Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-34106 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.ph | |
CVE-2026-34107 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.ph | |
CVE-2026-34108 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (li | |
CVE-2026-34109 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php ( | |
CVE-2026-34110 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_star | |
CVE-2026-34111 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_te | |
CVE-2026-34112 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.ph | |
CVE-2026-34113 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text. | |
CVE-2026-34114 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_te | |
CVE-2026-34115 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_a | |
CVE-2026-34116 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.p | |
CVE-2026-34117 |
critical | 9.3 | 0.0093 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subt | |
CVE-2026-58457 |
critical | 9.3 | 0.0294 | 2026-07-01 | Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command inj | |
CVE-2026-60121 |
critical | 9.3 | 0.0330 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj | |
CVE-2026-61498 |
critical | 9.3 | 0.0401 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj | |
CVE-2026-63766 |
critical | 9.3 | 0.0215 | 2026-07-20 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where AS | |
CVE-2026-64625 |
critical | 9.3 | 0.0060 | 2026-07-20 | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped | |
CVE-2026-67324 |
critical | 9.3 | 0.0064 | 2026-08-01 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of - | |
CVE-2026-53975 |
critical | 9.3 | 0.0168 | 2026-08-06 | OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remot | |
CVE-2026-71944 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71945 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71946 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71947 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71948 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71949 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71950 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71951 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71952 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71953 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71954 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71955 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain | |
CVE-2026-71956 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain | |
CVE-2026-71983 |
critical | 9.3 | 0.0246 | 2026-08-08 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71984 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71985 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71986 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71987 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71988 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71989 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71990 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71991 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71992 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71993 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-19586 |
critical | 9.3 | 0.0572 | 2026-08-20 | A pre-authentication OS command injection vulnerability has been identified in Omada gateways config | |
CVE-2020-37282 |
critical | 9.3 | 0.0345 | 2026-10-14 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers | |
CVE-2026-110635 |
critical | 9.3 | 0.0252 | 2026-10-14 | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js h | |
CVE-2026-110640 |
critical | 9.3 | 0.0273 | 2026-10-14 | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to e | |
CVE-2026-59106 |
critical | 9.3 | 0.0055 | 2026-10-26 | A security vulnerability has been identified in the WolfProt interface implementation. Insufficient | |
CVE-2026-97854 |
critical | 9.3 | — | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vu | |
CVE-2026-89010 |
critical | 9.3 | 0.0317 | 2026-09-11 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticat |