CWE-78
High likelihoodImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
6,223 vulnerabilities with CWE-78
CVE-2026-34106
CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php
CVSS 9.8
CVE-2026-50043
HIGH
Seiko Solutions Inc. SkyBridge MB-A100/MB-A110 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 7.2
CVE-2026-56700
CRITICAL
Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection
CVSS 9.8
CVE-2026-56415
CRITICAL
OS Command Injection in StoneFly Storage Concentrator
CVSS 10.0
CVE-2026-56413
CRITICAL
OS Command Injection in StoneFly Storage Concentrator
CVSS 10.0
CVE-2026-27957
HIGH
Coolify: Authenticated RCE via command injection in CA certificate management feature
CVSS 8.8
CVE-2026-27955
MEDIUM
Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`
CVSS 6.6
CVE-2026-56808
HIGH
Avtech Security Corporation DGM3103SCT - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 7.2
CVE-2026-56137
HIGH
Gotcha Gotcha Games Inc. Rpg Maker MV - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 7.8
CVE-2026-34597
HIGH
Coolify: Authenticated Host RCE
CVSS 8.8
CVE-2026-34594
HIGH
Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management
CVSS 8.8
CVE-2026-58000
HIGH
luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey
CVSS 8.8
CVE-2026-57999
HIGH
luci-app-tailscale-community - Command Injection via tailscale.do_login RPC
CVSS 8.8
CVE-2026-13581
MEDIUM
Edimax EW-7478APC POST Request formStaDrvSetup os command injection
CVSS 6.3
CVE-2026-55607
HIGH
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
CVSS 8.8
CVE-2026-13561
MEDIUM
Edimax EW-7478APC POST Request formiNICbasic os command injection
CVSS 6.3
CVE-2026-13560
MEDIUM
Edimax EW-7478APC POST Request formAccept os command injection
CVSS 6.3
CVE-2026-13545
HIGH
D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection
CVSS 8.8
CVE-2026-55975
HIGH
H.VIEW HV-500S6 IP Camera OS Command Injection
CVSS 7.2
CVE-2026-49869
CRITICAL
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
CVSS 10.0
CVE-2026-48800
HIGH
Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection
CVSS 7.8
CVE-2026-48778
HIGH
Notepad++ 8.9.6 - Arbitrary Code Execution
CVSS 7.8
CVE-2026-32833
HIGH
Cudy LT300 3.0 OS Command Injection via NTP Configuration
CVSS 8.8
CVE-2026-55448
MEDIUM
mise: Local credential_command executes untrusted config
CVSS 6.3
CVE-2026-55441
HIGH
mise: Arbitrary command execution via task-include files in an untrusted, config-less repository
CVSS 8.6
Details
Vulnerabilities
6,223
Exploit Likelihood
High