CVE-2026-110206: Interpretation Conflict

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...

CVE-2026-109108: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly an...

CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...

CVE-2026-104584

reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...

CVE-2026-109429: Interpretation Conflict

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

CVE-2026-104584

The reNgine tool (up to v2.2.0 and master branch commit de4199222cca5618f1255930ce78987e47d43a99 ) is vulnerable to OS Command Injection . The root cause lies in the custom_headers scan engine configuration field within web/reNgine/tasks.py, specifically in the fetch_url and dir_file_fuzz functio...

CVE-2026-96951: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

Debian dla-4832 : nagios4 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4832 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4832-1 [email protected]...

Cisco NX-OS Python Sandbox Bypass Command Execution

The vulnerability of the built-in Python interpreter in the Cisco NX-OS operating system is related to insufficient spatial separation. Exploiting this vulnerability could allow an attacker to bypass the sandboxing protection mechanisms and execute arbitrary commands...

CVE-2026-103848: Improper Neutralization of Special Elements used in an OS Command

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-100207: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

PT-2026-111569

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update config can inject an uppercase LOG FORMAT command localfile that the collector runs as root on...

CVE-2026-104585

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

PT-2026-111728

Name of the Vulnerable Software and Affected Versions Cronicle versions prior to 0.9.119 Description An issue exists in the administrator Activity Log within htdocs/js/pages/admin/Activity.js where the item.user.full name value is concatenated into HTML without proper encoding via encode entities...

EUVD-2026-100603

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

PT-2026-111393

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize input...

CVE-2026-109409: Improper Neutralization of Special Elements used in a Command

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

Microsoft Windows: CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

Microsoft VS Code: CVE-2026-69370: Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-69370: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...