Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-6837 |
high | 7.2 | 0.0152 | 2026-08-04 | A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX65 | |
CVE-2026-71284 |
high | 7.2 | 0.0092 | 2026-08-05 | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restor | |
CVE-2026-12005 |
high | 7.2 | 0.0054 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 | |
CVE-2026-54796 |
high | 7.2 | 0.0200 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special | |
CVE-2026-39902 |
high | 7.2 | 0.0040 | 2026-10-23 | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the pri | 1 PoC |
CVE-2024-23690 |
high | 7.2 | 0.0113 | 2025-02-04 | The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in | |
CVE-2026-113723 |
high | 7.1 | 0.0024 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-sup | |
CVE-2026-118692 |
high | 7.1 | 0.0058 | 2026-10-28 | CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked t | |
CVE-2026-118905 |
high | 7.1 | 0.0014 | 2026-10-29 | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js version | |
CVE-2026-4620 |
high | 7.1 | 0.0101 | 2026-03-27 | OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute | |
CVE-2026-4622 |
high | 7.1 | 0.0088 | 2026-03-27 | OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute | |
CVE-2026-48997 |
high | 7.1 | 0.0095 | 2026-06-17 | e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection v | |
CVE-2026-41857 |
high | 7.1 | 0.0023 | 2026-07-09 | A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's work | |
CVE-2026-68519 |
high | 7.1 | 0.0018 | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run( | |
CVE-2026-110236 |
high | 7.1 | 0.0105 | 2026-10-13 | KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attac | |
CVE-2026-115586 |
high | 7.1 | 0.0020 | 2026-10-23 | virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, | |
CVE-2026-45036 |
high | 7.0 | 0.0013 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before | |
CVE-2026-44604 |
high | 7.0 | 0.0057 | 2026-05-28 | A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extract | |
CVE-2026-11417 |
high | 7.0 | 0.0099 | 2026-06-10 | OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2. | |
CVE-2026-13760 |
high | 7.0 | 0.0116 | 2026-07-01 | OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cd | |
CVE-2026-61438 |
high | 7.0 | 0.0031 | 2026-07-15 | PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_ | |
CVE-2026-102815 |
medium | 6.9 | 0.0060 | 2026-10-27 | An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 | |
CVE-2026-5663 |
medium | 6.9 | 0.0189 | 2026-04-06 | A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnR | |
CVE-2026-5974 |
medium | 6.9 | 0.0246 | 2026-04-09 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the | |
CVE-2026-118607 |
medium | 6.8 | 0.0087 | 2026-10-28 | Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically presen | |
CVE-2026-55748 |
medium | 6.8 | 0.0025 | 2026-06-17 | OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a c | |
CVE-2026-56389 |
medium | 6.8 | 0.0022 | 2026-07-29 | GNU Bison allows for an execution of an arbitrary program during HTML report generation due to impro | |
CVE-2026-18587 |
medium | 6.8 | 0.0198 | 2026-08-03 | A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown funct | |
CVE-2026-76226 |
medium | 6.8 | 0.0029 | 2026-08-19 | Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in baz | |
CVE-2026-35072 |
medium | 6.7 | 0.0057 | 2026-04-17 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release | |
CVE-2026-35073 |
medium | 6.7 | 0.0057 | 2026-04-17 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release | |
CVE-2026-35074 |
medium | 6.7 | 0.0057 | 2026-04-17 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release | |
CVE-2026-54483 |
medium | 6.7 | 0.0062 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through | |
CVE-2026-49813 |
medium | 6.7 | 0.0062 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-65213 |
medium | 6.6 | 0.0054 | 2026-10-27 | This issue may allow an IPMI authenticated administrator to execute commands as the operating system | |
CVE-2026-27955 |
medium | 6.6 | 0.0027 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-42853 |
medium | 6.5 | 0.0054 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cl | |
CVE-2026-26355 |
medium | 6.5 | 0.0177 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-17248 |
medium | 6.5 | 0.0047 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic | |
CVE-2026-3014 |
medium | 6.4 | 0.0078 | 2026-07-14 | Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix s | |
CVE-2026-96376 |
medium | 6.4 | 0.0058 | 2026-10-22 | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerabi | |
CVE-2026-33145 |
medium | 6.3 | 0.0036 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to exe | |
CVE-2026-44170 |
medium | 6.3 | 0.0133 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26 | |
CVE-2026-55448 |
medium | 6.3 | 0.0020 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise | |
CVE-2026-17420 |
medium | 6.3 | 0.0037 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict | |
CVE-2026-73412 |
medium | 6.3 | 0.0061 | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts us | |
CVE-2026-0261 |
medium | 6.1 | 0.0140 | 2026-05-13 | Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenti | |
CVE-2026-17431 |
medium | 6.1 | 0.0095 | 2026-08-13 | PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the outpu | |
CVE-2026-26191 |
medium | 6.0 | 0.0077 | 2026-05-14 | Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's | |
CVE-2026-34387 |
medium | 5.7 | 0.0133 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability |