Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-46420 |
critical | 9.8 | 0.0201 | 2026-07-17 | setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, | |
CVE-2026-16766 |
critical | 9.8 | 0.0257 | 2026-07-25 | Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via P | |
CVE-2026-14522 |
critical | 9.8 | 0.0102 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a | |
CVE-2026-12940 |
critical | 9.8 | 0.0094 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via e | |
CVE-2026-52102 |
critical | 9.8 | 0.0294 | 2026-08-03 | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 all | |
CVE-2026-66902 |
critical | 9.8 | 0.0070 | 2026-08-04 | Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JS | |
CVE-2026-67261 |
critical | 9.8 | 0.0232 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a | |
CVE-2026-72580 |
critical | 9.8 | 0.0165 | 2026-08-10 | An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote a | |
CVE-2026-72589 |
critical | 9.8 | 0.0195 | 2026-08-10 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthentic | |
CVE-2026-13206 |
critical | 9.8 | 0.0177 | 2026-08-10 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi | |
CVE-2026-16956 |
critical | 9.8 | 0.0086 | 2026-08-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands d | |
CVE-2026-49819 |
critical | 9.8 | 0.0108 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentica | |
CVE-2026-16882 |
critical | 9.8 | 0.0086 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary com | |
CVE-2026-65184 |
critical | 9.8 | 0.0042 | 2026-10-26 | The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied We | |
CVE-2024-8517 |
critical | 9.8 | 0.9461 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and una | 2 PoC |
CVE-2026-115904 |
critical | 9.6 | 0.0074 | 2026-10-28 | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior t | |
CVE-2026-40088 |
critical | 9.6 | 0.0042 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow | |
CVE-2026-49481 |
critical | 9.6 | 0.0148 | 2026-08-12 | UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability | |
CVE-2026-8986 |
critical | 9.5 | 0.0328 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when proce | |
CVE-2026-66088 |
critical | 9.4 | 0.0069 | 2026-10-29 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs s | |
CVE-2026-6644 |
critical | 9.4 | 0.0194 | 2026-04-20 | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability al | |
CVE-2026-21571 |
critical | 9.4 | 0.0135 | 2026-04-21 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, | |
CVE-2026-45035 |
critical | 9.4 | 0.0038 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby regist | |
CVE-2026-55743 |
critical | 9.4 | 0.0039 | 2026-06-17 | The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (de | |
CVE-2026-64878 |
critical | 9.4 | 0.0080 | 2026-07-21 | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument | |
CVE-2026-64879 |
critical | 9.4 | 0.0226 | 2026-07-21 | A filename supplied during file upload is not properly sanitized before being used in system command | |
CVE-2026-63732 |
critical | 9.4 | 0.0101 | 2026-07-23 | 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password ( | |
CVE-2026-17566 |
critical | 9.4 | 0.0067 | 2026-07-31 | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-s | |
CVE-2026-73483 |
critical | 9.4 | 0.0062 | 2026-08-13 | Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in t | |
CVE-2026-113788 |
critical | 9.4 | 0.0039 | 2026-10-21 | Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerabi | |
CVE-2026-109122 |
critical | 9.4 | 0.0052 | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one fi | |
CVE-2026-107861 |
critical | 9.4 | 0.0051 | 2026-10-22 | The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostna | |
CVE-2026-110243 |
critical | 9.4 | 0.0051 | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the ne | |
CVE-2026-115995 |
critical | 9.4 | 0.0138 | 2026-10-24 | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impac | |
CVE-2026-34977 |
critical | 9.3 | 0.0077 | 2026-04-06 | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploa | |
CVE-2026-40111 |
critical | 9.3 | 0.0023 | 2026-04-09 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praison | |
CVE-2026-6349 |
critical | 9.3 | 0.0203 | 2026-04-16 | The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticat | |
CVE-2026-32311 |
critical | 9.3 | 0.0051 | 2026-04-20 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, tr | |
CVE-2026-5965 |
critical | 9.3 | 0.0164 | 2026-04-21 | NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated l | |
CVE-2026-41064 |
critical | 9.3 | 0.0034 | 2026-04-22 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fi | |
CVE-2026-6942 |
critical | 9.3 | 0.0192 | 2026-04-23 | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows rem | |
CVE-2026-41922 |
critical | 9.3 | 0.0498 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41923 |
critical | 9.3 | 0.0309 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41924 |
critical | 9.3 | 0.0320 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41925 |
critical | 9.3 | 0.0400 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41926 |
critical | 9.3 | 0.0123 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-44258 |
critical | 9.3 | 0.0036 | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function valida | |
CVE-2026-42062 |
critical | 9.3 | 0.0163 | 2026-05-13 | ELECOM wireless LAN access point devices contain an OS command injection in processing of username p | |
CVE-2026-41315 |
critical | 9.3 | 0.0103 | 2026-05-14 | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthoriz | |
CVE-2026-44666 |
critical | 9.3 | 0.0038 | 2026-05-14 | HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3 |