On this page

Atomicorp WAF Rule 340023

Rule Summary

Rule ID: 340023
Status: Active
Alert message: Atomicorp.com WAF Rules: Attack Blocked - remote command execution
Observed CWEs: CWE-15 (1), CWE-20 (15), CWE-22 (23), CWE-59 (2), CWE-73 (9), CWE-74 (43), CWE-77 (174), CWE-78 (334), CWE-79 (8), CWE-83 (1), CWE-88 (8), CWE-89 (9), CWE-93 (2), CWE-94 (128), CWE-95 (10), CWE-96 (1), CWE-98 (1), CWE-116 (1), CWE-121 (2), CWE-183 (1), CWE-184 (4), CWE-200 (2), CWE-250 (3), CWE-266 (1), CWE-269 (7), CWE-276 (2), CWE-284 (11), CWE-285 (1), CWE-287 (3), CWE-288 (1), CWE-306 (18), CWE-321 (1), CWE-352 (6), CWE-362 (1), CWE-434 (29), CWE-470 (7), CWE-479 (1), CWE-494 (2), CWE-502 (24), CWE-552 (1), CWE-601 (1), CWE-641 (1), CWE-644 (1), CWE-693 (4), CWE-732 (2), CWE-791 (2), CWE-798 (1), CWE-829 (2), CWE-835 (1), CWE-862 (11), CWE-863 (2), CWE-913 (1), CWE-915 (2), CWE-918 (1), CWE-942 (2), CWE-1188 (2), CWE-1286 (1), CWE-1336 (7)
Revision: 7
Rule severity: Critical (2)
Phase: 2 (request body)
Request surfaces: Request URI, Request arguments, JSON request data, SOAP request data
Rule action: deny
HTTP status: 403
Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Attack Blocked - remote command execution” in the request URI, request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2024-13984	Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload	TianQing Management Center	10.0 (v4.0)	Critical
CVE-2025-34037	Linksys E-Series TheMoon Remote Command Injection	E4200	10.0 (v4.0)	Critical
CVE-2026-105134	Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection	cloud backup suite	10.0 (v4.0)	Critical
CVE-2026-108576	TOZED X300 IPPingDiagnostics process_ping os command injection	X300	10.0 (v4.0)	Critical
CVE-2026-19188	Haiwell IoT Cloud HMI Gateway OS Command Injection	Haiwell IoT Cloud HMI Gateway	10.0 (v4.0)	Critical
CVE-2026-26015	Unauthenticated RCE in DocsGPT MCP STDIO Configuration	docsgpt	10.0 (v4.0)	Critical
CVE-2026-34234	CtrlPanel <= 1.1.1 - Remote Code Execution	ctrlpanel	10.0 (v3.1)	Critical
CVE-2026-41900	OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment	openlearnx	10.0 (v3.1)	Critical
CVE-2026-44181	Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution	enterprise gateway	10.0 (v4.0)	Critical
CVE-2026-45087	Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode	dalfox	10.0 (v3.1)	Critical
CVE-2026-45829	ChromaDB Security Vulnerability	ChromaDB	10.0 (v4.0)	Critical
CVE-2026-47668	DbGate - Remote Code Execution via Anonymous JWT	dbgate	10.0 (v3.1)	Critical
CVE-2026-49869	Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`	kestra	10.0 (v3.1)	Critical
CVE-2026-57572	Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args	crawl4ai	10.0 (v3.1)	Critical
CVE-2026-7411	Eclipse BaSyx Arbitrary Code Execution Vulnerability	Eclipse BaSyx	10.0 (v3.1)	Critical
CVE-2026-81735	UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Executi	UI-TARS-desktop	10.0 (v4.0)	Critical
CVE-2026-8984	Unauthenticated RCE	maxicharger single charger firmware	10.0 (v4.0)	Critical
CVE-2026-8985	Unauthenticated Command Injection	maxicharger single charger firmware	10.0 (v4.0)	Critical
CVE-2025-11539	Arbitrary Code Execution in Grafana Image Renderer Plugin	grafana-image-renderer	9.9 (v3.1)	Critical
CVE-2026-105691	Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color	penpot	9.9 (v3.1)	Critical
CVE-2026-105697	Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration	langflow	9.9 (v3.1)	Critical
CVE-2026-105740	Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server	langflow	9.9 (v3.1)	Critical
CVE-2026-113708	Argo CD: A Kustomize remote ref can run commands in the repo-server	argo-cd	9.9 (v3.1)	Critical
CVE-2026-34838	Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`	group-office	9.9 (v3.1)	Critical
CVE-2026-40933	Flowise: Authenticated RCE Via MCP Adapters	flowise	9.9 (v3.1)	Critical
CVE-2026-44450	Lumiverse: RCE via MCP stdio argument injection	Lumiverse	9.9 (v3.1)	Critical
CVE-2026-45632	Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution	dokploy	9.9 (v3.1)	Critical
CVE-2026-46512	Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping	frogman	9.9 (v3.1)	Critical
CVE-2026-57155	OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer	core	9.9 (v3.1)	Critical
CVE-2026-63298	LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration	lxd	9.9 (v3.1)	Critical
CVE-2026-72868	Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection	dokploy	9.9 (v3.1)	Critical
CVE-2026-72869	Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE	dokploy	9.9 (v3.1)	Critical
CVE-2026-72882	Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers	dokploy	9.9 (v3.1)	Critical
CVE-2026-73263	Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path	prowler	9.9 (v3.1)	Critical
CVE-2026-73294	Semaphore U: OS Command Injection	semaphore	9.9 (v3.1)	Critical
CVE-2026-79920	Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task	ajenti	9.9 (v3.1)	Critical
CVE-2014-1203	Eyou E-Mail <3.6 - Remote Code Execution	eyou	9.8 (v3.1)	Critical
CVE-2015-4664	Xceedium Xsuite - Multiple Vulnerabilities	privileged access manager	9.8 (v3.0)	Critical
CVE-2015-4667	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	9.8 (v3.0)	Critical
CVE-2018-16763	FUEL CMS 1.4.1 - Remote Code Execution	fuel cms	9.8 (v3.1)	Critical
CVE-2019-12725	Zeroshell 3.9.0 - Remote Command Execution	zeroshell	9.8 (v3.0)	Critical
CVE-2019-15107	Webmin <= 1.920 - Unauthenticated Remote Command Execution	webmin	9.8 (v3.1)	Critical
CVE-2019-16920	D-Link Routers - Remote Code Execution	dir-655 firmware	9.8 (v3.1)	Critical
CVE-2020-15568	TerraMaster TOS <.1.29 - Remote Code Execution	tos	9.8 (v3.1)	Critical
CVE-2020-15920	Mida Solutions eFramework ajaxreq.php Command Injection	eframework	9.8 (v3.1)	Critical
CVE-2020-21224	Inspur ClusterEngine 4.0 - Remote Code Execution	clusterengine	9.8 (v3.1)	Critical
CVE-2020-29390	Zeroshell 3.9.3 - Command Injection	zeroshell	9.8 (v3.1)	Critical
CVE-2020-9054	Zyxel NAS Firmware 5.21- Remote Code Execution	nas326 firmware	9.8 (v3.1)	Critical
CVE-2022-31137	Roxy-WI < 6.1.1.0 - Remote Code Execution	roxy-wi	9.8 (v3.1)	Critical
CVE-2022-35914	GLPI htmLawed php command injection	glpi	9.8 (v3.1)	Critical
CVE-2022-44276	responsive filemanager Unrestricted Upload of File with Dangerous Type Vulnerability	responsive filemanager	9.8 (v3.1)	Critical
CVE-2024-53584	OpenPanel 0.3.4 - OS Command Injection	openpanel	9.8 (v3.1)	Critical
CVE-2024-7954	SPIP Unauthenticated RCE via porte_plume Plugin	SPIP	9.8 (v3.1)	Critical
CVE-2025-24893	XWiki Platform - Remote Code Execution	xwiki	9.8 (v3.1)	Critical
CVE-2025-65719	Open Source Kubectl MCP Server v1.1.1 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2025-66401	MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL	mcp watch	9.8 (v3.1)	Critical
CVE-2025-66455	LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/con	lmdeploy	9.8 (v3.1)	Critical
CVE-2026-104586	AUTOM8N (WHM/cPanel plugin) through commit 82821f7 Command Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-104798	My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'a	My Calendar – Accessible Event Manager	9.8 (v3.1)	Critical
CVE-2026-110392	Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning	QA-Board	9.8 (v3.1)	Critical
CVE-2026-12940	Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoint	langflow	9.8 (v3.1)	Critical
CVE-2026-18482	neo-mjs Command Injection Vulnerability	neo-mjs	9.8 (v3.1)	Critical
CVE-2026-19912	Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability	Kaltura HTML5 Video Player, html5 library	9.8 (v3.1)	Critical
CVE-2026-30993	Slah CMS v1.5.0 and below Arbitrary Code Execution Vulnerability	Slah CMS v1.5.0 and below	9.8 (v3.1)	Critical
CVE-2026-31040	stata-mcp Code Injection Vulnerability	stata-mcp	9.8 (v3.1)	Critical
CVE-2026-3296	Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata	Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder	9.8 (v3.1)	Critical
CVE-2026-35048	Piwigo RCE via PHP Code Injection into Config File in Installer	Piwigo	9.8 (v3.1)	Critical
CVE-2026-35847	the CheckUils.php file Arbitrary Code Execution Vulnerability	the CheckUils.php file	9.8 (v3.1)	Critical
CVE-2026-37281	the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 Command Injection Vulnerability	the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0	9.8 (v3.1)	Critical
CVE-2026-38431	erpnext Code Injection Vulnerability	erpnext	9.8 (v3.1)	Critical
CVE-2026-3960	Remote Code Execution in h2oai/h2o-3	h2o	9.8 (v3.1)	Critical
CVE-2026-45018	Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution	chainlit	9.8 (v3.1)	Critical
CVE-2026-46562	Yamcs: Remote Code Execution via Mission Database algorithm override	yamcs	9.8 (v3.1)	Critical
CVE-2026-47391	PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-48687	fastnetmon Command Injection Vulnerability	fastnetmon	9.8 (v3.1)	Critical
CVE-2026-51866	Code Injection	-	9.8 (v3.1)	Critical
CVE-2026-51911	vanna v2.0.2 Code Injection Vulnerability	vanna v2.0.2	9.8 (v3.1)	Critical
CVE-2026-55573	e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain	e107	9.8 (v3.1)	Critical
CVE-2026-57124	PraisonAI UI MCP connect endpoint allows unauthenticated local command execution	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-57131	praisonai: Jobs API exposes agent-execution endpoints with no authentication	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-62379	OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback	OpenAM	9.8 (v3.1)	Critical
