Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-58000 |
high | 8.7 | 0.0172 | 2026-06-29 | luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerabili | |
CVE-2026-58452 |
high | 8.7 | 0.0267 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection | |
CVE-2026-41876 |
high | 8.7 | 0.0123 | 2026-07-10 | R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document convert | |
CVE-2026-61434 |
high | 8.7 | 0.0073 | 2026-07-10 | PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command executio | |
CVE-2026-50289 |
high | 8.7 | 0.0356 | 2026-07-17 | systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterf | |
CVE-2026-64881 |
high | 8.7 | 0.0223 | 2026-07-21 | The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow int | |
CVE-2026-67325 |
high | 8.7 | 0.0221 | 2026-08-01 | GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for | |
CVE-2026-69096 |
high | 8.7 | 0.0327 | 2026-08-03 | OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc. | |
CVE-2026-16793 |
high | 8.7 | 0.0052 | 2026-08-04 | An improper neutralization of special elements used in an operating system command vulnerability was | |
CVE-2026-71966 |
high | 8.7 | 0.0328 | 2026-08-10 | CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability | |
CVE-2026-72767 |
high | 8.7 | 0.0088 | 2026-08-11 | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vul | |
CVE-2026-73625 |
high | 8.7 | 0.0092 | 2026-08-13 | GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_o | |
CVE-2026-104085 |
high | 8.7 | 0.0199 | 2026-10-13 | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows aut | |
CVE-2026-114354 |
high | 8.6 | 0.0013 | 2026-10-23 | Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in D | |
CVE-2026-114355 |
high | 8.6 | 0.0121 | 2026-10-23 | OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmw | |
CVE-2013-20007 |
high | 8.6 | 0.0200 | 2026-10-28 | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authentic | |
CVE-2026-118755 |
high | 8.6 | 0.0140 | 2026-10-28 | Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that | |
CVE-2026-27650 |
high | 8.6 | 0.0094 | 2026-03-27 | OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is | |
CVE-2026-21719 |
high | 8.6 | 0.0120 | 2026-04-17 | An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with | |
CVE-2026-40520 |
high | 8.6 | 0.0138 | 2026-04-21 | FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiat | |
CVE-2026-35506 |
high | 8.6 | 0.0131 | 2026-05-13 | ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing | |
CVE-2026-49492 |
high | 8.6 | 0.0034 | 2026-06-05 | Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a sh | |
CVE-2026-11845 |
high | 8.6 | 0.0095 | 2026-06-12 | The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injecti | |
CVE-2026-53876 |
high | 8.6 | 0.0179 | 2026-06-17 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may | |
CVE-2026-12104 |
high | 8.6 | 0.0132 | 2026-06-19 | OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix t | |
CVE-2026-9717 |
high | 8.6 | 0.0173 | 2026-06-25 | CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabili | |
CVE-2026-55441 |
high | 8.6 | 0.0018 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feat | |
CVE-2026-55975 |
high | 8.6 | 0.0063 | 2026-06-26 | A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanit | |
CVE-2026-56808 |
high | 8.6 | 0.0248 | 2026-06-30 | DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, w | |
CVE-2026-50043 |
high | 8.6 | 0.0171 | 2026-07-01 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi | |
CVE-2026-22100 |
high | 8.6 | 0.0110 | 2026-07-13 | The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the | |
CVE-2026-15427 |
high | 8.6 | 0.0084 | 2026-07-14 | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1 | |
CVE-2026-65711 |
high | 8.6 | 0.0204 | 2026-07-24 | sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authentica | |
CVE-2026-67608 |
high | 8.6 | 0.0243 | 2026-08-03 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a | |
CVE-2026-67599 |
high | 8.6 | 0.0243 | 2026-08-03 | ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows a | |
CVE-2026-63725 |
high | 8.6 | 0.0044 | 2026-08-06 | sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around | |
CVE-2026-53455 |
high | 8.6 | 0.0050 | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5. | |
CVE-2026-111216 |
high | 8.6 | 0.0472 | 2026-10-15 | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenti | |
CVE-2026-111226 |
high | 8.6 | 0.0655 | 2026-10-15 | pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authentica | |
CVE-2026-112370 |
high | 8.6 | 0.0203 | 2026-10-19 | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of t | |
CVE-2026-113390 |
high | 8.6 | 0.0186 | 2026-10-20 | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the func | |
CVE-2026-75779 |
high | 8.6 | 0.0120 | 2026-10-23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross | |
CVE-2026-116219 |
high | 8.6 | 0.0208 | 2026-10-26 | Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/ | |
CVE-2024-14010 |
high | 8.5 | 0.0115 | 2025-12-12 | Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows at | |
CVE-2026-0631 |
high | 8.5 | 0.0162 | 2026-02-02 | An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Arc | |
CVE-2026-117558 |
high | 8.5 | 0.0069 | 2026-10-27 | The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that all | |
CVE-2026-117559 |
high | 8.5 | 0.0069 | 2026-10-27 | DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass | |
CVE-2026-117560 |
high | 8.5 | 0.0065 | 2026-10-27 | ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() | |
CVE-2026-117561 |
high | 8.5 | 0.0065 | 2026-10-27 | Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers | |
CVE-2026-117567 |
high | 8.5 | 0.0065 | 2026-10-27 | esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers |