CVE-2026-82536

Roo-Code through version 3.54.0 contains an auto-approve bypass in its shell command parsing logic. The root cause is the omission of the bash pipe operator (specifically the stderr-redirecting pipe) from the parser's operator token set. An attacker can craft a command line combining an allowlist...

Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

GHSA-XP7J-H7JC-4W8P Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

CVE-2026-83948

Improper neutralization of special elements used in a command 'command injection' in Microsoft Azure CLI allows an authorized attacker to execute code over a network...

EUVD-2026-73888

Improper neutralization of special elements used in a command 'command injection' in Microsoft Azure CLI allows an authorized attacker to execute code over a network...

CVE-2026-83948

CVE-2026-83948 is a command injection vulnerability in Microsoft Azure CLI , caused by improper neutralization of special elements used in a command. An authorized attacker can leverage this to execute code over a network, achieving remote code execution with high impact on confidentiality, integ...

CVE-2026-84387

An Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability CWE-77 vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions may allow a privileged attacker to execute...

CVE-2026-81380

CVE-2026-81380 is a command injection flaw in GitHub Copilot and Visual Studio Code that can allow an unauthenticated remote attacker to disclose information over a network . The vulnerability is rated CVSS 3.1 5.3 (MEDIUM) with a high attack complexity, no required privileges, and required user ...

CVE-2026-81380

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

EUVD-2026-73336

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-81349

Azure HDInsight is affected by an OS command injection vulnerability in its Ambari component, resulting from improper neutralization of special elements used in OS commands. An authorized attacker can leverage this flaw over the network to elevate privileges , potentially compromising confidentia...

EUVD-2026-73328

Improper neutralization of special elements used in an os command 'os command injection' in Azure HDInsights allows an authorized attacker to elevate privileges over a network...

CVE-2026-69534

CVE-2026-69534 is a command injection vulnerability in the Windows Program Compatibility Assistant Service , caused by improper neutralization of special elements used in a command. An authorized attacker can leverage this flaw to achieve local privilege escalation , with a CVSS 3.1 score of 7.8 ...

EUVD-2026-73011

Improper neutralization of special elements used in a command 'command injection' in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2026-84387

CVE-2026-84387 is a command injection vulnerability in Fortinet FortiSandbox affecting versions 5.2.0 , 5.0.0 through 5.0.6 , and 4.4.0 through 4.4.9 . The flaw involves improper neutralization of special elements in a command, potentially allowing an attacker to execute unauthorized code or comm...

EUVD-2026-72922

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

CVE-2026-84387

An Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability CWE-77 vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions may allow a privileged attacker to execute...

CVE-2026-84387

An Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability CWE-77 vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions may allow a privileged attacker to execute...

Security Bulletin: Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Summary Langflow uses a code security scanner and component-level execution policies to restrict server-side code execution to authorized users and contexts. The agentic assistant code scanner employs an incomplete denylist omitting process-spawning primitives and contains a logic error where...

CVE-2026-86733

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...