CVE-2026-67827	Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-67919	Halo 2.25.4 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-72592	dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload	phpfm	9.8 (v3.1)	Critical
CVE-2026-75031	Interchange Arbitrary Code Execution Vulnerability	Interchange	9.8 (v3.1)	Critical
CVE-2026-75411	JeecgBoot v3.9.2 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-75414	In AntFlow V2.0.0, ActivitiTest.java Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-79408	MetaGPT 0.8.1 Command Injection Vulnerability	MetaGPT 0.8.1	9.8 (v3.1)	Critical
CVE-2026-79538	metatool-ai MetaMCP up to and including 2.4.22 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-83627	Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via	Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals \| Critical CSS \| Minify CSS \| Defer CSS Javascript \| CDN	9.8 (v3.1)	Critical
CVE-2026-84372	Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections	predis	9.8 (v3.1)	Critical
CVE-2026-86793	SGLang Unsafe Deserialization Vulnerability	SGLang	9.8 (v3.1)	Critical
CVE-2026-88393	WookTeam 1.6.6 and Earlier Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-34449	SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection	siyuan	9.6 (v3.1)	Critical
CVE-2026-48519	Langflow: Unauthenticated RCE in Shareable Playgrounds	langflow	9.6 (v3.1)	Critical
CVE-2026-53649	Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE	joro	9.6 (v3.1)	Critical
CVE-2026-72878	Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments	dokploy	9.6 (v3.1)	Critical
CVE-2026-88062	OmniRoute < 3.8.49 - Unauthenticated RCE	OmniRoute	9.5 (v4.0)	Critical
CVE-2026-8986	Command Injection via Malicious OCPP Server	maxicharger single charger firmware	9.5 (v4.0)	Critical
CVE-2025-34292	BeWelcome/Rox PHP Object Injection RCE	Rox	9.4 (v4.0)	Critical
CVE-2025-62593	Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack	ray	9.4 (v4.0)	Critical
CVE-2025-66210	Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import	coolify	9.4 (v4.0)	Critical
CVE-2026-100714	Froxlor before 2.3.12 Command Injection via letsencryptchallengepath	froxlor	9.4 (v4.0)	Critical
CVE-2026-103056	AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR	AiSOC	9.4 (v4.0)	Critical
CVE-2026-33324	SQLBot prompt injection allows arbitrary SQL execution and remote code execution	sqlbot	9.4 (v4.0)	Critical
CVE-2026-45272	MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File	talebook	9.4 (v4.0)	Critical
CVE-2026-47670	DbGate - Remote Code Execution via Dynamic Import Bypass	dbgate	9.4 (v4.0)	Critical
CVE-2026-55413	ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution	ToolJet	9.4 (v4.0)	Critical
CVE-2026-58146	Unauthorized remote code execution in T-Mobile 5G Box IDU routers	T-Mobile 5G Box IDU	9.4 (v4.0)	Critical
CVE-2026-66398	phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API	phpMyFAQ	9.4 (v4.0)	Critical
CVE-2026-6644	A command injection vulnerability was found in the PPTP VPN Clients on the ADM	data master	9.4 (v4.0)	Critical
CVE-2026-72879	Dokploy: Command Injection via Registry Credentials in Swarm Upload	dokploy	9.4 (v4.0)	Critical
CVE-2026-73041	SiYuan before v3.7.4 Remote Code Execution via PDF Annotations	siyuan	9.4 (v4.0)	Critical
CVE-2026-73042	SiYuan before v3.7.4 Remote Code Execution via Menu Metadata	siyuan	9.4 (v4.0)	Critical
CVE-2026-73483	Flowise before 3.1.3 Sandbox Escape via Puppeteer	flowise	9.4 (v4.0)	Critical
CVE-2026-82244	Budibase before 3.41.3 Remote Code Execution via Plugin eval()	server	9.4 (v4.0)	Critical
CVE-2026-93985	OpenPanel js-runtime JavaScript Template Sandbox Escape RCE	openpanel	9.4 (v4.0)	Critical
CVE-2009-20006	osCommerce 2.2 Arbitrary PHP Code Execution	osCommerce	9.3 (v4.0)	Critical
CVE-2009-20010	Dogfood CRM spell.php RCE	Dogfood CRM	9.3 (v4.0)	Critical
CVE-2018-25114	osCommerce 2.3.4.1 - Remote Code Execution	Online Merchant	9.3 (v4.0)	Critical
CVE-2018-25357	Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php	dolibarr erp/crm	9.3 (v4.0)	Critical
CVE-2019-25687	Pegasus CMS 1.0 Remote Code Execution via extra_fields.php	pegasus cms	9.3 (v4.0)	Critical
CVE-2023-54398	Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet	U8 Cloud	9.3 (v4.0)	Critical
CVE-2024-0012	Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution	pan-os	9.3 (v4.0)	Critical
CVE-2024-58348	WordPress Background Image Cropper 1.2 Remote Code Execution	Background Image Cropper	9.3 (v4.0)	Critical
CVE-2025-10364	Unauthenticated Arbitrary Command Injection in Evertz SDVN	3080ipx-10G	9.3 (v4.0)	Critical
CVE-2025-31114	Fooocus webui vulnerable to Remote Code Execution	Fooocus	9.3 (v4.0)	Critical
CVE-2025-66571	UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection	UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4	9.3 (v4.0)	Critical
CVE-2025-71284	Synway SMG Gateway Management Software OS Command Injection via radius_address	smg gateway management software	9.3 (v4.0)	Critical
CVE-2025-71336	Flowise - Unsandboxed Remote Code Execution via Custom MCP	flowise	9.3 (v4.0)	Critical
CVE-2025-71429	GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py	GPT-SoVITS	9.3 (v4.0)	Critical
CVE-2026-101001	Netcore NBR200V2 Web Management network_tools eval os command injection	NBR200V2	9.3 (v4.0)	Critical
CVE-2026-101072	Netcore NR289-GE CGI ap_ip.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-101075	Netcore NR289-GE Location Time location_time.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-101076	Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-105110	Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter	Innbox	9.3 (v4.0)	Critical
CVE-2026-12257	Remote code execution in Mura Software’s CMS	CMS	9.3 (v4.0)	Critical
CVE-2026-19586	Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways	er7212pc firmware	9.3 (v4.0)	Critical
CVE-2026-35047	Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint	bravecms	9.3 (v4.0)	Critical
CVE-2026-41315	mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command I	mdserver-web	9.3 (v4.0)	Critical
CVE-2026-41923	WDR201A WiFi Extender OS Command Injection via internet.cgi	WDR201A WiFi Extender	9.3 (v4.0)	Critical
CVE-2026-41925	WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)	WDR201A WiFi Extender	9.3 (v4.0)	Critical
CVE-2026-44402	Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi	SNMP Web Pro	9.3 (v4.0)	Critical
CVE-2026-48768	TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName	typebot.io	9.3 (v3.1)	Critical
CVE-2026-53975	OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec	OpenChamber	9.3 (v4.0)	Critical
CVE-2026-58147	Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers	T-Mobile 5G Box IDU	9.3 (v4.0)	Critical
CVE-2026-58457	Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp	M300 Wi-Fi Repeater	9.3 (v4.0)	Critical
CVE-2026-60121	Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php	flamingo	9.3 (v4.0)	Critical
CVE-2026-61498	Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php	flamingo	9.3 (v4.0)	Critical
CVE-2026-61511	vBulletin 6.x - Remote Code Execution	vBulletin	9.3 (v4.0)	Critical
CVE-2026-63766	GPT-SoVITS 20250606v2pro OS Command Injection via webui.py	GPT-SoVITS	9.3 (v4.0)	Critical
CVE-2026-64625	AVideo before 29.0 OS Command Injection via execAsync	AVideo	9.3 (v4.0)	Critical
CVE-2026-64824	Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore	Home Assistant Core	9.3 (v4.0)	Critical
CVE-2026-70553	MaxSite CMS Unauthenticated RCE via Install Endpoint	MaxSite CMS	9.3 (v4.0)	Critical
CVE-2026-71921	DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi	VigorSwitch G2540xs	9.3 (v4.0)	Critical
CVE-2026-71956	D-Link DWR-M961 Command Injection via app.cgi	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71984	MSI Radix AXE6600 v781521 Command Injection via urlfilter	Radix AXE6600	9.3 (v4.0)	Critical
CVE-2026-71992	MSI Radix AXE6600 v781521 Command Injection via macfilter	Radix AXE6600	9.3 (v4.0)	Critical
CVE-2026-72710	SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection	SPIP	9.3 (v4.0)	Critical
CVE-2026-76071	Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter	NC63	9.3 (v4.0)	Critical
CVE-2026-85520	Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module	Google Merchant Center Feed	9.3 (v4.0)	Critical
CVE-2026-89026	Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate	Issabel Framework	9.3 (v4.0)	Critical
CVE-2026-89308	Arbitrary command execution in TrxTimeATTENDANCE	TrxTimeATTENDANCE	9.3 (v4.0)	Critical
CVE-2026-9209	mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx	mJobTime	9.3 (v4.0)	Critical
CVE-2026-10042	manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model	manga-image-translator	9.2 (v4.0)	Critical
CVE-2026-114053	vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision	vllm	9.2 (v4.0)	Critical
CVE-2026-63304	AVideo through 29.0 OS Command Injection via listFFmpegProcesses	AVideo	9.2 (v4.0)	Critical
CVE-2026-63305	AVideo through 29.0 OS Command Injection via ffmpeg.json.php	AVideo	9.2 (v4.0)	Critical
CVE-2026-80138	ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter	clipbucket-v5	9.2 (v4.0)	Critical
CVE-2026-82531	Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache	smarty	9.2 (v4.0)	Critical
CVE-2026-87930	MaxSite CMS through 109.6 PHP Object Injection via ci_session	MaxSite CMS	9.2 (v4.0)	Critical
CVE-2025-65473	easyimages2.0 Arbitrary Code Execution Vulnerability	easyimages2.0	9.1 (v3.1)	Critical
CVE-2025-66203	StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection	streamvault	9.1 (v3.1)	Critical
CVE-2026-12486	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12849	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12850	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12851	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-37637	Alexantr filemanager v.1.0 Arbitrary Code Execution Vulnerability	-	9.1 (v3.1)	Critical
CVE-2026-39353	InvoicePlane: Remote Code Execution via Writable Templates Directory	InvoicePlane	9.1 (v3.1)	Critical
CVE-2026-40484	ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function	CRM	9.1 (v3.1)	Critical
CVE-2026-42555	Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users	valtimo	9.1 (v3.1)	Critical
CVE-2026-46621	Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection	yamcs	9.1 (v3.1)	Critical
CVE-2026-47168	EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params	espocrm	9.1 (v3.1)	Critical
CVE-2026-50006	Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in	anyquery	9.1 (v3.1)	Critical
CVE-2026-55511	Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`	yamcs	9.1 (v3.1)	Critical
CVE-2026-57499	Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)	core	9.1 (v3.1)	Critical
CVE-2026-58400	GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter	core-geonetwork	9.1 (v3.1)	Critical
CVE-2026-58409	ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload	CRM	9.1 (v3.1)	Critical
CVE-2026-79766	Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email	Termix	9.1 (v3.1)	Critical
CVE-2026-79916	MaxKB AWS Bedrock model credential injection leads to remote code execution	MaxKB	9.1 (v3.1)	Critical
CVE-2025-9501	W3 Total Cache < 2.8.13 - Unauthenticated Command Injection	W3 Total Cache	9.0 (v3.1)	Critical
CVE-2026-102608	ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)	zoneminder	9.0 (v3.1)	Critical
CVE-2026-14602	Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter	Remote API	9.0 (v3.1)	Critical
CVE-2026-42238	Unauthenticated Remote Code Execution via Backup Restore in nginx-ui	nginx ui	9.0 (v4.0)	Critical
CVE-2026-45630	Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement	dokploy	9.0 (v3.1)	Critical
CVE-2026-47252	Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)	anyquery	9.0 (v3.1)	Critical
CVE-2026-73485	Flowise before 3.1.3 Remote Code Execution via Airtable Agent	flowise	9.0 (v4.0)	Critical
CVE-2026-73486	Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV	flowise	9.0 (v4.0)	Critical
CVE-2026-73487	Flowise before 3.1.3 Prompt Injection RCE via CSV Agent	flowise	9.0 (v4.0)	Critical
CVE-2026-91931	Flowise before 3.1.4 Remote Code Execution via Custom MCP npx	Flowise	9.0 (v4.0)	Critical
CVE-2026-33765	Pi-hole Web Interface has a Command Injection Vulnerability	web interface	8.9 (v4.0)	High
CVE-2026-41304	WWBN AVideo vulnerable to RCE caused by clonesite plugin	avideo	8.9 (v4.0)	High
CVE-2026-43945	FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection	FUXA	8.9 (v4.0)	High
CVE-2026-5850	Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5851	Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5852	Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5853	Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5854	Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5975	Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5976	Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5977	Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5978	Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5993	Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5994	Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5996	Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5997	Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6025	Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6026	Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6028	Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6029	Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6112	Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6113	Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6114	Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6115	Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6116	Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6131	Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6132	Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6138	Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6139	Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6140	Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6154	Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6155	Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6156	Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6195	Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-7121	Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7122	Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7123	Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7124	Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7125	Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7136	Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7137	Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7138	Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7139	Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7140	Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7152	Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7153	Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7154	Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7155	Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7156	Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7202	Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7203	Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7204	Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7240	Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7241	Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7242	Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7243	Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7244	Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-73570	zimbra collaboration suite Arbitrary Code Execution Vulnerability	zimbra collaboration suite	8.9 (v3.1)	High
CVE-2026-7538	Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7823	Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9384	Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9385	Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9386	Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9387	Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9388	Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9404	Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9405	Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9406	Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9407	Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9432	Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9433	Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9434	Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9435	Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9436	Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9454	Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9455	Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9456	Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9457	Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9458	Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9476	Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9477	Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9478	Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2017-14535	Trixbox - 2.8.0.4 OS Command Injection	trixbox	8.8 (v3.1)	High
CVE-2017-6884	Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection	emg2926 firmware	8.8 (v3.1)	High
CVE-2020-15874	Command Injection	-	8.8 (v3.1)	High
CVE-2020-8163	Ruby on Rails <5.0.1 - Remote Code Execution	rails	8.8 (v3.1)	High
CVE-2023-2288	Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization	otter	8.8 (v3.1)	High
CVE-2024-39024	In Packetfence 13.2.0, the WebGui interface setting Arbitrary Code Execution Vulnerability	-	8.8 (v3.1)	High
CVE-2025-10706	Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	ClassifiedPro - reCommerce WordPress Theme	8.8 (v3.1)	High
CVE-2025-51457	D-Link DAP-2610 up to 2.06B08r099 Command Injection Vulnerability	D-Link DAP-2610 up to 2.06B08r099	8.8 (v3.1)	High
CVE-2025-59710	biztalk360 Arbitrary Code Execution Vulnerability	biztalk360	8.8 (v3.1)	High
CVE-2025-65471	easyimages2.0 Arbitrary Code Execution Vulnerability	easyimages2.0	8.8 (v3.1)	High
CVE-2025-66209	Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup	coolify	8.8 (v3.1)	High
CVE-2025-66438	erpnext Information Disclosure Vulnerability	erpnext	8.8 (v3.1)	High
CVE-2026-104851	fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution	filesystem spec	8.8 (v3.1)	High
CVE-2026-105106	Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task	Koha	8.8 (v3.1)	High
CVE-2026-108963	databasement Arbitrary Code Execution Vulnerability	databasement	8.8 (v3.1)	High
CVE-2026-110908	pfSense-pkg-frr Command Injection Vulnerability	pfSense-pkg-frr	8.8 (v3.1)	High
CVE-2026-113779	pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission	pfSense-pkg-RESTAPI	8.8 (v3.1)	High
CVE-2026-14357	DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Ex	DevKit Pro	8.8 (v3.1)	High
CVE-2026-17196	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute	Super Forms – Drag & Drop Form Builder	8.8 (v3.1)	High
CVE-2026-24893	openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion	openitcockpit	8.8 (v3.1)	High
CVE-2026-30971	ZoneMinder: Authenticated RCE via command injection in monitor Device Path	zoneminder	8.8 (v3.1)	High
