CWE-77

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in truste

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPad

Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publis

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected de

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigat

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigati

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Com

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk usin

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, se

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, wh

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name`

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Executio

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/wind

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runti

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), a

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable

An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M

Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A

Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A

Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A

Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widg

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code exec

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. Thi

A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged u

Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote

Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apc

Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apc

Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the re

RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.

Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the for

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",whi

Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers

Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str vari

Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.

A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-g

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This

A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untru

A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute ar

A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate pr

A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate pri

In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow

An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in