CVE-2026-19635
A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could a
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Aug 14, 2026 · Last modified: Aug 15, 2026 · CWE-78
Not enough EPSS history yet.
A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-736808.8 HIG—
——0Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.1dCVE-2026-171869.9 CRI—
——0IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.1dCVE-2026-171798.5 HIG—
——0IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.1dCVE-2026-1918810.0 CRI—
——0A critical OS command injection vulnerability has been identified in the
Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the
Net Check feature accessible via the /setting endpoint. The cmdPing
Socket.io event fails to properly sanitize user-supplied input before
passing it to the underlying operating system, allowing an attacker to
inject and execute arbitrary OS commands with root privileges.1dCVE-2026-196829.9 CRI—
——0A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.17hCVE-2026-196819.9 CRI—
——0An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.17h