PT-2026-83800

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi mgr.cgi. Performing a manipulation of the argument alias/username/password/volume location results in os command injection. It is possible to initiate the attack...

CVE-2026-82702: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component aspWlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly...

PT-2026-83777

Name of the Vulnerable Software and Affected Versions diem-project diem versions prior to 5.1.4 Description An OS command injection flaw exists in the Administrative Console component. A remote attacker can exploit this by manipulating the dm command argument passed to the executeCommand function...

CVE-2026-82678: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...

CVE-2026-82691: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attac...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...

PT-2026-83821

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8...

CVE-2026-82689: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomountmgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can b...

CVE-2026-82692: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsimgr.cgi. Performing a manipulation of the argument alias/username/password/volumelocation results in os command injection. It is possible to initiate the attack remotely...

CVE-2026-79408

MetaGPT version 0.8.1 is vulnerable to an OS command injection flaw within the metagpt/repo_parser.py file. The root cause is that the RepoParser.rebuild_class_views() function interpolates the path argument into a shell command using shell=True without utilizing an argument list. This allows an ...

PT-2026-83850

A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The...

PT-2026-83789

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can ...

CVE-2026-82690: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/vemgr.cgi. This manipulation of the argument fdev causes os command injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636: Improper Neutralization of Special Elements used in an OS Command

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

OS Command Injection

com.powsybl, powsybl-computation-local is vulnerable to OS command injection. The vulnerability is due to insufficient escaping of attacker-controlled command arguments and environment variables before they are passed to shell interpreters, which allows an attacker to inject and execute arbitrary...

EUVD-2026-67958

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...

CVE-2026-19295

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...

CVE-2026-75121

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...