CWE-78
High likelihoodImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
6,220 vulnerabilities with CWE-78
CVE-2026-12943
CRITICAL
This Power Hardware Management Console update is being released to address
CVSS 9.8
CVE-2026-12940
CRITICAL
Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints
CVSS 9.8
CVE-2026-14522
HIGH
IBM App Connect Enterprise 12/13 - CRLF Command Execution
CVSS 8.8
CVE-2026-22622
HIGH
Eaton Padm < 20 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 8.8
CVE-2026-22621
HIGH
Eaton Padm < 20 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 8.3
CVE-2026-44106
HIGH
Phoenix Contact CHARX SEC < 1.9.1 - Local Privilege Escalation
CVSS 7.8
CVE-2026-44099
HIGH
Phoenix Contact CHARX SEC-3150 - Local Privilege Escalation via Pppd Password Injection
CVSS 7.8
CVE-2026-44098
HIGH
OS Command Injection in OCPP Agent via charge_box_id
CVSS 8.6
CVE-2026-44096
HIGH
Phoenix Contact CHARX SEC-3150 - Udhcpc Privilege Escalation
CVSS 7.8
CVE-2026-44095
HIGH
Phoenix Contact CHARX SEC-3150 - Local Privilege Escalation via Network Scripts
CVSS 7.8
CVE-2026-44093
HIGH
Phoenix Contact CHARX SEC < 1.9.1 - Local Privilege Escalation
CVSS 7.8
CVE-2026-16524
HIGH
Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
CVSS 7.8
CVE-2026-67438
MEDIUM
OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check
CVSS 6.6
CVE-2026-56389
MEDIUM
Arbitrary Command Execution in GNU Bison
CVE-2026-14959
CRITICAL
OS Command Injection in IBM Aspera Faspex
CVSS 9.1
CVE-2026-14958
CRITICAL
OS command injection in IBM Aspera Faspex
CVSS 9.1
CVE-2026-61376
HIGH
Elecom Co.,ltd. WAB-M1775-PS - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 7.2
CVE-2026-59764
HIGH
Elecom Co.,ltd. WRC-X3000GS3-B - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 7.2
CVE-2026-55578
HIGH
Pheditor 2.0.1-2.0.5 Terminal - Authenticated OS Command Injection
CVSS 8.8
CVE-2026-54540
HIGH
Authenticated terminal command whitelist bypass in Pheditor
CVSS 8.8
CVE-2026-48030
CRITICAL
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
CVSS 9.9
CVE-2026-24252
HIGH
Nvidia NeMo Framework - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 7.8
CVE-2026-16812
CRITICAL
KEV
VeloCloud Orchestrator OS Command Injection
CVSS 10.0
CVE-2026-59688
HIGH
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality
CVSS 8.4
CVE-2026-59687
HIGH
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
CVSS 8.4
Details
Vulnerabilities
6,220
Exploit Likelihood
High