issue is that helper configuration values are executed with shell=true without input validation, allowing injection of shell met...

CVE-2026-35022

...

CVE-2026-35021

The CVE-2026-35021 entry is rejected by the CNA and does not represent an active vulnerability.

CVE-2026-5678 Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection

A weakness has been identified in Totolink A7100RU 7.4cu.2313b20191024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument mode can lead to os command injection. The attack may be launched remotely. The exploit has been...

CVE-2026-5678

CVE-2026-5678 affects Totolink A7100RU (firmware 7.4cu.2313_b20191024). The vulnerability is in the /cgi-bin/cstecgi.cgi function setScheduleCfg, where manipulating the mode argument enables an OS command injection. Exploitation can be performed remotely, and a public exploit is available. Impact...

CVE-2026-5677

Totolink A7100RU 7.4cu.2313_b20191024 is affected by CVE-2026-5677. The vulnerability lies in the CsteSystem function in /cgi-bin/cstecgi.cgi, where manipulating the resetFlags argument enables OS command injection. The attack is remote and has publicly available exploit code. No remediation deta...

Regular Expression without Anchors

Overview Affected versions of this package are vulnerable to Regular Expression without Anchors in the parseModelURL function in Ollama Engine startup probe that allows shell metacharacters like ;, |, $, and backticks. An attacker can execute arbitrary operating system commands by supplying a...

CVE-2026-34940 KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript function in internal/modelcontroller/engineollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components ref, modelParam. This shell command is executed via bash ...

CVE-2026-34940

KubeAI has a OS Command Injection vulnerability in the Ollama Engine startup probe. Before version 0.23.2, the ollamaStartupProbeScript() constructs a shell command via fmt.Sprintf using unsanitized model URL components (ref, modelParam) and runs it with bash -c as a Kubernetes startup probe. An ...