CVE-2026-19679
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames co
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 14, 2026 · Last modified: Aug 14, 2026 · CWE-78
Not enough EPSS history yet.
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-736808.8 HIG—
———Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.7hCVE-2026-171869.9 CRI—
———IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.7hCVE-2026-171798.5 HIG—
———IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.7hCVE-2026-1918810.0 CRI—
———A critical OS command injection vulnerability has been identified in the
Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the
Net Check feature accessible via the /setting endpoint. The cmdPing
Socket.io event fails to properly sanitize user-supplied input before
passing it to the underlying operating system, allowing an attacker to
inject and execute arbitrary OS commands with root privileges.8hCVE-2026-196829.9 CRI—
———A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.8hCVE-2026-196819.9 CRI—
———An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.8h