CVE-2026-18073: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements...

PT-2026-85767

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-85672: Improper Neutralization of Special Elements used in an OS Command

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

CVE-2026-85656: Improper Neutralization of Special Elements used in an OS Command

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters...

CVE-2026-85696: Improper Neutralization of Special Elements used in an OS Command

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85223

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-85224

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224 D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224 D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224

CVE-2026-85224 is an OS command injection vulnerability in the File Sharing component of D-Link DNS-320 ShareCenter (firmware 2.06B01), specifically in /cgi/file_sharing.cgi. Manipulation of the fileurl argument allows a remote attacker to execute arbitrary commands. The CVSS 3.1 score is 9.1 (CR...

CVE-2026-85222

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85223 D-Link DNS-340L CGI dropbox.cgi os command injection

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-85223

CVE-2026-85223 affects D-Link DNS-340L firmware version 1.01B04 . The vulnerability is an OS command injection in the CGI Handler component, specifically in the file /cgi-bin/dropbox.cgi. Manipulating the callback_url and sync_interval arguments allows a remote, authenticated attacker to inject a...

CVE-2026-85223 D-Link DNS-340L CGI dropbox.cgi os command injection

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

EUVD-2026-70748

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85222

D-Link DNS-340L (firmware 1.01B04) is affected by an OS command injection in the Add-On Center component, specifically in /cgi-bin/addon_center.cgi. Manipulation of the f_name, f_url, f_flag, and f_login_user arguments allows remote code execution. The attack requires high privileges (authenticat...

CVE-2026-85012

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

CVE-2026-85012 OS command injection in the Amazon CodeCatalyst blueprints SDK

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...