CVE-2026-87688 is a command injection vulnerability in the Brocade Fabric OS administrative management API's certificate management component. It occurs due to insufficient input sanitization of user-supplied certificate identifiers during certificate deletion operations. An authenticated attacker with certificate deletion privileges can exploit this flaw to execute arbitrary system commands with the management daemon's privileges. This affects Fabric OS versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The vulnerability has a high severity score of 8.5 CVSS v4.0.
CVE-2026-102133 is a command injection vulnerability in the Kiteworks Core product affecting an optional repository-connector feature. This flaw allows an authenticated system administrator to inject commands via a user-supplied path that is not properly neutralized before being passed to an external command. Successful exploitation could lead to arbitrary code execution under the service account running the connector, requiring network egress to an attacker-controlled system. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
CVE-2026-102827 is a command injection vulnerability in the steveukx git-js library prior to version 4.0.0. The issue arises because the default blockUnsafeOperationsPlugin does not properly handle unambiguous long-option abbreviations in Git commands, allowing attacker-controlled push arguments to bypass detection. This can lead to arbitrary command execution when git push is invoked with maliciously crafted arguments. The vulnerability is fixed in version 4.0.0.
CVE-2026-102826 is a command injection vulnerability in the simple-git library (git-js) prior to version 4.0.0. The vulnerability arises because the default blockUnsafeOperationsPlugin does not fully reject unsafe configuration includes supplied via customArgs to git.clone(), allowing attacker-controlled configuration files to be loaded. This can lead to execution of arbitrary commands with the privileges of the Node.js process running the application. The issue is fixed in version 4.0.0.
CVE-2026-101076 is a critical OS command injection vulnerability in Netcore NR289-GE version 1.4.5102. It affects the system function in the /set_ntp_server_ip.cgi CGI Handler component, allowing remote attackers to inject OS commands via the ntp_ip argument. Exploit code is publicly available, and the vendor has not responded to disclosure attempts.
CVE-2026-82370 is a high-severity unauthenticated remote command injection vulnerability in the Brocade SANnav orchestrator HTTP service. It allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and container management instructions. This could lead to unauthorized changes to Fibre Channel fabric switch configurations and manipulation of application container runtimes. The vulnerability affects Brocade SANnav versions before 3.0.1a.
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.
A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-78501 is a command injection vulnerability in Microsoft 365 Copilot's Business Chat. This flaw allows an unauthorized attacker to disclose information over a network by exploiting improper neutralization of special elements used in commands. The vulnerability has a high severity with a CVSS score of 8.6. Microsoft has issued an official fix for this cloud service vulnerability.
CVE-2026-85885 is a critical command injection vulnerability in Microsoft 365 Copilot. It involves improper neutralization of special elements used in commands, allowing an authorized attacker to elevate privileges over a network. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this cloud service vulnerability.
CVE-2026-55946 is a command injection vulnerability in Microsoft Copilot that allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.1, indicating a medium severity level. An official fix is available from Microsoft.
Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission on the specific instance can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod. Open registration or hosted free-trial access can make the required role broadly obtainable. Successful exploitation can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data. This issue is fixed in version 1.22.8.
CVE-2026-73454 is a command injection vulnerability in Arista Networks EOS affecting platforms with gRPC Network Security Interface (gNSI) Credentialz configured. A specially crafted request can cause unintended changes to account properties, potentially granting elevated privileges beyond intended administrative controls. The vulnerability is rated high severity with a CVSS score of 8.1. Multiple versions of EOS from 4.30.0F through 4.36.0.1F are affected. No explicit patch information is provided in the input data.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.
Dell ThinOS 10 versions prior to 2605_10.2616 contain a critical command injection vulnerability (CWE-77). This flaw allows an unauthenticated attacker with adjacent network access to execute arbitrary commands remotely, potentially leading to full system compromise. The vulnerability is identified as CVE-2026-81048 and has a CVSS score of 9.6, indicating high severity. Affected versions include all ThinOS 10 releases before 2605_10.2616. No explicit patch link is provided, so users should consult Dell for remediation details.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.