CWE-78: OS Command Injection vulnerabilities

CVE-2026-82077 is a path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF. It allows an authenticated administrator to execute arbitrary commands on the underlying host by using crafted fax provider settings. The vulnerability affects multiple version ranges of PaperCut NG/MF. The CVSS 4.0 score is 7.3, indicating a high severity issue.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the affected application.

CVE-2026-82369 is an OS command injection vulnerability in Brocade SANnav's CLI scripting component. It allows authenticated users with command execution permissions to bypass command allow-lists and execute unauthorized shell commands on managed fabric switches. This can lead to full administrative access to the switches. The vulnerability affects all Brocade SANnav versions prior to 3.0.1a.

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0.

ManageEngine OpManager MSP versions 12.8.709 and below contain a critical remote code execution vulnerability in the Notification Profile module. This vulnerability is due to improper neutralization of special elements used in OS commands (CWE-78), allowing an attacker with limited privileges to execute arbitrary commands remotely. The flaw affects versions prior to 12.8.711 and has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

ManageEngine OpManager and Firewall Analyzer versions up to 12.8.709 contain a command injection vulnerability in the Diagnose Settings feature. This flaw allows improper neutralization of special elements used in OS commands, potentially enabling an attacker with limited privileges to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 8.8.

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.

CVE-2026-50227 is a vulnerability in Acer NitroSense V5 software (up to version 5.2.62) where an unauthenticated local attacker can connect to the MQTT broker via its localhost WebSocket endpoint. This allows invocation of exposed RPC functions, including child_process.execSync(), leading to arbitrary command execution within the application context.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. This vulnerability is resolved in OpenEye Apex version 3.4.3.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.