The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.
CVE-2026-94586 is a command injection vulnerability in the WebTools administrative interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated user with configuration download permissions can exploit this flaw to execute arbitrary shell commands with root privileges on the switch. The vulnerability has a high severity rating with a CVSS score of 8.5.
CVE-2026-94581 is an OS command injection vulnerability in the REST API management interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated attacker with high privileges who can configure SSH known host settings may execute arbitrary system commands with root permissions by supplying crafted parameters containing shell metacharacters.
CVE-2026-87662 is an OS command injection vulnerability in Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The flaw arises from unsanitized parameter strings used in processing upgrade requests, allowing attackers to execute arbitrary shell commands with elevated privileges of the firmware management daemon.
CVE-2026-87666 is an OS command injection vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. It occurs in the time and zone management subsystem when updating system timezone settings via the REST API or configuration download routines. The system fails to properly sanitize input, allowing an authenticated low-privilege administrative user to execute arbitrary shell commands with elevated privileges by submitting crafted timezone strings containing shell metacharacters.
CVE-2026-87675 is an OS command injection vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and from 10.0.0 through 10.0.0a1. It occurs in the configuration management subsystem during configuration download operations, where user-supplied input is passed unsanitized to an internal utility script. This allows execution of arbitrary OS commands on the affected switch when an administrator initiates the configuration download.
CVE-2026-87674 is a local privilege escalation vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and from 10.0.0 through 10.0.0a1. The flaw arises from insufficient access controls on internal IPC channels in the system logging daemon, allowing unprivileged local users to submit malformed logging configurations. Improper input sanitization during configuration file generation enables injection of arbitrary directives that execute with elevated privileges when the logging service reloads.
CVE-2026-87673 is an OS command injection vulnerability in Brocade Fabric OS maintenance command-line diagnostic utilities. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The vulnerability arises because the binary does not properly sanitize user input when invoking system commands via a shell interpreter. A privileged user with maintenance account access can exploit this flaw to execute arbitrary OS commands with root privileges.
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.
A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.
CVE-2026-107202 is a critical OS command injection vulnerability in the jonssonyan h-ui administrative API version 0.0.25 and below. It arises from improper validation of the listen configuration field, allowing an authenticated administrator to inject arbitrary OS commands with root privileges. The vulnerability occurs because the application uses unvalidated input to construct nftables/iptables rules executed via bash -c as root.
CVE-2026-102256 is a high-severity vulnerability in the SonicWall SMA1000 appliance involving improper neutralization of special elements in OS commands. This post-authentication flaw could allow a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands, leading to remote code execution. The vulnerability requires authentication and low attack complexity. No specific affected versions or patch information is provided.
CVE-2026-102160 is an OS command injection vulnerability in Arista Networks CloudVision CUE backup management. It allows an authenticated Super User to submit a crafted backup request that could execute arbitrary OS commands with the privileges of the affected service. The vulnerability affects versions from 2021.2.0 through 2026.2.0 inclusive. The CVSS 3.1 base score is 7.2, indicating a high severity level. No public exploits are known, and no vendor patch information is provided in the input data.
Dell OpenManage Integration with Microsoft Windows Admin Center versions prior to 3.7.0 contains an OS Command Injection vulnerability (CWE-78). This flaw allows a low privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input keyevent`. The adb client joins the arguments into a remote command string that the Android shell reparses, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. Exploitation requires a valid UFO_MCP_API_KEY, adb on the host, and a reachable authorized device, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.9.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10.