Total
4006 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-40135 | 1 Sap | 1 Netweaver Application Server Abap | 2026-10-26 | N/A | 6.5 MEDIUM |
| An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality. | |||||
| CVE-2026-23823 | 1 Arubanetworks | 1 Arubaos | 2026-10-26 | N/A | 7.2 HIGH |
| A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability. | |||||
| CVE-2026-43990 | 2026-10-26 | N/A | 8.4 HIGH | ||
| JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1. | |||||
| CVE-2026-8344 | 1 Dlink | 2 Dir-816, Dir-816 Firmware | 2026-10-26 | 6.5 MEDIUM | 6.3 MEDIUM |
| A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-41611 | 1 Microsoft | 1 Visual Studio Code | 2026-10-26 | N/A | 7.8 HIGH |
| Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-44853 | 1 Arubanetworks | 2 Arubaos, Sd-wan | 2026-10-26 | N/A | 7.2 HIGH |
| Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user. | |||||
| CVE-2026-8345 | 1 Dlink | 2 Dir-816, Dir-816 Firmware | 2026-10-26 | 6.5 MEDIUM | 6.3 MEDIUM |
| A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such manipulation of the argument ip_address leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2026-8346 | 1 Dlink | 2 Dir-816, Dir-816 Firmware | 2026-10-26 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_address results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. | |||||
| CVE-2026-8272 | 1 Dlink | 2 Dns-320, Dns-320 Firmware | 2026-10-26 | 5.8 MEDIUM | 4.7 MEDIUM |
| A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. | |||||
| CVE-2026-8271 | 1 Dlink | 2 Dns-320, Dns-320 Firmware | 2026-10-26 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_dhcpd/cgi_upnp_add/cgi_upnp_edit of the file /cgi-bin/network_mgr.cgi. The manipulation leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-42893 | 1 Microsoft | 1 Outlook | 2026-10-26 | N/A | 7.4 HIGH |
| Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network. | |||||
| CVE-2026-44854 | 1 Arubanetworks | 2 Arubaos, Sd-wan | 2026-10-26 | N/A | 7.2 HIGH |
| Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user. | |||||
| CVE-2026-8273 | 1 Dlink | 2 Dns-320, Dns-320 Firmware | 2026-10-26 | 5.8 MEDIUM | 4.7 MEDIUM |
| A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely. | |||||
| CVE-2026-34259 | 2026-10-26 | N/A | 8.2 HIGH | ||
| Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability. | |||||
| CVE-2026-105134 | 1 Ahsay | 1 Cloud Backup Suite | 2026-10-26 | 10.0 HIGH | 10.0 CRITICAL |
| A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary. | |||||
| CVE-2026-116102 | 2026-10-26 | 7.5 HIGH | 6.3 MEDIUM | ||
| A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely. | |||||
| CVE-2026-116053 | 2026-10-26 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-44865 | 1 Arubanetworks | 2 Arubaos, Sd-wan | 2026-10-26 | N/A | 7.2 HIGH |
| Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | |||||
| CVE-2026-44872 | 1 Arubanetworks | 2 Arubaos, Sd-wan | 2026-10-26 | N/A | 7.2 HIGH |
| A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device. | |||||
| CVE-2026-40061 | 1 F5 | 1 Big-ip Domain Name System | 2026-10-26 | N/A | 8.7 HIGH |
| When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||