CVE-2026-100308: Deserialization of Untrusted Data

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-102937: Improper Neutralization of Special Elements used in an OS Command

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

CVE-2022-51019: Improper Neutralization of Special Elements used in an OS Command

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

PT-2026-102435

Name of the Vulnerable Software and Affected Versions Netcore NAP930 version 0.1.241010.141410 Description Remote OS command injection is possible within the Network Tools CGI component. The issue exists in the eval function of the '/www/cgi-bin/network tools' endpoint, where improper handling of...

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157

The token-optimizer-mcp software is vulnerable to OS command injection in the smart_user tool (specifically the get-user-info operation) prior to version 5.1.0 . The root cause is the unsafe interpolation of a user-controlled username argument into a shell command executed via execAsync(). Becaus...

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-87969

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

CVE-2026-86102

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...

CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

EUVD-2026-88364

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...

CVE-2026-86102 WatchGuard AP Command Injection in Internal Management API Allows Command Execution

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...

EUVD-2026-88363

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

CVE-2026-101076

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

CVE-2026-101075

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /locationtime.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is...

CVE-2026-101076 Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...