CWE-78: OS Command Injection vulnerabilities

CVE-2026-44099 is a high-severity OS command injection vulnerability in the Phoenix Contact CHARX SEC-3150 system configuration. It allows a low-privileged local user to escalate privileges and execute arbitrary commands as root, leading to full system compromise. Versions from 1.0.0 up to but not including 1.9.1 are affected. The issue is fixed in version 1.9.1.

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

CVE-2026-44096 is a privilege escalation vulnerability in the Phoenix Contact CHARX SEC-3150 device. It involves an OS command injection flaw in the udhcpc component that allows a local user named "charx-web" to execute arbitrary commands with root privileges, leading to full system compromise. The issue affects versions from 1.0.0 up to but not including 1.9.1. A fix is available in version 1.9.1. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.5.

CVE-2026-44095 is a privilege escalation vulnerability in the Phoenix Contact CHARX SEC-3150 device. It arises from an OS command injection flaw in a network configuration script, allowing a low-privileged local user to execute arbitrary commands as root. This can lead to full system compromise. The vulnerability affects versions from 1.0.0 up to but not including 1.9.1. A fix is available in version 1.9.1. The CVSS 4.0 score is 8.5, indicating high severity.

CVE-2026-44093 is a local privilege escalation vulnerability in the init-script for user applications on the Phoenix Contact CHARX SEC-3150 device. It allows a low-privileged local user to execute arbitrary commands as root, leading to full system compromise. The vulnerability is classified as CWE-78 (OS Command Injection). It affects versions 1.0.0 up to but not including 1.9.1. A fix is available in version 1.9.1. The CVSS 4.0 base score is 8.5, indicating high severity.

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 contain an OS command injection vulnerability due to unquoted shell interpolation. This flaw allows a remote authenticated attacker to execute arbitrary code on the affected system without user interaction. The vulnerability is classified as critical with a CVSS score of 9.1.

IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 contain a critical OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary code via shell command injection. This vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 9.1, indicating high impact on confidentiality, integrity, and availability.

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

NoteGen versions prior to 0.32.0 include a vulnerability where the Tauri shell plugin grants shell:allow-execute capability for bash, python, and python3 with arbitrary arguments by default. This allows JavaScript running in the application's webview to execute operating system commands with the privileges of the NoteGen process. If an attacker can execute scripts in the webview (e.g., via cross-site scripting), they can achieve full remote code execution on the user's machine.

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

Zohocorp ManageEngine ADAudit Plus versions before 8606 contain a critical vulnerability (CVE-2026-6516) that allows unauthenticated remote code execution via a vulnerable agent API. This is an OS command injection flaw (CWE-78) that can be exploited without any privileges or user interaction. The vulnerability has a maximum CVSS score of 10. No official patch or remediation guidance is currently provided by the vendor.

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0.