Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (542)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-117569 |
high | 8.5 | 0.0067 | 2026-10-27 | Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in | |
CVE-2026-117573 |
high | 8.5 | 0.0070 | 2026-10-27 | hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients | |
CVE-2026-40029 |
high | 8.5 | 0.0080 | 2026-04-08 | parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file p | |
CVE-2026-40527 |
high | 8.5 | 0.0092 | 2026-04-17 | radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command | |
CVE-2026-45391 |
high | 8.5 | 0.0089 | 2026-05-12 | A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a loc | |
CVE-2026-45393 |
high | 8.5 | 0.0022 | 2026-05-12 | A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to e | |
CVE-2026-34176 |
high | 8.5 | 0.0069 | 2026-05-13 | When running in Appliance mode, an authenticated remote command injection vulnerability exists in an | |
CVE-2026-42924 |
high | 8.5 | 0.0025 | 2026-05-13 | An authenticated attacker with the Resource Administrator or Administrator role can create SNMP conf | |
CVE-2026-11409 |
high | 8.5 | 0.0279 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler i | |
CVE-2026-11410 |
high | 8.5 | 0.0279 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configurat | |
CVE-2026-12195 |
high | 8.5 | 0.0066 | 2026-07-04 | myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users ca | |
CVE-2026-55849 |
high | 8.5 | 0.0024 | 2026-07-08 | @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 | |
CVE-2026-15428 |
high | 8.5 | 0.0208 | 2026-07-14 | An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitizat | |
CVE-2026-44093 |
high | 8.5 | 0.0019 | 2026-07-30 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-pri | |
CVE-2026-44106 |
high | 8.5 | 0.0019 | 2026-07-30 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privilege | |
CVE-2026-9044 |
high | 8.5 | 0.0251 | 2026-07-31 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vul | |
CVE-2026-75094 |
high | 8.5 | 0.0318 | 2026-08-18 | A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file / | |
CVE-2026-112263 |
high | 8.5 | 0.0066 | 2026-10-19 | Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows att | |
CVE-2026-105044 |
high | 8.5 | 0.0094 | 2026-10-21 | Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions befor | |
CVE-2026-70386 |
high | 8.5 | 0.0122 | 2026-10-21 | Improper neutralization of special elements used in an OS command ('OS command injection') and Missi | |
CVE-2026-115726 |
high | 8.5 | 0.0016 | 2026-10-23 | Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell c | |
CVE-2026-40030 |
high | 8.4 | 0.0075 | 2026-04-08 | parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path ar | |
CVE-2026-21915 |
high | 8.4 | 0.0224 | 2026-04-09 | A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JS | |
CVE-2026-33791 |
high | 8.4 | 0.0069 | 2026-04-09 | An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos O | |
CVE-2026-40499 |
high | 8.4 | 0.0118 | 2026-04-15 | radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_ | |
CVE-2026-40517 |
high | 8.4 | 0.0105 | 2026-04-22 | radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() | |
CVE-2026-43990 |
high | 8.4 | 0.0015 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's | |
CVE-2026-43991 |
high | 8.4 | 0.0017 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based | |
CVE-2026-58459 |
high | 8.4 | 0.0286 | 2026-07-09 | gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in | |
CVE-2026-15895 |
high | 8.4 | 0.0108 | 2026-07-15 | OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allo | |
CVE-2026-14881 |
high | 8.4 | 0.0021 | 2026-07-22 | When importing connections in Compass it is possible to override some connection options that are ot | |
CVE-2026-115414 |
high | 8.4 | 0.0088 | 2026-10-22 | OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who ca | |
CVE-2026-55786 |
high | 8.4 | 0.0026 | 2026-10-14 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, | |
CVE-2026-45369 |
high | 8.3 | 0.0032 | 2026-05-14 | python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method i | |
CVE-2026-17497 |
high | 8.3 | 0.0075 | 2026-07-26 | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, | |
CVE-2026-22621 |
high | 8.3 | 0.0058 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PA | |
CVE-2026-18235 |
high | 8.3 | 0.0054 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Contro | |
CVE-2026-35071 |
high | 8.2 | 0.0046 | 2026-05-12 | Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of spec | |
CVE-2026-44712 |
high | 8.2 | 0.0015 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a | |
CVE-2026-49260 |
high | 8.2 | 0.0021 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version | |
CVE-2026-41113 |
high | 8.1 | 0.0085 | 2026-04-16 | sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts | |
CVE-2026-49402 |
high | 8.1 | 0.0044 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_proces | |
CVE-2026-55173 |
high | 8.1 | 0.0268 | 2026-07-16 | WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS comman | |
CVE-2026-48719 |
high | 8.0 | 0.0132 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 until 0.2026.05.06.15. | |
CVE-2026-40711 |
high | 8.0 | 0.0135 | 2026-06-26 | Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-power | |
CVE-2026-113726 |
high | 7.8 | 0.0026 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash a | |
CVE-2026-113732 |
high | 7.8 | 0.0024 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActiva | |
CVE-2026-113776 |
high | 7.8 | 0.0027 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, | |
CVE-2026-118615 |
high | 7.8 | 0.0041 | 2026-10-28 | Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerabilit | |
CVE-2026-70335 |
high | 7.8 | 0.0046 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub |