CVE-2026-83948 is a command injection vulnerability in Microsoft Azure CLI that allows an authorized attacker to execute arbitrary code over a network. The flaw arises from improper neutralization of special elements used in commands. This vulnerability affects Microsoft Azure CLI versions 1.0.0 and all versions from 1.0.0 up to but not including 2.2.1. A fix is available in version 2.2.1.
CVE-2026-81380 is a command injection vulnerability in Microsoft Visual Studio Code and GitHub Copilot. It arises from improper neutralization of special elements used in commands, allowing unauthorized attackers to disclose information over a network. The issue affects Visual Studio Code versions from 1.0.0 up to but not including 1.136.2. A fix is available in version 1.136.2. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-69534 is a command injection vulnerability in the Windows Program Compatibility Assistant Service affecting Windows 10 Version 1607 and later builds up to specified fixed versions. It allows an authorized local attacker to elevate privileges by exploiting improper neutralization of special elements used in commands. The vulnerability has a high severity with a CVSS score of 7.8 and has been officially fixed in multiple Windows 10 builds.
A command injection vulnerability exists in stefanzweifel laravel-backup-restore prior to version 1.9.4. This flaw allows a crafted backup archive to execute arbitrary OS commands during the database restore process. The issue has been fixed in version 1.9.4.
Dell SmartFabric OS10 versions prior to 10.5.6.14 contain a command injection vulnerability (CWE-77) that allows a high privileged remote attacker to execute commands. This vulnerability is due to improper neutralization of special elements used in commands. The issue is fixed in version 10.5.6.14.
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
A command injection vulnerability exists in the 'advanced/curl' component of Osbil Technology oPanel version 1.19.50 and earlier. Authenticated attackers can exploit this flaw by supplying malicious input to the 'url' parameter, enabling arbitrary shell command execution. This vulnerability has a high severity rating with a CVSS score of 8.1. No official patch or remediation information is currently provided.
NVIDIA Unified Fabric Manager Enterprise - GA contains a command injection vulnerability in the IBDiagnet API. An authenticated attacker with administrative privileges can exploit this flaw by sending crafted API requests. Successful exploitation may result in code execution, privilege escalation, and information disclosure. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level. No affected versions or patch information are provided in the available data.
NVIDIA Unified Fabric Manager Enterprise - GA contains a command injection vulnerability in its user management component. An authenticated administrator can exploit this by sending a crafted API request, potentially leading to code execution, privilege escalation, and information disclosure. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No affected versions or patches are explicitly stated in the available data.
NVIDIA Unified Fabric Manager Enterprise - GA contains a command injection vulnerability in its plugin management API. An authenticated user with low privileges can send a specially crafted API request to inject code. Successful exploitation could lead to code execution, privilege escalation, and information disclosure. The vulnerability has a high severity score of 8. No patch or official remediation has been confirmed yet.
CVE-2026-61400 is a command injection vulnerability in Apache CloudStack affecting the run and get diagnostics functionality for system VMs and virtual routers. Authenticated users with admin permissions on the getDiagnosticsData or runDiagnostics APIs can execute arbitrary commands as root or diagnostics-process user. This allows full compromise of affected instances and potential lateral movement within the CloudStack infrastructure. The vulnerability affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the issue.
CVE-2026-54449 is a command injection vulnerability in LangBot versions 4.10.7 and earlier. Authenticated users can modify the STDIO MCP server configuration without proper authorization, allowing them to execute arbitrary commands on the server with LangBot service privileges. This can lead to data disclosure, modification, and service disruption. No fixed version is currently available.
aiosmtplib versions prior to 5.1.1 contain a command injection vulnerability in several SMTP methods that accept caller-supplied addresses. These methods do not reject embedded carriage return (CR) or line feed (LF) characters, allowing attackers to inject additional SMTP commands. This can lead to desynchronization of the SMTP command-response pipeline, hanging the SMTP instance, or sending arbitrary messages without control of the SMTP server. The issue is fixed in version 5.1.1.
CVE-2026-24301 is a command injection vulnerability in Microsoft Copilot Web that allows an unauthorized attacker to execute commands leading to information disclosure over a network. The vulnerability is rated high severity with a CVSS score of 8.8. An official fix is available from Microsoft.
CVE-2026-75052 is a command injection vulnerability in JetBrains IntelliJ IDEA versions before 2026.2.1. It allows command execution via crafted Markdown preview content in trusted projects. The vulnerability has a low CVSS score of 3.6 and was fixed in version 2026.2.1.
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 have a vulnerability in the managesieve plugin where improper quoting of rule names allows bypassing the managesieve_disabled_actions setting. This issue affects the integrity of the system but does not impact confidentiality or availability. The vulnerability has a moderate severity score of 4.3. No official patch or remediation details are currently provided.
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability involving mail search and LITERAL+ byte-count desynchronization. This flaw can lead to information disclosure or privilege escalation through IMAP command injection.
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain an LDAP search filter injection vulnerability via unescaped %u/%fu/%d substitutions. This flaw can lead to information disclosure or privilege escalation. The vulnerability is tracked as CVE-2026-75007 with a CVSS score of 8.8, indicating high severity. Multiple specific older versions are affected. No explicit patch links are provided in the data, so patch status is not confirmed here.