CWE-77: Command Injection vulnerabilities

CVE-2026-75007 is a command injection vulnerability in Roundcube Webmail versions before 1.6.18 and 1.7.3. The flaw arises from improper neutralization of special elements in the LDAP search filter due to unescaped %u/%fu/%d substitutions. This vulnerability can lead to information disclosure or privilege escalation. It has a medium severity rating with a CVSS score of 5.4. Fixed versions 1.6.18 and 1.7.3 are available.

CVE-2026-75004 is a command injection vulnerability in Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3. It arises from improper quoting of rule names in the managesieve plugin, allowing bypass of the managesieve_disabled_actions setting via crafted Sieve script rule names. This issue affects only Roundcube instances using the managesieve plugin.

CVE-2026-75002 is a command injection vulnerability in Roundcube Webmail versions before 1.6.18 and 1.7.3. It arises from improper neutralization of special elements in IMAP commands related to mail search and LITERAL+ byte-count desynchronization. This flaw can lead to information disclosure or privilege escalation.

CVE-2026-50523 is a command injection vulnerability in Microsoft PowerShell 7.4 that allows an authorized attacker to execute arbitrary code locally by exploiting improper neutralization of special command elements. The flaw affects multiple versions of PowerShell 7.4, 7.5, and 7.6 prior to their respective fixed releases. This vulnerability has a high severity rating with a CVSS score of 7.8. An official fix is available in PowerShell versions 7.4.19.0, 7.5.10.0, and 7.6.5.

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

The Backup Migration plugin for WordPress contains a command injection vulnerability in all versions up to and including 2.1.5.1. This flaw arises from improper sanitization of the 'file' POST parameter in the restoreBackup() AJAX handler, allowing authenticated users with administrator or equivalent privileges to execute arbitrary OS commands as the web-server user. This vulnerability bypasses WordPress hardening constants that normally restrict code execution from the admin UI. It is a partial regression of a previous vulnerability (CVE-2023-7002) where similar mitigations were not applied consistently.

A critical vulnerability exists in dnsmgr version 2.15 and earlier that allows a local attacker to execute arbitrary code via the ping function in the CheckUils.php file. The vulnerability is identified as CVE-2026-35847 and has a CVSS score of 9.8, indicating high severity with network attack vector and no required privileges or user interaction.

CVE-2026-7849 is a critical command injection vulnerability in Phoenix Contact's CHARX SEC-3150 device. An unauthenticated remote attacker can inject commands into the system configuration, which are executed with root privileges. This flaw affects versions 1.0.0 up to but not including 1.9.1. The issue is fixed in version 1.9.1.

A critical injection vulnerability (CVE-2026-54680) exists in kube-logging logging-operator versions prior to 6.6.0. The Fluentd configuration renderer writes certain CRD strings directly into configuration files without proper escaping, allowing an attacker with permission to create Flow resources to inject malicious Fluentd <match **> blocks. This can lead to arbitrary command execution within the Fluentd aggregator. The issue is resolved in version 6.6.0.

CVE-2026-47708 is a critical command injection vulnerability in SepineTam's MCP-for-Stata (stata-mcp) prior to version 1.17.3. The vulnerability arises because the log_file_name parameter in the stata_do API and CLI is directly interpolated into Stata command strings without proper sanitization. This allows an attacker to inject arbitrary Stata commands, including potentially dangerous commands like shell or python execution, by crafting malicious input containing special characters. The issue is patched in version 1.17.3.

A command injection vulnerability (CWE-77) in MeltanoHub prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 allowed exfiltration of the GITHUB_TOKEN with write permissions via a vulnerable GitHub Actions workflow using pull_request_target. This workflow runs with base repository context and access to secrets. The issue is fixed in the specified commit. No known workarounds are available.

A vulnerability in libssh allows a malicious username expanded through %r in ProxyCommand handling to inject shell metacharacters. This can expose environment variables and cause unintended shell behavior. The flaw has a low CVSS score of 3.9 and requires local access with low privileges and user interaction. Red Hat has issued an update for Red Hat Hardened Images RPMs to address this issue.