Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-114575 |
critical | 10.0 | 0.0221 | 2026-10-22 | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the funct | |
CVE-2026-26015 |
critical | 10.0 | 0.0117 | 2026-04-29 | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an at | |
CVE-2026-105134 |
critical | 10.0 | 0.8176 | 2026-10-04 | Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to exec | KEV |
CVE-2023-27407 |
critical | 9.9 | 0.0130 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based managem | |
CVE-2026-20147 |
critical | 9.9 | 0.1038 | 2026-04-15 | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to exec | |
CVE-2026-20186 |
critical | 9.9 | 0.0560 | 2026-04-15 | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacke | |
CVE-2026-54680 |
critical | 9.9 | 0.0078 | 2026-07-29 | Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior t | |
CVE-2026-85885 |
critical | 9.9 | 0.0072 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot | |
CVE-2023-23080 |
critical | 9.8 | 0.0246 | 2023-02-27 | Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10 | |
CVE-2025-50526 |
critical | 9.8 | 0.0118 | 2025-12-23 | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch | |
CVE-2025-29229 |
critical | 9.8 | 0.0127 | 2025-12-23 | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. | |
CVE-2026-41153 |
critical | 9.8 | 0.0026 | 2026-04-17 | In JetBrains Junie before 252.549.29 command execution was possible via malicious project file | |
CVE-2026-41497 |
critical | 9.8 | 0.0054 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command | |
CVE-2026-38709 |
critical | 9.8 | 0.0275 | 2026-07-30 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300 | |
CVE-2026-38711 |
critical | 9.8 | 0.0275 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300 | |
CVE-2026-38708 |
critical | 9.8 | 0.0275 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300 | |
CVE-2026-38713 |
critical | 9.8 | 0.0275 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300 | |
CVE-2026-28672 |
critical | 9.8 | 0.0263 | 2026-08-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in | |
CVE-2026-79857 |
critical | 9.8 | 0.0141 | 2026-10-22 | There is a command injection vulnerability in the PAPI protocol (Aruba's access point management pro | |
CVE-2024-42360 |
critical | 9.8 | 0.0058 | 2024-08-14 | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal | |
CVE-2026-48561 |
critical | 9.6 | 0.0086 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat | |
CVE-2026-35428 |
critical | 9.6 | 0.0093 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud S | |
CVE-2026-90465 |
critical | 9.4 | 0.0024 | 2026-10-27 | A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positio | |
CVE-2026-8431 |
critical | 9.4 | 0.0037 | 2026-05-12 | An administrative user with access to configure webhooks can execute arbitrary commands by configuri | |
CVE-2026-12045 |
critical | 9.4 | 0.0066 | 2026-06-19 | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence data | |
CVE-2026-115995 |
critical | 9.4 | 0.0138 | 2026-10-24 | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impac | |
CVE-2025-71392 |
critical | 9.4 | 0.0044 | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table an | |
CVE-2026-44257 |
critical | 9.3 | 0.0039 | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip | |
CVE-2026-22095 |
critical | 9.3 | 0.0139 | 2026-07-13 | The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-22103 |
critical | 9.3 | 0.0139 | 2026-07-13 | The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-47708 |
critical | 9.3 | 0.0038 | 2026-07-21 | MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, | |
CVE-2026-93865 |
critical | 9.2 | 0.0046 | 2026-10-27 | A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows | |
CVE-2026-41265 |
critical | 9.2 | 0.0057 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-105014 |
critical | 9.1 | 0.0067 | 2026-10-22 | Improper neutralization of special elements used in a command ('command injection') in Azure Pipelin | |
CVE-2026-35580 |
critical | 9.1 | 0.0057 | 2026-04-07 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files | |
CVE-2026-52199 |
critical | 9.1 | 0.0066 | 2026-07-17 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar | |
CVE-2026-5850 |
high | 8.9 | 0.1510 | 2026-04-09 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function s | |
CVE-2026-5851 |
high | 8.9 | 0.1337 | 2026-04-09 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the funct | |
CVE-2026-5852 |
high | 8.9 | 0.1351 | 2026-04-09 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function se | |
CVE-2026-5853 |
high | 8.9 | 0.1351 | 2026-04-09 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by thi | |
CVE-2026-5854 |
high | 8.9 | 0.1661 | 2026-04-09 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the | |
CVE-2026-5975 |
high | 8.9 | 0.0180 | 2026-04-09 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the | |
CVE-2026-5976 |
high | 8.9 | 0.0180 | 2026-04-09 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the funct | |
CVE-2026-5977 |
high | 8.9 | 0.0211 | 2026-04-09 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function s | |
CVE-2026-5978 |
high | 8.9 | 0.0177 | 2026-04-09 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the | |
CVE-2026-5993 |
high | 8.9 | 0.0180 | 2026-04-10 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects | |
CVE-2026-5994 |
high | 8.9 | 0.0180 | 2026-04-10 | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This issue affects the | |
CVE-2026-5995 |
high | 8.9 | 0.0182 | 2026-04-10 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function se | |
CVE-2026-5996 |
high | 8.9 | 0.0182 | 2026-04-10 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected el | |
CVE-2026-5997 |
high | 8.9 | 0.0180 | 2026-04-10 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the f |