By weakness (CWE)

CWE-78: related vulnerabilities

CVEs classified under CWE-78. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

104 published vulnerabilities · page 2 of 2

• CVE-2026-8664MEDIUM 6.0

  A command injection flaw in the Rapid7 InsightConnect Finger Plugin allows authenticated users with high privileges to inject arbitrary operating system commands through the user or host input fields. An attacker with admin or elevated access could exploit insufficient input validation to execute unauthorized commands on the underlying Linux system, potentially compromising system integrity or accessing sensitive data.

• CVE-2026-49219MEDIUM 5.5

  ImageMagick, widely used for image processing and manipulation, contains a vulnerability that allows a local attacker with login privileges to bypass security policies and read files that should be restricted. The flaw stems from improper handling of filenames, specifically when symlinks are involved. An attacker could exploit this to circumvent the policy restrictions ImageMagick enforces. This is not a remote vulnerability—it requires local system access and user-level permissions.

• CVE-2026-57282MEDIUM 5.0

  Jenkins Git client Plugin versions 6.6.0 and earlier contain a command injection flaw in how they construct SSH wrapper scripts. When a Jenkins build runs in a workspace with a specially crafted directory name, an attacker with the ability to influence that workspace path can inject arbitrary shell commands that execute on the Jenkins agent. This requires authenticated access to create or influence build job workspace naming, limiting immediate risk but creating a significant privilege-escalation vector in multi-tenant Jenkins environments.

• CVE-2026-54686MEDIUM 4.3

  Warp, a terminal-based development environment with AI capabilities, contains a vulnerability in how it processes shell integration commands. Between April 2021 and May 2026, Warp accepted certain terminal state-changing instructions from the PTY stream without confirming they originated from legitimate shell integration. An attacker could exploit this by crafting malicious terminal output that, when viewed by a victim in Warp, tricks the application into accepting false metadata—such as spoofed current working directories or falsified SSH session information. The vulnerability requires user interaction (viewing attacker-controlled terminal content) and has a relatively low severity impact focused on integrity rather than confidentiality or availability. It is resolved in version 0.2026.05.06.15.42.stable_01 and later.