CVE-2026-110392

CVSS: 9.8v3.1CriticalReceived

Published 2026-10-14Last modified 2026-10-14

Open JSON

Vulnerability summary

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (cve.org)

EPSS score

1.24%

0%100%

Low · Change unavailable

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

2026-10-14
PublishedVulnerability first disclosed.
2026-10-14
Last modifiedVulnerability information updated.

Description

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.8

EPSS trend

Probability

1.24%

Chance of exploitation in the next 30 days

Percentile

69%

Versus all other CVEs

30-day change

Change unavailable

2026-10-142026-10-14

EPSS score

1.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

No affected systems are recorded for this record.

References

1 links

github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707