CWE-78: OS Command Injection vulnerabilities

CVE-2026-102031 is a critical OS Command Injection vulnerability in the TACACS component of Juniper Networks Junos OS Evolved. It allows a low-privileged TACACS+-authenticated user to execute commands with root privileges if periodic TACACS+ authorization-refresh is enabled. The vulnerability affects multiple specific versions of Junos OS Evolved. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed.

CVE-2026-102079 is an OS command injection vulnerability in the CLI of Juniper Networks Junos OS. A local, low privileged attacker can exploit a flaw in the 'request csds' command, which fails to properly sanitize user input, allowing execution of arbitrary commands with root privileges. This can lead to full system compromise. The vulnerability affects Junos OS versions 24.4 prior to 24.4R2-S4, 25.2 prior to 25.2R2-S1, and 25.4 prior to 25.4R1-S3. Versions before 24.4R1 are not affected. A patch is available to remediate this issue. The CVSS v3.1 base score is 7.8, indicating high severity.

CVE-2026-101967 is an OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved. It allows an unauthenticated attacker on the management LAN to execute commands as root by sending a crafted DHCP response. This vulnerability affects multiple versions of Junos OS Evolved prior to their respective fixed releases. The vulnerability has a high severity with a CVSS score of 8.8.

CVE-2026-101978 is an OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series devices. It allows an unauthenticated attacker on the management LAN to execute arbitrary commands as root via a crafted gRPC response. The vulnerability affects multiple specific versions of Junos OS Evolved. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-103929 is an OS command injection vulnerability in the jdx mise tool. It arises because certain shell interpreter argument settings in local untrusted .mise.toml files are not properly restricted by the global_only denylist, allowing attackers to control the shell interpreter arguments used for command execution. This enables arbitrary command execution when a user runs trusted or global tasks without explicit shell settings. The vulnerability affects versions prior to 2026.7.14 and has a CVSS score of 7.8 (high severity).

Dell Unisphere for PowerMax vApp version 9.2.4.x contains an OS Command Injection vulnerability (CWE-78) that allows a high privileged remote attacker to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 score of 6.6, indicating a medium severity level. No patch or remediation details are provided in the available data.

CVE-2026-16741 is a critical OS command injection vulnerability in TR7 Cyber Defense Inc.'s TR7 ASP product on both virtual and physical appliances. It affects versions from 1.0.40.236 up to but not including 1.0.1554.2331, and from 1.6.42.239 up to but not including 1.6.1554.2331. The vulnerability allows an attacker to execute arbitrary operating system commands due to improper neutralization of special elements in OS commands.

CVE-2026-73792 is a security vulnerability in Hewlett Packard Enterprise's HPE NonStop Java JToolkit involving improper neutralization of special elements used in OS commands, leading to potential OS command injection and buffer overflow. The vulnerability has a CVSS score of 3.8, indicating low severity. No affected versions or patch information are provided.

Koha Community's Koha software contains an OS command injection vulnerability in its Task Scheduler deletion functionality. Authenticated staff users with schedule task permissions can exploit this by injecting shell metacharacters in the jobid parameter, leading to arbitrary command execution as the application user. This vulnerability is fixed in Koha versions 24.11.20, 25.05.15, 25.11.09, 26.05.04, and the 26.11 development branch.

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

CVE-2026-110392 is a critical OS command injection vulnerability in Samsung Open Source QA-Board. It involves improper neutralization of special elements used in OS commands, allowing an attacker to execute arbitrary commands on the affected system. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No affected versions or patch information are provided. No known exploits are reported in the wild.

A local privilege escalation vulnerability exists in the Akamai Guardicore Platform Agent (GPA) before version 7.4 on macOS. The flaw is in the wapptunneld component, which improperly validates network interface names used in system command execution. An unprivileged local user who can rename network interfaces can inject malicious commands that execute with root privileges when a specific logout action is triggered. This vulnerability is identified as CVE-2026-46449 and has a CVSS score of 6.7 (medium severity).

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Komodo versions from 1.19.1 up to but not including 2.3.0 contain an OS command injection vulnerability in the periphery agent's container-management functionality. Authenticated users with specific low-level permissions can inject shell metacharacters in container names, leading to arbitrary command execution as root on the managed host. This allows privilege escalation without requiring Terminal permission.

VNote versions prior to 4.3.0 contain an OS command injection vulnerability due to improper neutralization of special elements in note filenames. Specifically, attacker-controlled double quotes in POSIX note filenames can break out of quoted paths and inject arguments into external program commands. This can lead to arbitrary command execution if the external program supports command execution via arguments. The issue is fixed in version 4.3.0.

MultiTail versions 7.1.5 and earlier contain an OS command injection vulnerability in the execute-on-match feature (-ex and -eX options). This flaw allows an attacker who can influence monitored input to execute arbitrary commands with the privileges of the MultiTail user due to improper escaping of shell metacharacters. No fix is currently available.

CVE-2026-100207 is an OS command injection vulnerability in Microsoft Azure CycleCloud version 8.9.1 and earlier. It allows an authorized attacker to execute arbitrary code locally by exploiting improper neutralization of special elements in OS commands. The vulnerability affects versions from 1.0.0 up to but not including 8.9.2. A patch is available in version 8.9.2. The vulnerability has a high severity rating with a CVSS score of 7.3.

CVE-2026-55376 is a high-severity OS command injection vulnerability in heymrun's heym product prior to version 0.0.40. Authenticated users with permissions to create or edit workflows using an Agent custom Python tool can bypass sandbox restrictions due to improper validation of imported standard-library modules. This allows execution of arbitrary OS commands and file operations with the backend application user's privileges. The issue is fixed in version 0.0.40.

CVE-2026-77099 is a critical OS command injection vulnerability in Commvault Cloud's CVFS component caused by improper input validation. This flaw allows unauthenticated attackers to execute arbitrary OS commands with high impact on confidentiality, integrity, and availability. Multiple versions of Commvault Cloud prior to specific maintenance releases are affected. Users are advised to upgrade to the resolved maintenance releases to mitigate this issue.

CVE-2026-75826 is a high-severity OS command injection vulnerability in Teltonika Networks RUTOS and TSWOS devices. It affects the backup function in multiple device models running RUTOS versions 7.22 before 7.24.6 and 7.25 before 7.25.2, as well as TSWOS versions 1.9 before 1.10.4. The flaw allows a remote authenticated attacker to execute arbitrary operating system commands.