CWE-78: OS Command Injection vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

CVE-2026-81550 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It involves improper neutralization of special elements in OS commands, allowing a remote authenticated attacker to execute arbitrary code. This vulnerability can lead to full confidentiality, integrity, and availability compromise of the affected system.

CVE-2026-82095 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It involves improper neutralization of special elements in OS commands, allowing a remote authenticated attacker to execute arbitrary code. The vulnerability requires authentication and has no user interaction needed. It impacts confidentiality, integrity, and availability of the affected system.

CVE-2026-82098 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It involves improper neutralization of special elements used in OS commands, allowing a remote authenticated attacker to execute arbitrary commands on the affected system. This vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and there are no known exploits in the wild.

CVE-2026-82099 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It involves improper neutralization of special elements in OS commands, allowing a remote authenticated attacker to execute arbitrary code. This vulnerability affects confidentiality, integrity, and availability of the affected system.

CVE-2026-19136 is a high-severity OS command injection vulnerability in the Lenovo Tianxi AI Agent PC Application, distributed exclusively in the Chinese market. It allows a local user to execute arbitrary operating system commands by opening a specially crafted link handled by the application. The vulnerability affects versions from 0 up to but not including 4.2.1.8111. No official patch information is provided in the input data.

CVE-2026-65639 is a critical OS command injection vulnerability in the advanced-rule parser of ConfigServer Security & Firewall (CSF). It allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root due to insufficient validation of feed-supplied rule data. The vulnerability affects versions from 2.15 up to but not including 16.30. The issue has been fixed in version 16.30 by WebPros. No known exploits are reported in the wild.

CVE-2026-65638 is a critical OS command injection vulnerability in ConfigServer Security & Firewall (CSF) due to improper escaping of request URLs. This flaw allows unauthenticated remote attackers to execute arbitrary commands as the CSF service account. The vulnerability affects versions starting from 14.00 up to but not including 16.30. WebPros has fixed the issue in version 16.30. Other forks or independently maintained versions may also be vulnerable and require independent evaluation.

Dell ThinOS 10 versions prior to 2605_10.2616 contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability is critical with a CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability. No explicit patch link is provided, and the affected versions are all versions before 2605_10.2616. There are no known exploits in the wild at this time.

Dell ThinOS 10 versions prior to 2605_10.2616 contain an OS Command Injection vulnerability (CWE-78) that allows unauthenticated remote attackers to execute arbitrary commands. This critical vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-0302 is an OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud that allows a local user to execute arbitrary commands within Checkov processes. The vulnerability requires local access and user interaction, with low attack complexity and privileges. No known exploits are reported in the wild, and the severity is assessed as low.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.

GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.