CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

PT-2026-82868

Name of the Vulnerable Software and Affected Versions NUMail versions prior to 202602162 Description NUMail contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating-system commands on the server. This occurs because the applicati...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows remote attackers to execute arbitrary commands via a crafted input. The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector requiring no privi...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface . An authenticated attacker can execute arbitrary operating system commands with elevated privileges, potentially leading to unauthorized access to sensitive information or complete device compromise ...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

EUVD-2026-67136

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

CVE-2026-81562

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-81562

CVE-2026-81562 is an OS command injection vulnerability in AlexGladkov claude-in-mobile version 3.10.2 , affecting the execSync function in the file src/adb/client.ts . A local attacker with low privileges can manipulate input to inject operating system commands, leading to partial compromise of ...

CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

vulnerabilities in Adobe Campaign Classic

Adobe has identified several vulnerabilities in Adobe Campaign Classic. These vulnerabilities involve Server-Side Request Forgery SSRF and OS Command Injection. The SSRF vulnerability allows attackers to manipulate requests on the server, which can lead to the execution of arbitrary code without...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-74770

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-68861

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-74770

Dell PowerProtect One (versions 20.1.0.0 and below ) is affected by an OS Command Injection vulnerability. A low-privileged remote attacker can exploit this flaw to achieve code execution , with a CVSS 3.1 score of 8.8 (HIGH) — reflecting network attack vector, low complexity, and high impact on ...

EUVD-2026-66674

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-74770

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-71171

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote...