CWE-78

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges du

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper n

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper n

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that ca

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChor

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific config

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of u

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authentica

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to r

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in gl

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the op

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAli

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm con

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to imprope

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to imprope

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to imprope

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command inj

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper

NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Cloud

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-contro

NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection.

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HT

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated atta

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/

When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iContro

An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects th

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an

Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with ex

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment

Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic expans

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of t

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config fil

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of gram

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to p

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to c

Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticat

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker

OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection v

OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist valida