CWE-78
CVEs classified under CWE-78, newest first.
1411 CVEsRSS
CVE-2026-77880High· 7.8Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the…
CVE-2026-77878High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API
Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file p…
CVE-2026-77876High· 8.8Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through th…
CVE-2026-120091High· 8.7Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes…
CVE-2026-116958Medium· 6.7Konflux-ci: unquoted variable expansion in shell command execution
A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this iss…
CVE-2026-94349High· 8.0Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could poten…
CVE-2026-18199High· 8.8Remote Code Execution Vulnerability
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.
CVE-2026-8923High· 8.7Remote Code Execution
Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.
CVE-2026-111560High· 8.6OS Command Injection in Barracuda Appliances
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root pr…
CVE-2026-119737High· 7.8PoCAmlogic pppoe_wrapper Command Injection via AF_UNIX Socket
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sendin…
CVE-2026-120282Critical· 9.9PoCWAVLINK WN536AX6-A protocol.csp host_black os command injection
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possibl…
CVE-2026-120279Critical· 10.0PoCWAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command inje…
CVE-2026-120344Critical· 10.0PoCWAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os c…
CVE-2026-120345Critical· 10.0PoCWAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os com…
CVE-2026-120276Critical· 10.0PoCWAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes o…
CVE-2026-120229Critical· 9.1PoCWAVLINK WN553X1-B ioos sub_416B50 os command injection
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carr…
CVE-2026-120195Critical· 10.0PoCWAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argumen…
CVE-2026-120197Critical· 9.9PoCWAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remo…
CVE-2026-120239Critical· 9.9PoCWAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in o…
CVE-2026-120231Critical· 9.9PoCWAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command in…
CVE-2026-120227Critical· 9.9PoCWAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in…
CVE-2026-120240Critical· 9.9PoCWAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_nam…
CVE-2026-120275Medium· 5.5Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection
A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The a…
CVE-2026-120228Critical· 9.9PoCWAVLINK WN553X1-B ioos Service sub_416D88 os command injection
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os…
CVE-2026-120277Critical· 10.0WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name l…
CVE-2026-120238Critical· 9.9WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The…
CVE-2026-120230Critical· 9.9WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from …
CVE-2026-120196Critical· 9.9WAVLINK WN579X3-D wapi.cgi port_forward os command injection
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remo…
CVE-2026-116755High· 7.4SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating syst…
CVE-2026-119335High· 7.8PoCPi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with ex…