Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2655)
CWE-79 (1918)
CWE-416 (1383)
CWE-862 (1246)
CWE-89 (1118)
CWE-22 (1046)
CWE-125 (940)
CWE-200 (866)
CWE-306 (862)
CWE-122 (834)
CWE-20 (815)
CWE-787 (735)
CWE-78 (727)
CWE-918 (707)
CWE-863 (667)
CWE-94 (653)
CWE-74 (604)
CWE-639 (577)
CWE-400 (545)
CWE-269 (509)
CWE-119 (507)
CWE-502 (488)
CWE-287 (453)
CWE-770 (450)
CWE-121 (414)
CWE-190 (383)
CWE-77 (380)
CWE-362 (376)
CWE-476 (311)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-18614 |
high | 8.9 | 0.0362 | 2026-08-03 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo | |
CVE-2026-18615 |
high | 8.9 | 0.0362 | 2026-08-03 | A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the functio | |
CVE-2026-18616 |
high | 8.9 | 0.0362 | 2026-08-03 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the functio | |
CVE-2026-18684 |
high | 8.9 | 0.0362 | 2026-08-03 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function rem | |
CVE-2026-18685 |
high | 8.9 | 0.0362 | 2026-08-04 | A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the functio | |
CVE-2026-18686 |
high | 8.9 | 0.0473 | 2026-08-04 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function | |
CVE-2026-19348 |
high | 8.9 | 0.0357 | 2026-08-09 | A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is t | |
CVE-2023-22789 |
high | 8.8 | 0.0160 | 2023-05-08 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 | |
CVE-2026-107672 |
high | 8.8 | 0.0031 | 2026-10-27 | A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Aut | |
CVE-2026-108303 |
high | 8.8 | 0.0025 | 2026-10-27 | Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. | |
CVE-2026-108329 |
high | 8.8 | 0.0050 | 2026-10-27 | Tanium addressed an unauthorized code execution vulnerability in Threat Response. | |
CVE-2026-24301 |
high | 8.8 | 0.0111 | 2026-08-18 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Cop | 1 PoC |
CVE-2026-49179 |
high | 8.8 | 0.0086 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Windows Activ | 1 PoC |
CVE-2026-56197 |
high | 8.8 | 0.0099 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Windows Admin | |
CVE-2026-97781 |
high | 8.8 | 0.0088 | 2026-10-13 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Off | |
CVE-2026-69370 |
high | 8.8 | 0.0088 | 2026-10-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio | |
CVE-2023-23917 |
high | 8.8 | 0.0098 | 2023-02-23 | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker | |
CVE-2023-31208 |
high | 8.8 | 0.0097 | 2023-05-17 | Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1 | |
CVE-2026-20094 |
high | 8.8 | 0.0114 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-35682 |
high | 8.8 | 0.0179 | 2026-04-17 | Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that en | |
CVE-2026-30898 |
high | 8.8 | 0.0077 | 2026-04-18 | An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the w | |
CVE-2026-44866 |
high | 8.8 | 0.0090 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Op | |
CVE-2026-44867 |
high | 8.8 | 0.0090 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Op | |
CVE-2026-44868 |
high | 8.8 | 0.0090 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Op | |
CVE-2026-44869 |
high | 8.8 | 0.0090 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Op | |
CVE-2026-44870 |
high | 8.8 | 0.0090 | 2026-05-12 | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the | |
CVE-2026-44871 |
high | 8.8 | 0.0123 | 2026-05-12 | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the | |
CVE-2025-57282 |
high | 8.8 | 0.0098 | 2026-05-18 | ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. | |
CVE-2026-96951 |
high | 8.8 | 0.0981 | 2026-10-13 | Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attac | KEV |
CVE-2026-79878 |
high | 8.8 | 0.0082 | 2026-10-22 | A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol | |
CVE-2025-40937 |
high | 8.7 | 0.0059 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected applica | |
CVE-2026-42271 |
high | 8.7 | 0.9144 | 2026-05-08 | BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, | KEV |
CVE-2026-77931 |
high | 8.7 | 0.0100 | 2026-10-15 | MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute | |
CVE-2026-116504 |
high | 8.6 | 0.0155 | 2026-10-26 | A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function | |
CVE-2026-116506 |
high | 8.6 | 0.0188 | 2026-10-26 | A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function a | |
CVE-2024-56837 |
high | 8.6 | 0.0052 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX | |
CVE-2026-67323 |
high | 8.6 | 0.0125 | 2026-08-01 | GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in | |
CVE-2026-112370 |
high | 8.6 | 0.0203 | 2026-10-19 | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of t | |
CVE-2026-113390 |
high | 8.6 | 0.0186 | 2026-10-20 | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the func | |
CVE-2026-116505 |
high | 8.5 | 0.0274 | 2026-10-26 | A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDe | |
CVE-2026-40061 |
high | 8.5 | 0.0024 | 2026-05-13 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TM | |
CVE-2026-40698 |
high | 8.5 | 0.0024 | 2026-05-13 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacke | |
CVE-2026-41953 |
high | 8.5 | 0.0025 | 2026-05-13 | A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at l | |
CVE-2026-5509 |
high | 8.5 | 0.0246 | 2026-05-27 | An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router | |
CVE-2026-75094 |
high | 8.5 | 0.0318 | 2026-08-18 | A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file / | |
CVE-2026-119586 |
high | 8.5 | — | 2026-10-30 | SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover | |
CVE-2026-50520 |
high | 8.4 | 0.0035 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio | |
CVE-2026-43990 |
high | 8.4 | 0.0015 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's | |
CVE-2026-46508 |
high | 8.4 | 0.0016 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.1 | |
CVE-2026-46529 |
high | 8.4 | 0.0053 | 2026-06-10 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si |