Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-61567 |
critical | 10.0 | 0.0053 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLi | |
CVE-2026-41900 |
critical | 10.0 | 0.0091 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3 | |
CVE-2026-41553 |
critical | 10.0 | 0.0065 | 2026-05-15 | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Executi | |
CVE-2026-45087 |
critical | 10.0 | 0.0873 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe | |
CVE-2026-49869 |
critical | 10.0 | 0.0209 | 2026-06-26 | Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote | KEV |
CVE-2026-56004 |
critical | 10.0 | 0.0066 | 2026-07-02 | A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12 | |
CVE-2026-59726 |
critical | 10.0 | 0.0302 | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-co | |
CVE-2026-46339 |
critical | 10.0 | 0.0276 | 2026-07-15 | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware d | |
CVE-2026-8985 |
critical | 10.0 | 0.0709 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /te | |
CVE-2026-6516 |
critical | 10.0 | 0.0473 | 2026-07-23 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code | |
CVE-2026-16812 |
critical | 10.0 | 0.0176 | 2026-07-27 | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow | KEV |
CVE-2026-105134 |
critical | 10.0 | 0.8176 | 2026-10-04 | Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to exec | KEV |
CVE-2026-15068 |
critical | 9.9 | 0.0079 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to exe | |
CVE-2026-16816 |
critical | 9.9 | 0.0079 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute | |
CVE-2026-104353 |
critical | 9.9 | 0.0130 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2023-27407 |
critical | 9.9 | 0.0130 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based managem | |
CVE-2026-40933 |
critical | 9.9 | 0.1196 | 2026-04-21 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-45744 |
critical | 9.9 | 0.0201 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa | |
CVE-2026-46716 |
critical | 9.9 | 0.0043 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-34038 |
critical | 9.9 | 0.0254 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-54051 |
critical | 9.9 | 0.0047 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandb | |
CVE-2026-48030 |
critical | 9.9 | 0.0755 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi | |
CVE-2026-72603 |
critical | 9.9 | 0.0223 | 2026-08-11 | An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permiss | |
CVE-2026-73263 |
critical | 9.9 | 0.0065 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accep | |
CVE-2026-73294 |
critical | 9.9 | 0.0065 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, reposi | |
CVE-2026-63298 |
critical | 9.9 | 0.0069 | 2026-08-12 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration | |
CVE-2026-18835 |
critical | 9.9 | 0.0079 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute | |
CVE-2026-90868 |
critical | 9.9 | — | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 | |
CVE-2025-63334 |
critical | 9.8 | 0.0118 | 2025-11-05 | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulne | |
CVE-2026-82119 |
critical | 9.8 | 0.0105 | 2026-10-27 | OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-0 | |
CVE-2026-114278 |
critical | 9.8 | 0.0090 | 2026-10-28 | The che-machine-exec service constructs a shell command by concatenating user-controlled input (the | |
CVE-2026-103406 |
critical | 9.8 | 0.0052 | 2026-10-28 | An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedP | |
CVE-2019-15598 |
critical | 9.8 | 0.0274 | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker | |
CVE-2026-40288 |
critical | 9.8 | 0.0061 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of prais | |
CVE-2026-39808 |
critical | 9.8 | 0.9319 | 2026-04-14 | Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthentic | KEV |
CVE-2026-5935 |
critical | 9.8 | 0.0034 | 2026-04-23 | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow a | |
CVE-2026-42076 |
critical | 9.8 | 0.0170 | 2026-05-04 | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command inje | |
CVE-2026-8153 |
critical | 9.8 | 0.0285 | 2026-05-08 | OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5 | |
CVE-2026-41497 |
critical | 9.8 | 0.0054 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command | |
CVE-2026-8500 |
critical | 9.8 | 0.0165 | 2026-05-13 | Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI applica | |
CVE-2026-4408 |
critical | 9.8 | 0.0250 | 2026-05-28 | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers an | |
CVE-2026-45748 |
critical | 9.8 | 0.0173 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa | |
CVE-2026-49261 |
critical | 9.8 | 0.0158 | 2026-06-11 | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11 | |
CVE-2026-42846 |
critical | 9.8 | 0.0073 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's | |
CVE-2026-9862 |
critical | 9.8 | 0.0099 | 2026-06-15 | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in th | |
CVE-2026-8592 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin | |
CVE-2026-8660 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux | |
CVE-2026-8665 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Lin | |
CVE-2026-8666 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plug | |
CVE-2026-62392 |
critical | 9.8 | 0.0248 | 2026-07-14 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi |