188724 matches found
CVE-2026-109409: Improper Neutralization of Special Elements used in a Command
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...
Microsoft Windows: CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...
Microsoft VS Code: CVE-2026-69370: Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-69370: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-11732: Improper Input Validation
An insufficient input validation vulnerability in the website blocking feature Block Sites of the listed NETGEAR router models allows a network-adjacent attacker having network access such as WiFi credentials to run unauthorized commands on the router. This vulnerability could affect the...
PT-2026-111680
Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17-lts Description Ansible-based automation rendering allows the evaluation of attacker-controlled template expressions by users with permissions to create or execute affected automation tasks. This can trigge...
CVE-2026-104126: Improper Control of Generation of Code
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation...
CVE-2026-110203: Interpretation Conflict
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...
CVE-2026-69718: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...
CVE-2026-55376: Improper Neutralization of Special Elements used in an OS Command
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...
PT-2026-111569
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update config can inject an uppercase LOG FORMAT command localfile that the collector runs as root on...
PT-2026-112041
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check filter exec in mt.c passed the constructed command...
PT-2026-111830
Name of the Vulnerable Software and Affected Versions Roo Code versions prior to 3.54.1 Description A command approval bypass exists in the parseCommandLine function. This issue allows attackers to auto-approve arbitrary shell commands by placing a command substitution in the command position. By...
PT-2026-111824
Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4 Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by...
PT-2026-113545
Name of the Vulnerable Software and Affected Versions Citrix UniconOS versions prior to 2607.2 CR Citrix UniconOS versions prior to 2603 LTSR CU2 Description An issue in Citrix UniconOS allows for persistent command execution. Recommendations Update Citrix UniconOS to version 2607.2 CR or later...
PT-2026-111604
Name of the Vulnerable Software and Affected Versions CVFS affected versions not specified Description An input validation issue exists that allows for command execution. Recommendations Update CVFS to the resolved maintenance release...
PT-2026-111311
Name of the Vulnerable Software and Affected Versions Wavlink WL-WN592AX6 version 250422 Description A flaw in the wmapd Daemon allows for remote OS command injection. The issue resides within the system function, enabling an attacker to execute arbitrary operating system commands without...
CVE-2026-104585
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection within the /download_data/ and /api/v1/scan endpoints. The flaw specifically affects the Dynamic Analyzer ADB integration module . This vulnerability allows for the execution of arbitrary commands on the underlying system...
CVE-2026-96951: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...
