CVE-2026-109108: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly an...

PT-2026-111884

Name of the Vulnerable Software and Affected Versions Azure CycleCloud affected versions not specified Description Improper neutralization of special elements used in an OS command leads to an OS command injection. This allows an authorized attacker to execute code locally on the system...

PT-2026-113310

Name of the Vulnerable Software and Affected Versions Komodo version 2.2.0 Description The periphery agent's container-management functionality allows an authenticated low-privileged user with Execute or Read and Logs permissions to perform OS command injection. By supplying shell metacharacters ...

PT-2026-111781

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager version 8.0.0 Fortinet FortiManager versions 7.6.0 through 7.6.6 Fortinet FortiManager Cloud versions 7.6.2 through 7.6.6 Description An OS command injection issue exists due to improper neutralization of special elements...

CVE-2026-104584

reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...

CVE-2026-110005: Undefined Security Weakness

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

PT-2026-111302

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE1-A version 251117 Description A remote OS command injection exists in the /cgi-bin/uploadVpn.cgi endpoint. The issue occurs when the Type variable is manipulated, affecting the popen function. OS command injection is a flaw...

VulnCheck KEV: CVE-2026-96951

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-103848: Improper Neutralization of Special Elements used in an OS Command

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-100207: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

CVE-2026-104585

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

EUVD-2026-100603

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-109409: Improper Neutralization of Special Elements used in a Command

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

Microsoft Windows: CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

Microsoft VS Code: CVE-2026-69370: Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-69370: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-69718: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

CVE-2026-55376: Improper Neutralization of Special Elements used in an OS Command

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...

CVE-2026-104085: Improper Neutralization of Special Elements used in an OS Command

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $id i...

PT-2026-112041

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check filter exec in mt.c passed the constructed command...