ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers...

CVE-2026-56379

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows atta

来源摘录 · NVD

A command injection vulnerability has been identified in the DHCP option processing logic in...

CVE-2026-11834

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router mod

历史摘要 · 未重新核验 · GitHub Advisory

Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

CVE-2026-46606

### Summary The Glances KVM/QEMU monitoring engine (`glances/plugins/vms/engines/virsh.py`) passes VM domain names, rea

历史摘要 · 未重新核验 · GitHub Advisory

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplie...

CVE-2026-11834

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router mod

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection....

CVE-2026-12815

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name

历史摘要 · 未重新核验 · NVD

A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of the component API En...

CVE-2026-12814

A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bi

历史摘要 · 未重新核验 · NVD

githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

### Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is trig

历史摘要 · 未重新核验 · GitHub Advisory

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

CVE-2026-55849

## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--wo

历史摘要 · 未重新核验 · GitHub Advisory

gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an authenticated attacker with access to the code-generation feature and MCP management interface c...

CVE-2026-48787

gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an authenticated attacker with access to t

历史摘要 · 未重新核验 · NVD

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint b...

CVE-2026-49260

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/

历史摘要 · 未重新核验 · NVD

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with config...

CVE-2026-12104

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.

历史摘要 · 未重新核验 · NVD

gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

CVE-2026-0755

Untrusted prompt input could reach the Gemini CLI @file parser, allowing read/exfiltration of arbitrary local files (@/e

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Shell positional parameters could weaken strict inline-eval checks

CVE-2026-53855

### Summary Shell positional parameters could weaken strict inline-eval checks. In affected versions, a command request

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

CVE-2026-53848

### Summary Exec allowlist could miss side effects from transparent command wrappers. In affected versions, a command r

历史摘要 · 未重新核验 · GitHub Advisory

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without pr...

CVE-2026-40456

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address p

历史摘要 · 未重新核验 · NVD

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), t...

CVE-2026-48997

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the

历史摘要 · 未重新核验 · NVD

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute...

CVE-2026-20266

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands

历史摘要 · 未重新核验 · GitHub Advisory

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 ...

CVE-2026-55743

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised sec

历史摘要 · 未重新核验 · GitHub Advisory

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have...

CVE-2026-55748

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name

历史摘要 · 未重新核验 · GitHub Advisory

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

### Summary yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if th

历史摘要 · 未重新核验 · GitHub Advisory