CWE-78
High likelihoodImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
6,223 vulnerabilities with CWE-78
CVE-2026-54686
MEDIUM
Warp: DCS lifecycle hook spoofing can alter terminal session metadata
CVSS 4.3
CVE-2026-48732
HIGH
Warp: Remote SSH cwd can lead to unauthorized remote command execution
CVSS 8.8
CVE-2026-48731
HIGH
Warp: Linux external editor command injection
CVSS 7.8
CVE-2026-48719
HIGH
Warp branch selector command injection via Git branch names
CVSS 8.0
CVE-2026-48703
HIGH
Warp: Command Injection via Warp code search tool arguments
CVSS 7.8
CVE-2026-57282
MEDIUM
Jenkins Git Client Plugin < 6.6.0 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 5.0
CVE-2026-12537
HIGH
Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
CVSS 7.8
CVE-2026-12851
CRITICAL
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
CVSS 9.1
CVE-2026-12850
CRITICAL
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
CVSS 9.1
CVE-2026-12849
CRITICAL
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
CVSS 9.1
CVE-2026-12486
CRITICAL
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability
CVSS 9.1
CVE-2026-55249
MEDIUM
@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String
CVSS 6.3
CVE-2026-49402
HIGH
Deno: Command Injection via spawnSync & spawn on Windows
CVSS 8.1
CVE-2026-35018
HIGH
NetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection
CVSS 8.8
CVE-2026-56379
HIGH
ImageMagick - Command Injection via SVG Decoder
CVSS 8.1
CVE-2026-56274
CRITICAL
Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
CVSS 9.9
CVE-2026-11834
HIGH
Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
CVE-2026-12815
MEDIUM
coollabsio coolify Image Name os command injection
CVSS 6.3
CVE-2026-12814
MEDIUM
Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
CVSS 6.3
CVE-2026-48787
HIGH
gin-vue-admin vulnerable to RCE
CVE-2026-49260
HIGH
PhpWeasyPrint < 2.5.1 - WeasyPrint Binary Path Command Injection
CVSS 8.2
CVE-2026-12104
HIGH
SIMA Bondix Server - Authenticated OS Command Injection in Bondix
CVE-2026-40456
HIGH
LMS < 9fcb4de IP Address Parameter - OS Command Injection
CVE-2026-48997
HIGH
e107: Command Injection via shell expansion in ImageMagick resize destination path
CVSS 7.1
CVE-2026-20266
CRITICAL
OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit
CVSS 9.1
Details
Vulnerabilities
6,223
Exploit Likelihood
High