CVE-2026-33704	Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint	chamilo lms	8.8 (v3.1)	High
CVE-2026-34057	Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name	coolify	8.8 (v3.1)	High
CVE-2026-34153	Coolify LocalFileVolume fs_path command injection enables RCE	coolify	8.8 (v3.1)	High
CVE-2026-34158	Coolify: Command injection via single-quote breakout in Docker Compose custom commands	coolify	8.8 (v3.1)	High
CVE-2026-34197	Apache ActiveMQ Jolokia Remote Code Execution (CVE-2026-34197)	activemq	8.8 (v3.1)	High
CVE-2026-34594	Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management	coolify	8.8 (v3.1)	High
CVE-2026-34599	Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component	coolify	8.8 (v3.1)	High
CVE-2026-35196	Chamilo LMS has OS Command Injection via export_all_certificates action	chamilo lms	8.8 (v3.1)	High
CVE-2026-4327	The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_lo	The Welcomizer	8.8 (v3.1)	High
CVE-2026-45505	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass	activemq	8.8 (v3.1)	High
CVE-2026-45578	WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL	avideo	8.8 (v3.1)	High
CVE-2026-45662	Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)	dokploy	8.8 (v3.1)	High
CVE-2026-48017	DbGate: Remote Code Execution via functionName injection in loadReader endpoint	dbgate	8.8 (v3.1)	High
CVE-2026-52356	D-Link DAP1160L A1_FW101WWb04 Command Injection Vulnerability	D-Link DAP1160L A1 FW101WWb04	8.8 (v3.1)	High
CVE-2026-52483	OS Command Injection	-	8.8 (v3.1)	High
CVE-2026-54149	MaxKB MCP tool import validation bypass allows post-authentication remote code execution	MaxKB	8.8 (v3.1)	High
CVE-2026-55585	QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`	qwed-verification	8.8 (v3.1)	High
CVE-2026-57296	Jenkins External Workspace Manager Plugin Arbitrary Code Execution Vulnerability	Jenkins External Workspace Manager Plugin	8.8 (v3.1)	High
CVE-2026-58195	Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into ex	agentic-flow	8.8 (v3.1)	High
CVE-2026-62675	Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools	omnigent	8.8 (v3.1)	High
CVE-2026-65660	Microsoft SharePoint Server Remote Code Execution Vulnerability	sharepoint server	8.8 (v3.1)	High
CVE-2026-72875	Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile	dokploy	8.8 (v3.1)	High
CVE-2026-73222	Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio)	claude-code-templates	8.8 (v3.1)	High
CVE-2026-76801	FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation	FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment	8.8 (v3.1)	High
CVE-2026-77601	OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting	cosmos	8.8 (v3.1)	High
CVE-2026-78834	Code Injection	-	8.8 (v3.1)	High
CVE-2026-79423	seacms v13.6 Arbitrary Code Execution Vulnerability	seacms v13.6	8.8 (v3.1)	High
CVE-2026-82217	Eclipse Theia Path Traversal Vulnerability	Eclipse Theia	8.8 (v3.1)	High
CVE-2026-82804	Apache DolphinScheduler: Command Injection in the Alert Script Plugin	Apache DolphinScheduler	8.8 (v3.1)	High
CVE-2026-8365	Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy	Blocksy	8.8 (v3.1)	High
CVE-2026-84317	Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the o	nginx-ui	8.8 (v3.1)	High
CVE-2026-84318	Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE	nginx-ui	8.8 (v3.1)	High
CVE-2026-85731	oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)	oras-go	8.8 (v3.1)	High
CVE-2026-88622	NUUO Network Video Recorder 2.0.0 Command Injection Vulnerability	-	8.8 (v3.1)	High
CVE-2026-96795	Horilla: Authenticated RCE in Horilla List-View Export	horilla-hr	8.8 (v3.1)	High
CVE-2005-10004	Cacti graph_view.php Remote Command Execution	cacti	8.7 (v4.0)	High
CVE-2019-25671	VA MAX 8.3.4 Remote Code Execution via changeip.php	VA MAX	8.7 (v4.0)	High
CVE-2021-47938	ImpressCMS 1.4.2 Remote Code Execution via Autotasks	ImpressCMS	8.7 (v4.0)	High
CVE-2021-47943	TextPattern CMS 4.8.7 Remote Code Execution via File Upload	TextPattern CMS	8.7 (v4.0)	High
CVE-2022-50944	Aero CMS 0.0.1 PHP Code Injection via posts.php	Aero CMS	8.7 (v4.0)	High
CVE-2023-54350	WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated	Augmented Reality	8.7 (v4.0)	High
CVE-2025-30007	HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management	control panel	8.7 (v4.0)	High
CVE-2025-34311	IPFire < v2.29 Command Injection via Proxy Report Creation	ipfire	8.7 (v4.0)	High
CVE-2025-34312	IPFire < v2.29 Command Injection via URL Filter Blacklist	ipfire	8.7 (v4.0)	High
CVE-2025-34334	AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE	fax server	8.7 (v4.0)	High
CVE-2025-71260	BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE	footprints	8.7 (v4.0)	High
CVE-2026-100852	AzuraCast through 0.23.x Command Injection via Streamer Username	AzuraCast	8.7 (v4.0)	High
