CVE-2026-110005

The Komodo version 2.2.0 platform contains an OS command injection vulnerability within the periphery agent's container-management functionality. An authenticated low-privileged user possessing Execute or Read plus Logs permissions on a managed server can exploit the DestroyContainer or SearchCon...

CVE-2026-97798

Improper neutralization of argument delimiters in a command 'argument injection' in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-97781

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...

CVE-2026-96951

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-96220

Improper control of generation of code 'code injection' in Windows Assigned Access allows an authorized attacker to elevate privileges locally...

CVE-2026-88094

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Storage Library allows an authorized attacker to elevate privileges over a network...

CVE-2026-88075

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2026-85359

Improper control of generation of code 'code injection' in Windows Performance Monitor allows an authorized attacker to elevate privileges locally...

CVE-2026-83759

Improper control of generation of code 'code injection' in Windows Encrypting File System EFS allows an authorized attacker to execute code over a network...

CVE-2026-70266

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-70049

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-69370

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

DEBIAN-CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110233

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...

CVE-2026-110205

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that discards command substitutions placed next to or ? glob characters. Attackers using indirect prompt injection can craft commands like echo $... that match allowlisted prefixes, executing denied...

CVE-2026-110206

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...

CVE-2026-110202

Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision that allows attackers to auto-approve denied shell commands by prefixing them with a bare & redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo...

CVE-2026-110203

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...

CVE-2026-110204

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine treats $ command; substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted...

CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...