CVE-2026-69320: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

PT-2026-70768

Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in an OS command, known as OS command injection, allows an unauthorized attacker to...

CVE-2026-67180: Improper Neutralization of Special Elements used in an OS Command

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10...

CVE-2026-73081: Improper Neutralization of Special Elements used in an OS Command

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

CVE-2026-48362: Improper Neutralization of Special Elements used in an OS Command

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitatio...

CVE-2026-48385: Improper Neutralization of Special Elements used in an OS Command

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-73222: Improper Neutralization of Special Elements used in an OS Command

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...

CVE-2026-14863: Improper Neutralization of Special Elements used in an OS Command

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-73224: Improper Neutralization of Special Elements used in an OS Command

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...

PT-2026-70344

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. This allows an attacker to execute arbitrary code in the context of the curre...

CorgetGpsDget 2_3.2 Command Injection

CorgetGpsDget version 23.2 suffers from a remote command injection vulnerability. Exploit Title: CorgetGpsDget 23.2 - OS Command Injection Date: 2026-07-05 Exploit Author: Bytetobreach Fofa server: "PTTServer" Vendor Homepage: http://corget.com Version: GpsDget 23.2, build 2020-09-01 dget.version...

CVE-2026-70335: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally...

CVE-2026-73077: Improper Neutralization of Special Elements used in an OS Command

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

CVE-2025-30241

CVE-2025-30241 affects TP-Link Aginet devices; the web interface allows OS command execution due to inadequate input validation/sanitization before using system-level commands. An authenticated adjacent attacker can inject crafted input to run arbitrary commands with elevated privileges, potentia...

CVE-2025-30241 OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system...

CVE-2025-30241 OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system...

CVE-2026-71849 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard, wazuh-dashboard-fips, langfuse, langfuse-fips...

GHSA-79QM-7RJ5-M7R9 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard, wazuh-dashboard-fips, langfuse, langfuse-fips...

CVE-2026-72880 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-72878 Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...