Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

16616 matches found

NVD
NVD•added 2026/09/29 8:17 p.m.•9 views

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

6.3CVSS0.00511EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/09/29 7:35 p.m.•35 views

CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

8.8CVSS0.00288EPSS
SaveExploits0References1
CVE
CVE•added 2026/09/29 7:35 p.m.•17 views

CVE-2026-100292

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , an authenticated request can enable a hidden debug interface . This interface allows additional commands to be sent to a backend service, potentially exposing system-level functionality . If crafted inputs reach the underlying command handler, ...

8.8CVSS5.9AI score0.00288EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment•added 2026/09/29 7:35 p.m.•6 views

CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

8.8CVSS5.9AI score0.00288EPSS
SaveExploits0References1
Kitploit
Kitploit•added 2026/09/29 7:12 p.m.•12 views

CVE-2026-48030

CVE-2026-48030 — Pheditor における OS コマンドインジェクション 概要 フィールド| 詳細 ---|--- CVE ID| CVE-2026-48030 製品| pheditor ベンダー| Hamid Samak 影響を受けるバージョン| 2.0.1, 2.0.2, 2.0.3 修正済みバージョン| 2.0.4 深刻度| 緊急 CVSS スコア| 9.9 CVSS ベクター| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE| CWE-78 OS コマンドインジェクション 発見者| Muslimbek...

9.9CVSS6.2AI score0.07548EPSS
SaveExploits1References4
Kitploit
Kitploit•added 2026/09/29 6:45 p.m.•12 views

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 1.1.0 - OSコマンドインジェクション Exploit Title: SDT-CW3B1 1.1.0 - OS Command Injection Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 CVE Description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to...

10CVSS8.7AI score0.94342EPSS
SaveExploits21
NVD
NVD•added 2026/09/29 5:17 p.m.•5 views

CVE-2022-51019

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

8.8CVSS0.01799EPSS
SaveExploits0References6
Cvelist
Cvelist•added 2026/09/29 4:04 p.m.•34 views

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

8.8CVSS0.01799EPSS
SaveExploits0References6
OSV
OSV•added 2026/09/29 4:04 p.m.•5 views

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

8.7CVSS6.4AI score
SaveExploits0References8
Vulnrichment
Vulnrichment•added 2026/09/29 4:04 p.m.•5 views

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

8.8CVSS6.7AI score0.01799EPSS
SaveExploits0References6
CVE
CVE•added 2026/09/29 4:04 p.m.•11 views

CVE-2022-51019

Akaunting versions prior to 2.1.31 are vulnerable to an OS command injection vulnerability within the module installation and update flow. The root cause is the unvalidated passing of the alias parameter to shell command execution. Authenticated users with admin panel access can exploit this by i...

8.8CVSS6.7AI score0.01799EPSS
SaveExploits0References6
EUVD
EUVD•added 2026/09/29 4:04 p.m.•7 views

EUVD-2022-56062

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

8.8CVSS6.7AI score0.01799EPSS
SaveExploits0References6
Kitploit
Kitploit•added 2026/09/29 3:13 p.m.•10 views

Vulnerability-CVE-2025-64446-CVE-2025-58034

FortiWeb エクスプロイトシミュレーション CVE-2025-64446 & CVE-2025-58034 注意: このドキュメントは学習およびセキュリティ研究目的のみです。 許可なくシステムを攻撃するために使用しないでください。 1. 概要 FortiWebはWebアプリケーションファイアウォール（WAF）であり、Webアプリケーションを保護するために使用されます。 2025年には、2つの深刻な脆弱性が発見されました： CVE-2025-64446 – パストラバーサルによる認証バイパス CVE-2025-58034 – OSコマンドインジェクション 2...

9.8CVSS8AI score0.91838EPSS
SaveExploits21
Kitploit
Kitploit•added 2026/09/29 1:28 p.m.•16 views

CVE-2026-39949

CVE-2026-39949: ホスト変数インジェクションによる Cacti の認証済みリモートコード実行 概要 Cacti ≤ 1.2.30 の OS コマンドインジェクションの脆弱性により、デバイスおよびグラフテンプレート作成権限を持つ認証済みユーザーは、基盤となるサーバー上で任意のコマンドを実行できます。この欠陥は、ユーザーが制御するホストメタデータフィールド（具体的にはデバイスのメモ欄）が、Cacti の変数置換エンジンを介して RRDtool...

7.4AI score
SaveExploits2
Kitploit
Kitploit•added 2026/09/29 1:21 p.m.•9 views

CVE-2015-10141

CVE-2015-10141 – XDebug リモートコード実行 RCE CVE-2015-10141 は、Xdebug バージョン 2.5.5 以前 に影響を与える 認証不要の OS コマンドインジェクション 脆弱性です。 根本原因: Xdebug のリモートデバッグ機能が有効な場合、拡張機能は ポート 9000 で待機し、いかなる認証も行わず デバッガプロトコルコマンドを受け入れます。 攻撃ベクトル: 攻撃者は、このインターフェースを介して特別に細工した eval コマンドを送信し、任意の PHP コードを実行できます。これにより、system や passthru...

9.3CVSS6.2AI score0.07386EPSS
SaveExploits2References1
NVD
NVD•added 2026/09/29 1:17 p.m.•8 views

CVE-2026-102437

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

7.8CVSS0.00992EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/09/29 12:06 p.m.•7 views

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

7.8CVSS6.5AI score0.00992EPSS
SaveExploits0References2
OSV
OSV•added 2026/09/29 12:06 p.m.•4 views

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

7.8CVSS6.3AI score
SaveExploits0References5
EUVD
EUVD•added 2026/09/29 12:06 p.m.•7 views

EUVD-2026-88756

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

7.8CVSS6.5AI score0.00992EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/09/29 12:06 p.m.•40 views

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

7.8CVSS0.00992EPSS
SaveExploits0References2
Rows per page
Query Builder