CVE-2026-62943: Improper Neutralization of Special Elements used in an OS Command

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

CVE-2026-84071: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...

CVE-2026-81623: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input...

CVE-2026-84085: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-93533: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-82892: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

VulnCheck KEV: CVE-2023-46359

An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature...

CVE-2026-82887: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2025-14754: Improper Neutralization of Special Elements used in an OS Command

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2026-81942: Improper Neutralization of Special Elements used in an OS Command

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-80442: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affect...

CVE-2026-53557

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

UBUNTU-CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-52483

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...

CVE-2026-92993

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

EUVD-2026-82422

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through...

CVE-2026-47252

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...