Total
378 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-29768 | 2 Netapp, Vim | 3 Bootstrap Os, Hci Compute Node, Vim | 2026-06-17 | N/A | 4.4 MEDIUM |
| Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198. | |||||
| CVE-2025-27146 | 1 Matrix | 1 Matrix Irc Bridge | 2026-06-17 | N/A | 2.7 LOW |
| matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4. | |||||
| CVE-2025-24845 | 1 Hummingheads | 1 Defense Platform | 2026-06-17 | N/A | 5.5 MEDIUM |
| Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition. | |||||
| CVE-2025-23073 | 2026-06-17 | N/A | 3.5 LOW | ||
| Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data. This issue briefly impacted the master branch of MediaWiki’s GlobalBlocking Extension. | |||||
| CVE-2025-21613 | 1 Go-git Project | 1 Go-git | 2026-06-17 | N/A | 9.8 CRITICAL |
| go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0. | |||||
| CVE-2025-1712 | 1 Checkmk | 1 Checkmk | 2026-06-17 | N/A | 8.8 HIGH |
| Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files | |||||
| CVE-2025-15316 | 1 Tanium | 2 Module Server, Server | 2026-06-17 | N/A | 6.7 MEDIUM |
| Tanium addressed a local privilege escalation vulnerability in Tanium Server. | |||||
| CVE-2025-15315 | 1 Tanium | 2 Module Server, Server | 2026-06-17 | N/A | 6.7 MEDIUM |
| Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. | |||||
| CVE-2025-14946 | 2026-06-17 | N/A | 4.8 MEDIUM | ||
| A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd. | |||||
| CVE-2025-12613 | 2026-06-17 | N/A | 8.6 HIGH | ||
| Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior. **Note:** Following our established security policy, we attempted to contact the maintainer regarding this vulnerability, but haven't received a response. | |||||
| CVE-2025-12556 | 2026-06-17 | N/A | 8.8 HIGH | ||
| An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machine. | |||||
| CVE-2025-0065 | 2026-06-17 | N/A | 7.8 HIGH | ||
| Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker with local unprivileged access on a Windows system to elevate privileges via argument injection. | |||||
| CVE-2024-9131 | 1 Arista | 1 Ng Firewall | 2026-06-17 | N/A | 7.2 HIGH |
| A user with administrator privileges can perform command injection | |||||
| CVE-2024-7573 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject arbitrary arguments into a WP_Query query and potentially expose sensitive information such as attachments or private posts. | |||||
| CVE-2024-58275 | 2026-06-17 | N/A | N/A | ||
| Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server. | |||||
| CVE-2024-52301 | 2 Debian, Laravel | 2 Debian Linux, Framework | 2026-06-17 | N/A | 7.5 HIGH |
| Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs. | |||||
| CVE-2024-51532 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-06-17 | N/A | 7.1 HIGH |
| Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files. | |||||
| CVE-2024-47611 | 2026-06-17 | N/A | N/A | ||
| XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters (for example, filenames) that don't exist in the current legacy code page, the characters are converted to similar-looking characters with best-fit mapping. Some best-fit mappings result in ASCII characters that change the meaning of the command line, which can be exploited with malicious filenames to do argument injection or directory traversal attacks. This vulnerability is fixed in 5.6.3. Command line tools built for Cygwin or MSYS2 are unaffected. liblzma is unaffected. | |||||
| CVE-2024-47553 | 1 Siemens | 1 Sinec Security Monitor | 2026-06-17 | N/A | 9.9 CRITICAL |
| A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate user input to the ```ssmctl-client``` command. This could allow an authenticated, lowly privileged remote attacker to execute arbitrary code with root privileges on the underlying OS. | |||||
| CVE-2024-47516 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure instance. | |||||