CWE-78
High likelihoodImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
5,944 vulnerabilities with CWE-78
CVE-2026-48723
HIGH
BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json
CVSS 7.8
CVE-2026-9863
HIGH
Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability
CVSS 7.5
CVE-2026-9862
CRITICAL
Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
CVSS 9.8
CVE-2026-11527
HIGH
Perl Config::IniFiles < 3.001000 - OS Command Injection via -file 2-Arg open()
CVSS 8.6
CVE-2026-11526
CRITICAL
Perl GD < 2.86 - OS Command Injection via 2-Arg open()
CVSS 9.8
CVE-2026-46716
CRITICAL
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
CVSS 9.9
CVE-2026-42853
MEDIUM
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
CVSS 6.5
CVE-2026-48165
HIGH
MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
CVSS 8.0
CVE-2026-48163
HIGH
MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
CVSS 8.0
CVE-2026-44170
MEDIUM
MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
CVE-2026-44168
HIGH
MariaDB: wsrep SST unsafe parameter handling on the donor side
CVSS 8.0
CVE-2026-11845
HIGH
IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection
CVSS 7.2
CVE-2026-42846
CRITICAL
ClipBucket: Remote Play URL Command Injection
CVSS 9.8
CVE-2026-45172
HIGH
Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command
CVE-2026-48547
HIGH
KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml
CVSS 7.3
CVE-2026-49261
CRITICAL
MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
CVSS 10.0
CVE-2026-49219
MEDIUM
ImageMagick: Policy Bypass can read disallowed files
CVSS 5.5
CVE-2026-42563
HIGH
Dulwich Vulnerable to Command Injection via Merge Driver Path
CVE-2026-0273
MEDIUM
Palo Alto Networks Cloud Ngfw - Command Injection
CVE-2026-6893
HIGH
Dracut: dracut: root code execution via dhcp options command injection
CVSS 8.8
CVE-2026-46643
HIGH
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
CVE-2026-9151
HIGH
TP-Link Archer OpenVPN - Adjacent Authenticated OS Command Injection
CVE-2026-46618
MEDIUM
Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
CVE-2026-11417
HIGH
Aws Cloud Development Kit Library < 2.245.0 - Command Injection
CVSS 7.3
CVE-2026-45564
HIGH
Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)
CVSS 8.8
Details
Vulnerabilities
5,944
Exploit Likelihood
High