CWE-78
CVEs classified under CWE-78, newest first.
1423 CVEsRSS
CVE-2026-67324Critical· 9.8GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Re…
CVE-2026-67308Critical· 10.0Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metachar…
CVE-2026-9044High· 8.0An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN cl…
CVE-2026-16843High· 7.2Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation
Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to…
CVE-2026-17566Critical· 9.9PoCpgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the…
CVE-2026-17347High· 7.5The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous…
CVE-2026-16524High· 7.8A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
CVE-2026-44106High· 7.8A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
CVE-2026-44096High· 7.8A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
CVE-2026-67438Medium· 6.6OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check
OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check
CVE-2025-59172NoneEricsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.
CVE-2026-24252High· 7.8NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection
NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.
CVE-2026-17497High· 8.3NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore in…
CVE-2026-16766NoneCatalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-co…
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-co…
GHSA-g3hq-hphg-8fhhHigh· 8.8Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
GHSA-6v4m-fw66-8r4xMediumShescape: Path disclosure on Unix with Zsh
Shescape: Path disclosure on Unix with Zsh
GHSA-w4hw-qcx7-56prCriticalShescape: Shell injection via unescaped parentheses on Windows with CMD
Shescape: Shell injection via unescaped parentheses on Windows with CMD
GHSA-6p8h-3wgx-97gfHigh· 7.5GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
GHSA-r9mr-m37c-5fr3High· 8.8GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
CVE-2026-14881High· 7.8When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow th…
GHSA-4v35-78jc-648rMediumDuplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows
Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows
GHSA-rcv6-pvrj-4xcgHighn8n: Authenticated code execution in the n8n Git node
n8n: Authenticated code execution in the n8n Git node
CVE-2026-65590Medium· 5.5n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any file…
CVE-2026-59846Low· 3.9Libssh: libssh: information disclosure via proxycommand %r username expansion
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
CVE-2026-16445High· 7.5A flaw was found in dracut
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's Ne…
CVE-2026-13760High· 7.3aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
GHSA-v396-v7q4-x2qjHighGitPython unsafe clone option gate bypass through joined short options
GitPython unsafe clone option gate bypass through joined short options
GHSA-2f96-g7mh-g2hxHigh· 8.8GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
CVE-2026-50289High· 8.8systeminformation: systeminformation: Arbitrary Command Execution via OS Command Injection (CVE-2026-50289)
A flaw was found in systeminformation, a Node.js library. A remote attacker can exploit an operating system (OS) command injection vulnerability in the `networkInterfaces()` function on Linux. This occurs because the library improperly han…
CVE-2023-49900Critical· 9.8An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.
An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.