Total
4005 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-19346 | 2026-10-23 | 9.0 HIGH | 8.8 HIGH | ||
| A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-69718 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-10-23 | N/A | 7.8 HIGH |
| Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-47285 | 1 Microsoft | 1 Visual Studio Code | 2026-10-23 | N/A | 6.5 MEDIUM |
| Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-72913 | 2026-10-23 | N/A | N/A | ||
| Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2. | |||||
| CVE-2026-47299 | 1 Microsoft | 1 Azure Monitor Agent | 2026-10-23 | N/A | 7.2 HIGH |
| Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-75011 | 2026-10-23 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-75052 | 1 Jetbrains | 1 Intellij Idea | 2026-10-23 | N/A | 3.6 LOW |
| In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects | |||||
| CVE-2026-113390 | 2026-10-22 | 9.0 HIGH | 9.9 CRITICAL | ||
| A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2026-112370 | 2026-10-22 | 9.0 HIGH | 9.9 CRITICAL | ||
| A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-53533 | 2026-10-22 | N/A | N/A | ||
| aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an attacker who influences an envelope sender or recipient to inject commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. SMTP.sendmail() and SMTP.send() without a Message object pass addresses through the affected methods, while SMTP.send_message() is not affected. Successful injection can desynchronize the command-response pipeline, hang the SMTP instance, or send an arbitrary message without requiring attacker control of the SMTP server. This issue is fixed in version 5.1.1. | |||||
| CVE-2026-75094 | 2026-10-22 | 8.3 HIGH | 9.1 CRITICAL | ||
| A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. | |||||
| CVE-2026-24301 | 1 Microsoft | 1 Copilot | 2026-10-22 | N/A | 8.8 HIGH |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-75985 | 2026-10-22 | 6.5 MEDIUM | 7.4 HIGH | ||
| A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipulation of the argument wan_type causes command injection. The attack may be initiated remotely. The exploit has been published and may be used. | |||||
| CVE-2026-75984 | 2026-10-22 | 6.5 MEDIUM | 7.4 HIGH | ||
| A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used. | |||||
| CVE-2026-112942 | 2026-10-21 | N/A | N/A | ||
| launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2. | |||||
| CVE-2026-55453 | 1 Openprinting | 1 Cups | 2026-10-20 | N/A | 3.3 LOW |
| OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20. | |||||
| CVE-2026-43836 | 2026-10-20 | N/A | N/A | ||
| A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. | |||||
| CVE-2026-43850 | 2026-10-20 | N/A | N/A | ||
| A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. | |||||
| CVE-2026-113506 | 2026-10-20 | 9.0 HIGH | 9.9 CRITICAL | ||
| A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication." | |||||
| CVE-2026-113396 | 2026-10-20 | 6.5 MEDIUM | 7.4 HIGH | ||
| A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer. | |||||