Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 7.2. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS2024, LTS2025, and LTS2026 releases, contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 respectively for the affected release lines.
Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.8 and several LTS releases contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and specific LTS releases contain an OS Command Injection vulnerability (CWE-78). This flaw allows a low privileged remote attacker to execute arbitrary OS commands. The vulnerability is rated high severity with a CVSS score of 8.8. Fixed versions include 8.9.0.0 or later and specific later LTS releases.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 depending on the release branch.
CVE-2026-102815 is an OS command injection vulnerability in the tmpServer service of TP-Link RE305 v3. The vulnerable service runs with root privileges and listens on the local loopback interface. A local attacker with low privileges on the device can exploit this flaw by submitting crafted requests to the TDDPv1 service to execute arbitrary commands with root privileges. This vulnerability allows privilege escalation from a low-privileged process to root on the affected device.
CVE-2026-102814 is an OS command injection vulnerability in the TP-Link RE305 v3 device's TDDP v2 service. The service uses a fixed and derivable cryptographic key, allowing an unauthenticated attacker on the same local network to forge protocol packets and access privileged operations. Exploitation can lead to arbitrary system command execution with root privileges.
Atlantis versions from 0.4.0 up to but not including 0.47.1 contain an OS command injection vulnerability. This flaw allows an authenticated contributor to inject shell metacharacters via the workspace name in atlantis.yaml, leading to arbitrary command execution as the Atlantis service account. External contributors can exploit this only if --allow-fork-prs is enabled. The vulnerability is fixed in version 0.47.1.
Adobe Campaign Classic contains an OS Command Injection vulnerability (CWE-78) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects version 0 of the product and has a critical severity rating with a CVSS score of 9.9. Exploitation changes the security scope and can lead to full compromise of confidentiality, integrity, and availability in the context of the current user.
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2.
CVE-2026-82119 is a critical OS Command Injection vulnerability affecting Hitachi HiRDB Server versions 9 and 10. The flaw allows unauthenticated attackers to execute arbitrary operating system commands remotely. Versions impacted include HiRDB Server 10 from 10-00 up to but not including 10-12-01, and multiple versions of HiRDB Server 9 and its variants. A fix is available in version 10-12-01.
CVE-2026-65213 is an OS command injection vulnerability in the SMCI MBD-X12SPI product. It allows an IPMI authenticated administrator to execute commands as the operating system root user on the Baseboard Management Controller (BMC). The vulnerability has a CVSS 3.1 score of 6.6, indicating a medium severity level. No public exploits or patches are currently documented.
CVE-2026-16521 is an OS command injection vulnerability in the SMCI MBD-X12STW-F product due to insufficient input filtering. An attacker with high privileges can inject malicious commands into a BMC function, which may execute upon restarting the related service. This vulnerability affects version 01.02.08 of the product and has a high severity rating with a CVSS score of 7.2.
CVE-2026-111461 is an OS command injection vulnerability in the Moxa OnCell G3150A-LTE Series devices. It occurs when the SMS management functionality is enabled and configured, allowing a remote attacker with required privileges to execute arbitrary commands due to insufficient input validation.
CVE-2026-111422 is a high-severity OS command injection vulnerability in Apache Airflow's SSH provider (apache-airflow-providers-ssh) versions 4.3.0 up to but not including 7.0.1. The issue arises because the SSHRemoteJobOperator improperly quotes the environment parameter, allowing shell syntax such as command substitution to be executed on the remote SSH host. This enables a user who can trigger a DAG but cannot author DAGs to execute arbitrary commands remotely as the SSH connection user. The vulnerability is fixed in version 7.0.1.
CVE-2026-116576 is an OS command injection vulnerability in the systeminformation Node.js library prior to version 5.33.16. The issue arises because the services() function improperly sanitizes input used in a PowerShell command filter on Windows, allowing crafted Unicode quotation marks to inject arbitrary PowerShell expressions. These expressions execute with the Node.js process permissions, potentially enabling unauthorized file access, data modification, or service disruption. The package itself does not expose a network service, so exploitation depends on an application forwarding attacker-controlled input to the vulnerable functions. The vulnerability is fixed in version 5.33.16.
CVE-2026-65184 is a critical OS command injection vulnerability in the Vertiv Avocent ACS8000 appliance. The root-privileged wsserver terminal-bridge daemon constructs shell commands directly from client-supplied WebSocket fields and executes them via system() and popen() calls without proper input sanitization. This allows an unauthenticated attacker to execute arbitrary commands with root privileges. The vulnerability affects versions from 0 up to and including 2.32.4. No patch information is currently available.
CVE-2026-59106 is a critical OS command injection vulnerability in the WolfProt interface of WolfVision Cynap Pure (Next Gen) and Cynap Bridge devices. It allows an unauthenticated attacker with network access to execute arbitrary operating system commands with the privileges of the affected application service due to insufficient neutralization of user input. The vulnerability affects versions prior to 2.00c for Cynap Pure (Next Gen) and prior to 1.78a and 1.72e for Cynap Bridge. Fixed versions are available.
A command injection vulnerability exists in pypa virtualenv versions 21.14.9 through 21.14.12. The bash bin/activate script improperly handles an attacker-controlled --prompt value, allowing unescaped dollar signs or backticks to be copied into the PS1 environment variable. When promptvars and POSIX mode are disabled, this can lead to command substitution and execution when the environment is activated or an interactive bash shell inherits PS1. This issue is fixed in version 21.14.13.