CVE-2026-108743 is an OS Command Injection vulnerability in Apache Kylin affecting versions from 4.0.4 through 5.0.4. The flaw involves improper neutralization of special elements used in OS commands, potentially allowing an attacker to execute arbitrary commands. The impact is primarily on Kylin services exposed directly to public networks, which is uncommon; most in-house deployments are not affected. The issue is fixed in version 5.0.5.
CVE-2026-96620 is a critical vulnerability in the anthropics claude-agent-sdk-python prior to version 0.2.121. The issue arises from improper input validation of the resume option passed to the Claude CLI, allowing an attacker to inject CLI flags such as --mcp-config. This can lead to arbitrary command execution at CLI startup, bypassing SDK permission controls. The vulnerability is fixed in version 0.2.121.
ZoneMinder versions from 1.37.48 up to but not including 1.38.3 contain an OS command injection vulnerability in the downloadEvents() function. This occurs because the monitor Name value is manually wrapped in single quotes instead of properly escaped, allowing shell metacharacters to break out of the quoting. An attacker with monitor-create or monitor-edit permissions can store a malicious monitor Name, which is then executed when a user with Events View permission exports events. This vulnerability is fixed in version 1.38.3.
ZoneMinder versions prior to 1.38.3 contain an OS command injection vulnerability in the exportEvents() function. An authenticated user with View Events or View Snapshots permission can exploit this by submitting a crafted exportFile parameter with a valid CSRF token and exportDetail enabled. This allows arbitrary OS command execution as the web server user. The issue is fixed in version 1.38.3.
CVE-2026-92263 is an OS command injection vulnerability in CodeWithCJ SparkyFitness, a self-hosted AI-powered health and fitness tracker. Versions prior to 1.6.0 have a flaw in the api/admin/backup/restore endpoint where an authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters. This leads to arbitrary command execution with the server process privileges. The issue is fixed in version 1.6.0.
Wheels CLI versions 4.0.0 through 4.1.1 contain multiple security issues including OS command injection due to insufficient validation or escaping of user-supplied inputs. This allows execution of shell commands on deploy hosts and CI runners. Additional flaws include unintended file deletion, overwriting vendor files, stored XSS in generated views, and improper process termination. These vulnerabilities are fixed in version 4.1.2, but some generated views require manual edits to fully mitigate stored XSS.
CVE-2026-55453 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where the quote_string() function in backend/ipp.c improperly preserves carriage-return and line-feed characters in a remote printer-controlled marker-message. This allows an attacker to inject newline characters that the scheduler interprets as separate PPD control lines, enabling persistence of attacker-selected PPD keywords. A demonstrated exploit involves injecting a FoomaticRIPCommandLine value that executes in the filter context during a later print job on a Foomatic-backed queue. The issue is fixed in version 2.4.20.
CVE-2026-45449 is an OS Command Injection vulnerability in Unitronics UniStream Pro and UniLogic software. It affects Unitronics UniStream Pro versions B10 and C10, and UniLogic versions prior to 1.41.329. This vulnerability allows improper neutralization of special elements used in OS commands, potentially enabling an attacker with limited privileges to execute arbitrary commands. The CVSS score is 8.3, indicating a high severity impact with high confidentiality and integrity impact and low availability impact.
CVE-2026-57155 is a critical path traversal vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It arises from improper validation of a CSV country_code value used in constructing output filenames during GeoIP alias imports. An attacker with Firewall Alias Edit privileges can exploit this to write arbitrary files as root, potentially leading to full firewall compromise via cron job execution. The issue is fixed in version 26.1.11.
CVE-2026-47786 is a critical OS command injection vulnerability in QNAP Systems Inc.'s HybridDesk Station. This flaw allows remote attackers to execute arbitrary commands without authentication. The vulnerability affects versions 4.2.x prior to 4.2.23 and 4.3.x prior to 4.3.4. Fixed versions 4.2.23 and later, and 4.3.4 and later, have addressed this issue.
CVE-2026-34007 is an OS command injection vulnerability in QNAP Systems Inc. Notes Station 3. This flaw allows remote attackers to execute arbitrary commands on affected systems. The vulnerability affects versions from 3.9.x up to but not including 3.9.11. A fix has been released in version 3.9.11 and later. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-41545 is a relative path traversal vulnerability in QNAP Systems Inc.'s QuMagie product. An attacker with administrator privileges can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in QuMagie version 2.9.1 and later.
CVE-2026-110908 is an OS command injection vulnerability in the Netgate pfSense FRR package versions 2.0.2_1 and 2.1.2_1. It affects the FRR status filter in the WebGUI, allowing an authenticated user with limited privileges to execute arbitrary commands as root by exploiting improper neutralization of special elements in a shell command pipeline. Updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1 address this issue.
CVE-2026-0313 is a command injection vulnerability in Palo Alto Networks Cortex XSOAR OS Query content pack. It allows an authenticated administrator to execute arbitrary operating system commands on remote endpoints. The vulnerability affects versions from 0 up to but not including 1.0.17. The CVSS 4.0 base score is 6.1, indicating a medium severity. There are no known exploits in the wild and no patch information is provided in the input data.
CVE-2026-0320 is a command injection vulnerability in Palo Alto Networks PAN-OS software affecting PA-Series and VM-Series firewalls and Panorama devices. An authenticated administrator with access to the management interface can execute arbitrary commands as root. The vulnerability does not affect Cloud NGFW or Prisma Access. Restricting management interface access to trusted internal IP addresses significantly reduces risk. The CVSS 4.0 score is 6.1 (medium severity).
CVE-2026-100232 is a high-severity vulnerability in SonicWall Network Security Manager (NSM) on-premises. It is an OS command injection flaw that occurs post-authentication and could allow a remote authenticated attacker to execute arbitrary operating system commands, leading to remote code execution.
CVE-2026-55679 is an OS command injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to reach the pre-installation endpoint and inject commands via the 'usuario' parameter in the Linux reinstall flow. This leads to execution of arbitrary commands as the web-server user, persistence of attacker-controlled PHP configuration, and potential disruption or alteration of application data. The issue is fixed in version 3.8.6.
Markdown Preview Enhanced for Visual Studio Code versions prior to 0.8.28 contains an OS command injection vulnerability. This occurs when a user opens a malicious Markdown file and clicks a crafted external or unsupported-scheme link, causing shell metacharacters to be interpreted by the Windows command shell. This allows execution of arbitrary commands with the privileges of the current user. The vulnerability is fixed in version 0.8.28.
flytohub flyto-core versions 2.26.2 and 2.26.3 contain a command injection vulnerability in the HTTP MCP POST /mcp route. This flaw allows unauthenticated JSON-RPC calls to execute arbitrary shell commands via the sandbox.execute_shell module, potentially leading to full OS command execution with the privileges of the flyto-core server process. The issue is resolved in version 2.26.4.
CVE-2026-102059 is an OS command injection vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX, SRX, and QFX Series devices. An adjacent unauthenticated attacker can exploit this flaw by using a rogue DHCP server to execute arbitrary commands with root privileges. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. It has a high severity with a CVSS score of 8.8. No known exploits in the wild have been reported. The vendor has not provided explicit patch links in the provided data, so patch status should be verified with Juniper advisories.