CVE-2026-56197

Improper neutralization of special elements used in a command 'command injection' in Windows Admin Center allows an authorized attacker to execute code over a network...

CVE-2026-55145

Improper neutralization of special elements used in a command 'command injection' in Outlook Copilot allows an authorized attacker to perform tampering over a network...

CVE-2026-50488

Improper neutralization of special elements used in a command 'command injection' in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally...

CVE-2026-62656

The CVE-2026-62656 entry concerns post-authenticated command injection affecting certain NETGEAR RAX models. A logged-in user can send specially crafted requests to the router to run unauthorized commands, enabling changes to the router and impacting security/operation. The vulnerability targets ...

CVE-2026-62658

NETGEAR Nighthawk RAX series routers (RAX45, RAX43, RAX50, RAX54sv2) are affected by CVE-2026-62658, a post-authentication vulnerability that could allow a logged-in user to execute arbitrary commands or code on the device. The CVSS 4.0 base score is 5.7 (MEDIUM) with high integrity impact and ad...

CVE-2026-58635

Improper neutralization of special elements used in a command 'command injection' in Windows Narrator Braille allows an authorized attacker to elevate privileges locally...

CVE-2026-50520

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code locally...

CVE-2026-50520

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code locally...

CVE-2026-48561

Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to execute code over a network...

CVE-2026-15428

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with...

CVE-2026-15427

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

CVE-2026-58635

CVE-2026-58635 is a Windows Narrator Braille elevation-of-privilege vulnerability caused by improper neutralization of special elements used in a command. Exploitation is local, requires low privileges, and does not require user interaction; successful exploitation yields high impact to confident...

CVE-2026-50520

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code locally...

CVE-2026-50520

CVE-2026-50520: Visual Studio Code is affected by a command-injection vulnerability due to improper neutralization of special elements in a command, enabling a local attacker to execute code. The CVSS v3.1 base score is 8.4 (HIGH) with LOCAL attack vector, no user interaction required, and high i...

CVE-2026-48561

Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to execute code over a network...

CVE-2026-48561

CVE-2026-48561 concerns Microsoft Copilot and is described as an Improper neutralization of special elements used in a command (command injection) that allows remote code execution over a network. The CVSS 3.1 metrics from the source indicate a CRITICAL base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/...

CVE-2026-15428

The CVE-2026-15428 entry concerns Archer VX800v (v1) and related CXE/ CWMP management exposure. The underlying issue is insufficient input sanitization of the domain name parameter in the HTTP interface, enabling an adjacent attacker to inject shell metacharacters and achieve arbitrary code execu...

CVE-2026-15428 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with...

CVE-2026-15427 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

CVE-2026-15427

The CVE-2026-15427 involves an OS command injection in the TR-069/CWMP management interface of TP-Link Archer VX1800v (v1). The root cause is insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires TR-069 ...