CWE-78
High likelihoodImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
5,964 vulnerabilities with CWE-78
CVE-2026-30861
CRITICAL
WeKnora 0.2.5-0.2.9 - Unauthenticated Remote Code Execution via MCP stdio Configuration Validation Bypass
CVSS 9.9
CVE-2026-25070
CRITICAL
XikeStor SKS8310-8X <1.04.B07 - Command Injection
CVSS 9.8
CVE-2026-29783
HIGH
GitHub Copilot CLI <=0.0.422 - Code Injection
CVSS 7.8
CVE-2026-29058
CRITICAL
AVideo < 7.0 - Unauthenticated OS Command Injection via base64Url GET Parameter
CVSS 9.8
CVE-2026-28507
HIGH
Idno <1.6.4 - Remote Code Execution
CVSS 7.2
CVE-2026-28470
CRITICAL
OpenClaw <2026.2.2 - Command Injection
CVSS 9.8
CVE-2026-28463
HIGH
OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Exec-Approval Allowlist
CVSS 8.4
CVE-2026-28391
CRITICAL
OpenClaw <2026.2.2 - Command Injection
CVSS 9.8
CVE-2026-28287
HIGH
FreePBX 16.0.17.2-16.0.19 & 17.0.2.4-17.0.4 - Command Injection
CVSS 8.8
CVE-2026-28209
HIGH
FreePBX 16.0.17.2-16.0.19 & 17.0.2.4-17.0.4 - Command Injection
CVSS 7.2
CVE-2026-20008
MEDIUM
Cisco ASA 9.12.1-9.16.4.85 & FTD 6.4.0-7.0.9 Authenticated OS Command Injection via Lua CLI
CVSS 6.0
CVE-2026-26478
CRITICAL
Mobvoi Tichome Mini - Command Injection
CVSS 9.8
CVE-2026-27441
CRITICAL
SEPPmail Secure Email Gateway <15.0.1 - Command Injection
CVSS 9.8
CVE-2026-28774
HIGH
IDC SFX Series SuperFlex 101 - Command Injection
CVSS 8.8
CVE-2026-28773
HIGH
IDC SFX Series 101 - Command Injection
CVSS 8.8
CVE-2026-26279
CRITICAL
froxlor < 2.3.4 - Authenticated Remote Code Execution via Email Validation Bypass
CVSS 9.1
CVE-2026-3485
CRITICAL
D-Link DIR-868L 110b03 - Command Injection
CVSS 9.8
CVE-2026-0654
HIGH
TP-Link Deco BE25 v1.0-1.1.1 - Command Injection
CVSS 8.0
CVE-2026-24101
CRITICAL
Tenda AC15V1.0 V15.03.05.18 - Command Injection
CVSS 9.8
CVE-2026-28517
CRITICAL
openDCIM < 23.04 - OS Command Injection via fac_Config.dot Parameter
CVSS 9.8
CVE-2026-28417
MEDIUM
Vim < 9.2.0073 - OS Command Injection via netrw Plugin SCP URL Handler
CVSS 4.4
CVE-2026-28409
CRITICAL
WeGIA < 3.6.5 - Authenticated Remote Code Execution via Database Restore Filename
CVSS 10.0
CVE-2026-21654
CRITICAL
Johnson Controls Frick Controls Quantum HD <=10.22 - Command Injection
CVSS 9.8
CVE-2026-0980
HIGH
rubyipmi < 0.13.0 - Authenticated Remote Code Execution via BMC Username Injection
CVSS 8.3
CVE-2026-3301
CRITICAL
Totolink N300RH 6.1c.1353_B20190305 - Command Injection
CVSS 9.8
Details
Vulnerabilities
5,964
Exploit Likelihood
High