CliInvoke: Argument Injection in Extensibility Runner Factory

An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line. The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Argumen...

PT-2026-99126

Name of the Vulnerable Software and Affected Versions Mediawiki - ExternalData Extension versions prior to 3.7 Description An OS Command Injection issue exists in the ExternalData extension, which allows unauthenticated remote code execution through wikitext. This occurs due to the improper...

CVE-2026-19775: Missing Authorization

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-100382: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

CVE-2026-100368: Improper Neutralization of Special Elements used in an OS Command

CliInvoke is a .NET library for invoking command-line programs, and its CliInvoke.Specializations packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. CliInvoke.Specializations versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4,...

Linux Distros Unpatched Vulnerability : CVE-2026-79310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...

The vulnerability of the Erlang/OTP software platform lies in its ability to use strictly encrypted keys, allowing a hacker to execute arbitrary code.

The vulnerability of the Erlang/OTP software platform lies in the ability to use hard-coded keys of the platform. Exploiting this vulnerability allows a remote attacker to execute arbitrary code before the operating system is loaded...

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions. The wrappers re-run a caller-supplie...

CVE-2026-85082 Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-85082

The Root Browser Classic 3.3.0 application is vulnerable to an OS command injection due to the improper handling of SQLite database paths. The application passes the file path of a selected database to an operating-system shell without ensuring the filename is safely separated from the command. T...

CVE-2026-97366

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

EUVD-2026-86461

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-97366 jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-97366

A security flaw exists in jhen0409 react-native-debugger versions up to 0.14.0 . The vulnerability is located in the openDevTools function within the electron/window.js file of the Open in Editor Handler component. By manipulating the host argument, an attacker can trigger an os command injection...

CVE-2026-97366 jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-93289 OS command injection in Eufy Omni C20, Omni X10 Pro

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

CVE-2026-93289 OS command injection in Eufy Omni C20, Omni X10 Pro

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

CVE-2026-93289

The Eufy Omni C20 and Omni X10 Pro are vulnerable to an OS command injection attack. This vulnerability allows an unauthenticated attacker to execute arbitrary system commands during the pairing process . While the specific root cause is not detailed in the provided documents, the impact is signi...

CVE-2026-79766

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...