CVE-2026-72557: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-14863: Improper Neutralization of Special Elements used in an OS Command

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-69320: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-73081: Improper Neutralization of Special Elements used in an OS Command

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

PT-2026-70131

Name of the Vulnerable Software and Affected Versions ZoneMinder version 1.39.17 Description An authenticated user can execute OS commands due to a broken permission check within the Filter class. The canEdit and canDelete functions call nonexistent methods on the ZMUser class, which triggers the...

CorgetGpsDget 2_3.2 Command Injection

CorgetGpsDget version 23.2 suffers from a remote command injection vulnerability. Exploit Title: CorgetGpsDget 23.2 - OS Command Injection Date: 2026-07-05 Exploit Author: Bytetobreach Fofa server: "PTTServer" Vendor Homepage: http://corget.com Version: GpsDget 23.2, build 2020-09-01 dget.version...

CVE-2026-67180: Improper Neutralization of Special Elements used in an OS Command

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10...

CVE-2026-73224: Improper Neutralization of Special Elements used in an OS Command

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...

PT-2026-70768

Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in an OS command, known as OS command injection, allows an unauthorized attacker to...

CVE-2026-72603: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

PT-2026-104466

Уязвимость устройства синхронизации времени TOPAZ Метроном PTS связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, внедрять произвольные команды ОС...

PT-2026-70147

Name of the Vulnerable Software and Affected Versions wg-easy version 15.3.0 Description An OS command injection issue exists where users with the clients.create permission can execute arbitrary commands as root. This occurs because the client name field is written to the WireGuard configuration...

CVE-2026-70335: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally...

CVE-2026-73222: Improper Neutralization of Special Elements used in an OS Command

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...

CVE-2025-30241

CVE-2025-30241 affects TP-Link Aginet devices; the web interface allows OS command execution due to inadequate input validation/sanitization before using system-level commands. An authenticated adjacent attacker can inject crafted input to run arbitrary commands with elevated privileges, potentia...

CVE-2025-30241 OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system...

CVE-2025-30241 OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system...

GHSA-79QM-7RJ5-M7R9 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard, commercial-gitlab-rails-ee-fips, langfuse, commercial-gitlab-rails-ee, wazuh-dashboard-fips, langfuse-fips...

CVE-2026-71849 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard, commercial-gitlab-rails-ee-fips, langfuse, commercial-gitlab-rails-ee, wazuh-dashboard-fips, langfuse-fips...

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...