CWE-78: OS Command Injection vulnerabilities

CVE-2026-18264 is a high-severity OS command injection vulnerability in NoMachine version 9.7.3. It affects the web service listening on TCP port 4000, where improper validation of user input allows authenticated remote attackers to execute arbitrary code with the service account's privileges.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable.

CVE-2026-61898 is an OS command injection vulnerability in Canonical's accountsservice affecting certain Ubuntu-specific language helper scripts. The vulnerability arises because these scripts treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input and interpolate it unescaped into a GNU sed replacement expression. This allows an attacker to inject arbitrary shell commands executed with root privileges via the SetLanguage D-Bus method. The issue affects multiple specific versions of accountsservice prior to 23.13.9-8ubuntu7. The vulnerability has a high severity score of 7.8 CVSS v3.1.

CVE-2026-18482 is a critical OS command injection vulnerability in Klarso GmbH's neo-mjs product. The flaw exists in the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the functions checkSyntax() and runPlaywrightTest() unsafely interpolate user-controlled absolutePath values into shell commands. This allows an attacker to execute arbitrary operating system commands if an AI agent is tricked into invoking these functions. The vulnerability is fixed in commit 88c77fc.

CVE-2026-75616 is an OS command injection vulnerability in the web management interface of TP-Link Archer C20 v6 firmware. It affects certain WAN-related configuration operations and requires authenticated administrator access. Exploitation allows execution of arbitrary system commands with elevated privileges, potentially leading to full device compromise and impacting confidentiality, integrity, and availability of the device and network traffic.

CVE-2026-53545 is a critical OS command injection vulnerability in Termix, a web-based server management platform. The flaw exists in versions prior to 2.3.2 in the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint, where user-controlled input is improperly sanitized and interpolated into shell commands. An authenticated user able to edit tunnel host fields can inject arbitrary shell commands that execute with the privileges of the connected SSH account when the tunnel disconnects. This allows remote command execution on the source SSH host. The issue is fixed in Termix version 2.3.2.

CVE-2026-53542 is an OS command injection vulnerability in Termix-SSH's Termix platform prior to version 2.3.2. The flaw exists in the archive creation endpoint where file basenames are passed to the tar command without proper sanitization or an end-of-options marker. This allows an attacker with SSH file-manager access to craft filenames that are interpreted as tar options, leading to arbitrary command execution with the privileges of the SSH user. The vulnerability is fixed in version 2.3.2.

CVE-2026-16882 is a critical OS command injection vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw allows a remote attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No vendor patch or remediation information is provided in the available data.

CVE-2026-16875 is a high severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows a local attacker to execute arbitrary OS commands due to improper neutralization of special elements (shell metacharacter injection). This vulnerability does not require user interaction and can lead to full confidentiality, integrity, and availability compromise.

CVE-2026-16865 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper neutralization of special elements in OS commands, leading to OS command injection. This flaw could allow a remote attacker to execute arbitrary code without privileges or user interaction.

CVE-2026-16848 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows remote attackers to execute arbitrary OS commands. This occurs due to improper neutralization of shell metacharacters in DHCP options, leading to OS command injection.

CVE-2026-16844 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows remote attackers to execute arbitrary OS commands. This occurs due to improper neutralization of special elements in OS commands, classified as CWE-78 OS Command Injection.

CVE-2026-16842 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows remote attackers to execute arbitrary OS commands. This occurs due to improper neutralization of special elements in OS commands, classified as CWE-78 OS Command Injection. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-68560 is an OS command injection vulnerability in Wekan versions prior to 9.75. The vulnerability arises from unsafe interpolation of uploaded file paths into an administrator-configured external command line, which is executed via a shell. Authenticated users able to upload attachments could exploit this to execute arbitrary commands as the Wekan server process. This issue is fixed in version 9.75 by properly quoting the file path to prevent shell metacharacter injection.

CVE-2026-16816 is a critical OS command injection vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

Dell RecoverPoint for Virtual Machines versions prior to 6.1 contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high-privileged remote attacker to execute arbitrary commands on the affected system without user interaction. The vulnerability is rated high severity with a CVSS score of 7.2.

CVE-2026-15068 is a critical OS command injection vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1 NIM. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands.

CVE-2026-49255 is an OS command injection vulnerability in electerm prior to version 3.11.11. The vulnerability arises because electerm interpolates untrusted file paths into system commands such as rmrf(), mv(), and cp() without proper sanitization. A malicious SSH or SFTP server can supply crafted filenames containing shell metacharacters, leading to arbitrary command execution with the user's privileges on both POSIX and Windows systems. This can result in data exfiltration, file modification, malware installation, or denial of service. The issue is fixed in electerm version 3.11.11.

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability is identified as CVE-2026-54796 and has a CVSS score of 7.2, indicating high severity.