CWE-78: OS Command Injection vulnerabilities

CVE-2026-19702 is an OS command injection vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair. It affects version 1.0.7 and allows improper neutralization of special elements used in OS commands. This vulnerability can lead to high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available.

CVE-2026-55673 is an OS command injection vulnerability in powsybl-core prior to version 7.2.2. It arises from insufficient escaping of command arguments and environment variables in UnixLocalCommandExecutor and WindowsLocalCommandExecutor, allowing attacker-controlled input to execute arbitrary shell commands as the JVM user. This affects multiple components including action-simulator, security-analysis, and dynamic-security-analysis, and can be exploited remotely via downstream tools and services that forward untrusted parameters. The issue is fixed in version 7.2.2.

JS Recon versions from 1.2.1-beta.1 up to but not including 1.3.1-beta.2 contain an OS command injection vulnerability in the PR Branch Checker GitHub Actions workflow. This flaw allows a remote attacker who opens a pull request to inject shell commands via specially crafted branch or fork names. The injected commands execute with the workflow's GITHUB_TOKEN permissions, which include write access to pull requests. The vulnerability is fixed starting with version 1.3.1-beta.2.

NUMail, a product by Green-Computing, has an OS Command Injection vulnerability (CWE-78) that allows unauthenticated remote attackers to inject and execute arbitrary OS commands on the server. This vulnerability is critical with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation. No affected versions or patches have been explicitly stated or provided. There are no known exploits in the wild at this time.

Xiiaozet LK100W devices have a vulnerability in their web-based management interface that allows authenticated attackers to perform OS command injection. This can lead to execution of arbitrary operating system commands with elevated privileges, risking unauthorized access to sensitive data or full device compromise. The vulnerability is identified as CVE-2026-78037 with a high severity score of 8.8. No patch or official remediation guidance is currently available.

CVE-2026-57499 is a critical OS command injection vulnerability in the Liman open source server management software core component. It affects versions prior to 2.2.2 - 1103. An authenticated administrator can exploit improper input validation in the log rotation configuration endpoint by injecting shell commands via the ip_address parameter, which is unsafely embedded in a shell command. This vulnerability allows arbitrary command execution on the Liman server. It has a high CVSS score of 9.1 and is fixed in version 2.2.2 - 1103.

Dell PowerProtect One versions 20.1.0.0 and earlier contain an OS Command Injection vulnerability (CWE-78) that allows a low privileged remote attacker to execute arbitrary code. This vulnerability has a high severity with a CVSS score of 8.8, indicating critical impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Dell PowerProtect One versions 20.1.0.0 and below contain an OS Command Injection vulnerability (CWE-78) that allows a low privileged remote attacker to execute arbitrary commands. This vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability if exploited.

Dell Cloud Disaster Recovery versions 20.2 and earlier contain an OS Command Injection vulnerability in the REST API. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

Dell Cloud Disaster Recovery versions 20.2 and earlier contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability has a critical severity with a CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-19042 is a command injection vulnerability in TeamViewer Full Client and Host for Linux versions 13.0, 14.0, and 15.0. It allows a remote attacker to execute arbitrary commands as the current user by sending a specially crafted URL through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link. The vulnerability has a high severity with a CVSS score of 8.8.

NVIDIA OpenShell for Linux has a vulnerability in its sandbox exec handler that allows OS command injection. Exploiting this flaw could enable an attacker to execute arbitrary code, disclose sensitive information, or tamper with data. The vulnerability has a medium severity rating with a CVSS score of 6.8. No affected versions or patches are explicitly stated in the available data.

NVIDIA NemoClaw for Linux has an OS command injection vulnerability in its status and logs plugin commands. This flaw could allow an attacker with local privileges to execute arbitrary OS commands, potentially leading to code execution, data tampering, information disclosure, and denial of service. The vulnerability is tracked as CVE-2026-65089 with a high severity rating and a CVSS score of 7.8. No patch or official remediation has been confirmed yet.

NVIDIA NemoClaw for Linux has an OS command injection vulnerability in its NIM management component. This flaw allows an attacker with local privileges to execute arbitrary OS commands, potentially leading to code execution, data tampering, information disclosure, and denial of service. The vulnerability is rated high severity with a CVSS score of 7.8. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

NVIDIA NemoClaw for Linux has a vulnerability in its command-line interface that allows OS command injection. Exploiting this flaw could enable attackers to execute arbitrary code, tamper with data, disclose sensitive information, or cause denial of service. The vulnerability is identified as CVE-2026-65099 with a high severity score of 7.8. No specific affected versions or patches have been disclosed yet.

NVIDIA NemoClaw for Linux has an OS command injection vulnerability in its Telegram bridge component. This flaw could allow an attacker with limited privileges to execute arbitrary OS commands, potentially leading to code execution, privilege escalation, information disclosure, and data tampering. The vulnerability is tracked as CVE-2026-65096 and has a high severity rating with a CVSS score of 7.8. No patch or official remediation guidance has been provided yet. There are no known exploits in the wild at this time.

CVE-2026-65091 is a high-severity OS command injection vulnerability in NVIDIA OpenShell affecting all platforms. A malicious gateway could exploit this flaw to execute arbitrary OS commands, potentially leading to code execution, data tampering, and information disclosure. There is no confirmed patch or official remediation available at this time.

Adobe Campaign Classic (ACC) contains an OS Command Injection vulnerability (CVE-2026-76197) that allows an attacker to execute arbitrary code with the privileges of the current user. This vulnerability does not require user interaction and has a changed scope, indicating a broader impact. The vulnerability is rated critical with a CVSS score of 10. No patch or remediation information is currently available.

Adobe Campaign Classic contains an OS Command Injection vulnerability (CWE-78) that allows an attacker to execute arbitrary code with the privileges of the current user. This vulnerability does not require user interaction and affects the scope of the application. The CVSS score is 10.0, indicating critical severity.