1682 matches found
CVE-2026-84838
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
CVE-2026-84838
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
CVE-2026-84838 Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
CVE-2026-84837
A command injection vulnerability was identified in rpm , specifically in the gettarspec function used by rpmbuild -t*. The root cause is an unescaped tarball path or filename that, when containing shell metacharacters, allows an attacker to inject arbitrary commands. This is particularly relevan...
CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...
CVE-2026-84694
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...
The vulnerability of the Internet access control and audit system Ruijie 6000-E10, related to the failure to take measures to neutralize special elements, allows a perpetrator to execute arbitrary commands.
The vulnerability of the Internet access control and audit system Ruijie 6000-E10 is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2026-73766
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...
EUVD-2026-69630
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...
CVE-2026-73763 Unauthenticated Remote Command Execution in Management Component
A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result in remote execution of arbitrary commands in the context of the affected utility...
CVE-2026-73751 Authenticated Remote Command Injection in AOS-CX Web-based Management Interface
An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...
CVE-2026-79682
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...
CVE-2026-79682
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...
CVE-2026-84233
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...
WordPress MW WP Form plugin < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin MW WP Form versions 5.1.5...
CVE-2026-13732
A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...
CVE-2026-79408
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...
PT-2026-83998
Name of the Vulnerable Software and Affected Versions MetaGPT version 0.8.1 Description An OS command injection flaw exists where the rebuild class views function in metagpt/repo parser.py interpolates the path argument into a shell command using shell=True without using an argument list. This...
CVE-2026-55673
PowSyBl (Power System Blocks), a framework for building power system software, is affected by a command injection vulnerability prior to version 7.2.2. The UnixLocalCommandExecutor and WindowsLocalCommandExecutor components concatenate attacker-controlled arguments and environment variables into ...