Everything Threat Times has reported about command injection: 9 stories, newest first. Part of our Vulnerabilities coverage.
A critical vulnerability in Wavlink router firmware allows remote attackers to execute arbitrary OS commands through a CGI script flaw, with public exploit code now available.
A CVSS 9.4 critical vulnerability in Linksys E1700 firmware allows remote OS command injection via the DMZ function, with no vendor response reported.
The National Vulnerability Database has assigned a 9.4 score to CVE-2026-108540, a command injection vulnerability in OpenSpug Spug that allows remote attackers to execute arbitrary operating system commands.
A command injection flaw in Argo CD allows attackers to execute shell commands via crafted SSH proxy URLs, affecting versions 2.11.0 through 3.6.0-rc1.
A high-severity flaw in OpenStack Mistral allows authenticated users to execute arbitrary commands on executor hosts via the ssh_proxied action.
A critical command injection vulnerability in Tenable Identity Exposure allowed attackers to execute system-level commands, prompting an urgent update.
Federal agency lists CVE-2016-3081 in its KEV catalog, setting a strict October 11 deadline for federal agencies to apply mitigations.
Cisco releases software updates for Application Policy Infrastructure Controller addressing command injection and file access vulnerabilities.
A high-severity vulnerability in aaPanel BaoTa up to version 11.8.0 allows remote command injection, according to NVD.