Total
3432 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-66219 | 1 Dontkry | 1 Willitmerge | 2026-06-17 | N/A | 9.8 CRITICAL |
| willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public. | |||||
| CVE-2025-66032 | 1 Anthropic | 1 Claude Code | 2026-06-17 | N/A | 9.8 CRITICAL |
| Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 1.0.93. | |||||
| CVE-2025-65946 | 1 Roocode | 1 Roo Code | 2026-06-17 | N/A | 8.1 HIGH |
| Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7. | |||||
| CVE-2025-65885 | 2 Nokia, Symwld | 13 500, 603, 700 and 10 more | 2026-06-17 | N/A | 5.1 MEDIUM |
| An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\Data directory. | |||||
| CVE-2025-65657 | 1 Feehi | 1 Feehicms | 2026-06-17 | N/A | 6.5 MEDIUM |
| FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE). | |||||
| CVE-2025-65293 | 1 Aqara | 2 Camera Hub G3, Camera Hub G3 Firmware | 2026-06-17 | N/A | 6.6 MEDIUM |
| Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset. | |||||
| CVE-2025-65292 | 1 Aqara | 6 Camera Hub G3, Camera Hub G3 Firmware, Hub M2 and 3 more | 2026-06-17 | N/A | 7.3 HIGH |
| Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names. | |||||
| CVE-2025-64993 | 1 Teamviewer | 1 Digital Employee Experience | 2026-06-17 | N/A | 6.8 MEDIUM |
| A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform. | |||||
| CVE-2025-64992 | 1 Teamviewer | 1 Digital Employee Experience | 2026-06-17 | N/A | 6.8 MEDIUM |
| A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform. | |||||
| CVE-2025-64991 | 1 Teamviewer | 1 Digital Employee Experience | 2026-06-17 | N/A | 6.8 MEDIUM |
| A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform. | |||||
| CVE-2025-64988 | 1 Teamviewer | 1 Digital Employee Experience | 2026-06-17 | N/A | 7.2 HIGH |
| A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform. | |||||
| CVE-2025-64987 | 1 Teamviewer | 1 Digital Employee Experience | 2026-06-17 | N/A | 7.2 HIGH |
| A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform. | |||||
| CVE-2025-64986 | 1 Teamviewer | 1 Digital Employee Experience | 2026-06-17 | N/A | 7.2 HIGH |
| A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform. | |||||
| CVE-2025-64671 | 1 Microsoft | 1 Github Copilot | 2026-06-17 | N/A | 8.4 HIGH |
| Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally. | |||||
| CVE-2025-64424 | 1 Coollabs | 1 Coolify | 2026-06-17 | N/A | 8.8 HIGH |
| Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available. | |||||
| CVE-2025-64419 | 1 Coollabs | 1 Coolify | 2026-06-17 | N/A | 9.6 CRITICAL |
| Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue. | |||||
| CVE-2025-64093 | 1 Zenitel | 4 Icx500, Icx500 Firmware, Icx510 and 1 more | 2026-06-17 | N/A | 10.0 CRITICAL |
| Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device. | |||||
| CVE-2025-64090 | 1 Zenitel | 2 Tcis-3, Tcis-3 Firmware | 2026-06-17 | N/A | 10.0 CRITICAL |
| This vulnerability allows authenticated attackers to execute commands via the hostname of the device. | |||||
| CVE-2025-63749 | 1 Pnetlab | 1 Pnetlab | 2026-06-17 | N/A | 6.5 MEDIUM |
| pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter. | |||||
| CVE-2025-63604 | 1 Baryhuang | 1 Aws Resources Mcp Server | 2026-06-17 | N/A | 6.5 MEDIUM |
| A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulnerability stems from the exposure of dangerous Python built-in functions (__import__, getattr, hasattr) in the execution namespace and the direct use of exec() to execute user-supplied code. An attacker can craft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), file system access, environment variable disclosure, and potential system compromise. The vulnerability allows attackers to bypass intended security controls and gain unauthorized access to sensitive AWS resources and credentials stored in the server's environment. | |||||