CVE-2026-19682
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arb
CVSS
9.9
Crítico
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 14 ago 2026 · Última mod.: 14 ago 2026 · CWE-78
Sin historial EPSS suficiente todavía.
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-736808.8 ALT—
———Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.8hCVE-2026-171869.9 CRÍ—
———IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.8hCVE-2026-171798.5 ALT—
———IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.8hCVE-2026-1918810.0 CRÍ—
———A critical OS command injection vulnerability has been identified in the
Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the
Net Check feature accessible via the /setting endpoint. The cmdPing
Socket.io event fails to properly sanitize user-supplied input before
passing it to the underlying operating system, allowing an attacker to
inject and execute arbitrary OS commands with root privileges.9hCVE-2026-196819.9 CRÍ—
———An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.9hCVE-2026-196798.8 ALT—
———An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.8h