CWE-78

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection M

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection M

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection M

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Do

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default se

The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with repl

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with ar

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could al

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This iss

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbi

Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary c

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such a

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz")

ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "

An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/

Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in D

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exist

OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecure

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` functi

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of a

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remot

OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One B

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login han

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The

FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integr

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integra

An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allo

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows atta

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation pro

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insuf

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the list

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbi

Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versi