Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment.
mdserver-web versions 0.18.0 through 0.18.4 contain an unauthenticated remote command execution vulnerability. The issue arises from lack of authentication on the /modify_crond and /start_task interfaces, allowing attackers to modify and start scheduled tasks, leading to OS command injection. This vulnerability is critical with a CVSS 4.0 score of 9.3. No official patch or remediation guidance is currently provided by the vendor.
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.
Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.
The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.
Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma Access® are not impacted by these vulnerabilities.
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.
CVE-2026-6281 is a high-severity vulnerability in Lenovo Personal Cloud T2s devices that allows a remote authenticated user on the local network to execute arbitrary OS commands due to improper neutralization of special elements in OS commands. The vulnerability is identified as CWE-78 and has a CVSS 4.0 base score of 8.7, indicating significant impact. No official patch or remediation guidance has been provided by Lenovo at this time. There are no known exploits in the wild. The vulnerability requires local network access and user authentication to be exploited.
CVE-2026-34176 is a high-severity vulnerability in F5 BIG-IP appliances running in Appliance mode. It involves an authenticated remote OS command injection via an undisclosed iControl REST endpoint. Successful exploitation allows an attacker with high privileges to cross security boundaries, potentially leading to full compromise of confidentiality and integrity without impacting availability. The vulnerability affects specific versions including 21.0.0, 17.5.0, 17.1.0, and 16.
CVE-2026-42924 is a high-severity vulnerability in F5 BIG-IP affecting versions 16.1.0, 17.1.0, 17.5.0, and 21.0.0. It allows an authenticated attacker with Resource Administrator or Administrator roles to create SNMP configuration objects via the iControl SOAP interface, resulting in privilege escalation.
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion advisory. Pre-patch, the check was applied to the raw command string rather than the parsed first token. This vulnerability is fixed in 0.x.y-security-1.
CVE-2026-8051 is an OS command injection vulnerability in Ivanti Virtual Traffic Manager versions before 22.9r4. It allows a remote authenticated attacker with administrative privileges to execute arbitrary commands on the affected system. The vulnerability is classified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity. No official patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.
Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
CVE-2025-40947 is a high-severity OS command injection vulnerability affecting multiple Siemens RUGGEDCOM ROX MX5000 series devices running versions prior to V2.17.1. The issue arises from improper sanitization of user input during the feature key installation process, allowing an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability has a CVSS score of 7.5, indicating a significant risk. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-7256 is a high-severity OS command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0. An adjacent attacker on the LAN can exploit this by sending a crafted HTTP request to execute arbitrary OS commands on the device. The vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78). No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic secret used for JWT signing and password-hash derivation, enabling forgery of administrative API tokens. The forged token can then be used to invoke a pipeline function that reaches an OS command sink (CWE-78) running in the SYSTEM context.
A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl Edge service account.