Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (879)
CWE-200 (847)
CWE-306 (837)
CWE-122 (829)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (540)
CWE-400 (528)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (439)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-72579 |
high | 7.5 | 0.0110 | 2026-08-10 | An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attack | |
CVE-2026-67180 |
high | 7.5 | 0.0023 | 2026-08-11 | Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to | |
CVE-2026-73660 |
high | 7.5 | 0.0077 | 2026-08-13 | FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module al | |
CVE-2026-33924 |
high | 7.5 | — | 2026-10-29 | Two OS command injection vulnerabilities were discovered in the update installation functionality du | |
CVE-2026-39420 |
high | 7.4 | 0.0049 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sand | |
CVE-2026-41015 |
high | 7.4 | 0.0116 | 2026-04-16 | radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name | |
CVE-2026-7096 |
high | 7.4 | 0.0408 | 2026-04-27 | A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the funct | |
CVE-2026-7119 |
high | 7.4 | 0.0327 | 2026-04-27 | A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the fi | |
CVE-2026-48787 |
high | 7.4 | 0.0059 | 2026-06-19 | gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an authenticated attac | |
CVE-2026-13545 |
high | 7.4 | 0.0554 | 2026-06-29 | A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of t | |
CVE-2026-117568 |
high | 7.3 | 0.0060 | 2026-10-27 | mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run | |
CVE-2026-100207 |
high | 7.3 | 0.0044 | 2026-10-13 | Improper neutralization of special elements used in an os command ('os command injection') in Azure | |
CVE-2026-1345 |
high | 7.3 | 0.0036 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 | |
CVE-2026-5844 |
high | 7.3 | 0.0508 | 2026-04-09 | A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file pr | |
CVE-2026-6483 |
high | 7.3 | 0.1337 | 2026-04-17 | A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function st | |
CVE-2026-6992 |
high | 7.3 | 0.0815 | 2026-04-25 | A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGe | |
CVE-2026-36045 |
high | 7.3 | 0.0144 | 2026-05-27 | picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/ | |
CVE-2026-18900 |
high | 7.3 | 0.0382 | 2026-08-05 | A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file | |
CVE-2026-19034 |
high | 7.3 | 0.0318 | 2026-08-06 | A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the fun | |
CVE-2026-19035 |
high | 7.3 | 0.0318 | 2026-08-06 | A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function ne | |
CVE-2026-19036 |
high | 7.3 | 0.0318 | 2026-08-06 | A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C | |
CVE-2026-67434 |
high | 7.3 | 0.0106 | 2026-08-06 | PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Pri | |
CVE-2026-48098 |
high | 7.3 | 0.0019 | 2026-08-07 | NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a use | |
CVE-2026-13476 |
high | 7.3 | 0.0043 | 2026-08-12 | IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute ar | |
CVE-2026-119282 |
high | 7.3 | — | 2026-10-29 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 | |
CVE-2026-16521 |
high | 7.2 | 0.0088 | 2026-10-27 | An OS command injection vulnerability exists because of insufficient input filtering. An attacker ca | |
CVE-2026-86395 |
high | 7.2 | 0.0219 | 2026-10-28 | Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 | |
CVE-2026-86399 |
high | 7.2 | 0.0219 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-86379 |
high | 7.2 | 0.0284 | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS20 | |
CVE-2026-86394 |
high | 7.2 | 0.0219 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-110541 |
high | 7.2 | 0.0181 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-35581 |
high | 7.2 | 0.0056 | 2026-04-07 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class co | |
CVE-2026-5208 |
high | 7.2 | 0.0097 | 2026-04-08 | Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to | |
CVE-2026-23774 |
high | 7.2 | 0.0147 | 2026-04-20 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions | |
CVE-2026-22761 |
high | 7.2 | 0.0116 | 2026-04-20 | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A | |
CVE-2026-24506 |
high | 7.2 | 0.0119 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through | |
CVE-2026-26943 |
high | 7.2 | 0.0119 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through | |
CVE-2026-8051 |
high | 7.2 | 0.0191 | 2026-05-12 | OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authent | |
CVE-2026-23820 |
high | 7.2 | 0.0056 | 2026-05-12 | A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant coul | |
CVE-2026-23821 |
high | 7.2 | 0.0062 | 2026-05-12 | A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an | |
CVE-2026-43685 |
high | 7.2 | 0.0046 | 2026-05-12 | A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console pr | |
CVE-2026-40852 |
high | 7.2 | 0.0037 | 2026-05-27 | A highly authenticated attacker can alter the config generator injecting a payload into future creat | |
CVE-2026-48163 |
high | 7.2 | 0.0091 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27 | |
CVE-2026-48165 |
high | 7.2 | 0.0151 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27 | |
CVE-2026-49814 |
high | 7.2 | 0.0200 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-49815 |
high | 7.2 | 0.0171 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-53478 |
high | 7.2 | 0.0200 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-53479 |
high | 7.2 | 0.0197 | 2026-07-07 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-6952 |
high | 7.2 | 0.0152 | 2026-07-21 | A post-authentication command injection vulnerability in the "LogServer" field of the syslog compone | |
CVE-2026-66138 |
high | 7.2 | 0.0047 | 2026-07-24 | In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can ach |