FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
CVE-2026-116786 is a command injection vulnerability in SignalWire FreeSWITCH prior to version 1.11.2. The flaw exists in the sofia_handle_sip_i_refer() function, which improperly handles Refer-To URI parameters and headers, allowing an authenticated caller to inject arbitrary variables into a new call leg. This can lead to execution of operating system commands with FreeSWITCH process privileges. The vulnerability requires only a registered SIP account and a call that uses the off-box transfer path. It is fixed in version 1.11.2.
CVE-2026-82413 is a command injection vulnerability in ntopng, a network traffic monitoring application, affecting versions prior to 6.7.260717. The flaw arises from insufficient validation of the scan_ports parameter in certain Lua scripts, allowing authenticated users or unauthenticated users if login is disabled, to inject shell metacharacters. This leads to arbitrary command execution with the privileges of the ntopng service account when nmap is installed. The issue is fixed in version 6.7.260717.
CVE-2026-97693 is a critical command injection vulnerability in the Yuxi platform versions from 0.6.0.beta1 up to but not including 0.7.1. It allows a low-privileged authenticated user with command execution in their own Docker sandbox to access and manipulate other tenants' sandboxes and data without needing administrator credentials. The vulnerability arises from insufficient isolation between Docker sandboxes and trusted services, enabling cross-tenant API access, file and secret exposure, sandbox management, and potential command execution in shared internal services if default credentials remain unchanged. The issue is fixed in version 0.7.1, but deployments must also rotate persisted credentials for PostgreSQL, Neo4j, and MinIO if they were set to default values, as upgrading alone does not rotate these credentials.
Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
CVE-2026-105979 is a command injection vulnerability in the Welotec TK100 device's ZeroTier VPN function. It allows a remote attacker with high privileges to inject and execute system commands with root privileges due to improper input validation. The vulnerability affects versions prior to 3.5.116, 1.0.124, and 1.0.123. A fix is available in these versions. The CVSS 4.0 score is 8.6, indicating high severity.
CVE-2026-107672 is a command injection vulnerability in Autodesk Fusion Post Processor Utility versions 5.0.1 up to but not including 5.0.2. It arises from a trusted Markdown injection triggered by a maliciously crafted .stack.json file, allowing an attacker to execute arbitrary commands with the privileges of the current user. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in version 5.0.2.
CVE-2026-90465 is an authentication bypass vulnerability in WatchGuard Fireware OS affecting the FireCluster Sync processing. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path attacker, can send specially crafted requests to perform privileged firewall management actions as root. This flaw affects multiple versions prior to fixed releases in 2026.4, 12.12.4, and 12.5.22. The vulnerability has a high severity CVSS score of 8.7.
CVE-2026-93865 is a critical vulnerability in WatchGuard Fireware OS affecting the FireCluster synchronization daemon. It allows a remote unauthenticated attacker to perform privileged system-level administrative actions by sending crafted requests to the FireCluster management IP when clustering is enabled. The flaw is due to missing authentication for critical functionality. Fixed versions are available.
CVE-2026-105014 is a critical command injection vulnerability in Microsoft Azure Pipelines. It allows an unauthorized attacker to execute arbitrary code remotely by exploiting improper neutralization of special elements in commands. The vulnerability affects the cloud service Azure Pipelines and has a CVSS score of 9.1. Microsoft has released an official fix for this issue.
CVE-2026-112942 is a command injection vulnerability in the vitejs launch-editor package prior to version 2.14.2. The flaw arises from improper handling of Windows file arguments containing parent-directory components and line-and-column suffixes, allowing an attacker to bypass filename existence checks. This can lead to OS command injection when combined with a related Windows percent-expansion issue. The vulnerability is fixed in version 2.14.2 and later.
WP Photo Album Plus plugin for WordPress versions up to 9.3.02.002 contains an authenticated command injection vulnerability via the 'value' parameter in the 'update-photo' AJAX action. This flaw arises from improper shell escaping in the wppa_image_magick_a() function, allowing attackers with the 'wppa_upload' capability to execute arbitrary OS commands as the web server user. Exploitation requires ImageMagick to be enabled on the server. The vulnerability enables full remote code execution and can affect users beyond administrators if the plugin's privilege settings are misconfigured.
CVE-2026-55453 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where the quote_string() function in backend/ipp.c improperly preserves carriage-return and line-feed characters in a remote printer-controlled marker-message. This allows an attacker to inject newline characters that the scheduler interprets as separate PPD control lines, enabling persistence of attacker-selected PPD keywords. A demonstrated exploit involves injecting a FoomaticRIPCommandLine value that executes in the filter context during a later print job on a Foomatic-backed queue. The issue is fixed in version 2.4.20.
Dell Unisphere for PowerMax vApp version 9.2.4.x contains a command injection vulnerability (CWE-77) that allows a high privileged remote attacker to execute arbitrary commands. This vulnerability can lead to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.6, indicating a medium severity level.
CVE-2026-97781 is a command injection vulnerability in Microsoft Office OneNote within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute arbitrary code remotely by exploiting improper neutralization of special elements used in commands. The vulnerability has a high severity with a CVSS score of 8.8. An official fix is available from Microsoft, and the product is a cloud service with vendor-managed remediation.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69718 is a command injection vulnerability in Windows Update on Microsoft Windows 11 version 23H2. It allows an authorized local attacker to elevate privileges by exploiting improper neutralization of special elements used in commands. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-69370 is a command injection vulnerability in Microsoft Visual Studio Code that allows an unauthorized attacker to execute arbitrary code over a network. The flaw is due to improper neutralization of special elements used in commands. It affects versions from 1.0.0 up to but not including 1.141.1. A fix is available in version 1.141.1.
An input validation vulnerability in the Brocade Fabric OS administrative management API's security certificate management component allows an authenticated attacker with certificate deletion privileges to execute arbitrary system commands. This occurs because user-supplied certificate identifiers are not properly sanitized before being passed to external system routines. The vulnerability affects Fabric OS versions before 9.2.2d and versions 10.0.0 through 10.0.0a1.