CVE-2026-100864	heym before 0.0.91 Remote Code Execution via Expression Engine	heym	8.7 (v4.0)	High
CVE-2026-105123	W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API	wcms	8.7 (v4.0)	High
CVE-2026-109308	Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection	cms	8.7 (v4.0)	High
CVE-2026-116009	Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action	camaleon-cms	8.7 (v4.0)	High
CVE-2026-116811	OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template	openpanel	8.7 (v4.0)	High
CVE-2026-34228	Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write	emlog	8.7 (v4.0)	High
CVE-2026-34735	Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`	wiki	8.7 (v4.0)	High
CVE-2026-34791	Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34792	Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34793	Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34795	Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34796	Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34797	Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-40488	OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution	magento	8.7 (v4.0)	High
CVE-2026-40521	FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload	FrontAccounting	8.7 (v4.0)	High
CVE-2026-41934	Vvveb < 1.0.8.2 Authenticated RCE via Code Editor	Vvveb	8.7 (v4.0)	High
CVE-2026-47722	nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml	nebula-mesh	8.7 (v4.0)	High
CVE-2026-49143	BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler	browserstack-runner	8.7 (v4.0)	High
CVE-2026-55094	Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)	taskcluster	8.7 (v4.0)	High
CVE-2026-58000	luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey	luci-proto-openvpn	8.7 (v4.0)	High
CVE-2026-58452	JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint	C492A-W6 Wi-Fi IP Camera	8.7 (v4.0)	High
CVE-2026-63722	ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php	ICEcoder	8.7 (v4.0)	High
CVE-2026-64837	ICEcoder through 8.1 OS Command Injection via lib/properties.php	ICEcoder	8.7 (v4.0)	High
CVE-2026-67206	Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload	wolfcms	8.7 (v4.0)	High
CVE-2026-69096	OpenWrt luci-app-dockerman Read ACL Remote Code Execution	luci	8.7 (v4.0)	High
CVE-2026-69100	LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution	lamp-cloud	8.7 (v4.0)	High
CVE-2026-71966	CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer	cyberpanel	8.7 (v4.0)	High
CVE-2026-71981	Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter	cypht	8.7 (v4.0)	High
CVE-2026-72819	Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload	grav	8.7 (v4.0)	High
CVE-2026-72830	Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass	grav	8.7 (v4.0)	High
CVE-2026-72870	Dokploy: Command Injection via Docker Credentials in buildRemoteDocker	dokploy	8.7 (v4.0)	High
CVE-2026-73680	Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename	Cockpit CMS	8.7 (v4.0)	High
CVE-2026-76060	OS Command Injection in PayRange API	Zoneminder	8.7 (v4.0)	High
CVE-2026-78416	Authenticated RCE via `condition.config` JSON cleanse bypass	cms	8.7 (v4.0)	High
CVE-2026-79756	Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform	nuclio	8.7 (v4.0)	High
CVE-2026-79987	Low-privilege RCE through element-search eager loading	cms	8.7 (v4.0)	High
CVE-2026-82278	BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once	bisheng	8.7 (v4.0)	High
CVE-2026-86732	Craft CMS before 5.10.12 Remote Code Execution via element-index	cms	8.7 (v4.0)	High
CVE-2026-90770	Spug through 3.4.0 Remote Code Execution via ping_check	spug	8.7 (v4.0)	High
CVE-2026-92580	AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF	AVideo	8.7 (v4.0)	High
CVE-2024-20353	adaptive security appliance software Denial of Service Vulnerability	adaptive security appliance software	8.6 (v3.1)	High
CVE-2025-12061	Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution	TAX SERVICE Electronic HDM	8.6 (v3.1)	High
CVE-2025-68455	Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior	craft cms	8.6 (v4.0)	High
CVE-2025-68700	RAGFlow Remote Code Execution Vulnerability	ragflow	8.6 (v4.0)	High
CVE-2026-102911	zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection	pi-llm-wiki	8.6 (v4.0)	High
CVE-2026-108540	OpenSpug File Transfer transfer os command injection	Spug	8.6 (v4.0)	High
CVE-2026-109108	Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection	WL-WN530BE1-A	8.6 (v4.0)	High
CVE-2026-109397	Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space	Thelia	8.6 (v4.0)	High
CVE-2026-111214	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php	pfsense	8.6 (v4.0)	High
CVE-2026-111217	Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID	pfsense	8.6 (v4.0)	High
CVE-2026-111218	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters	pfsense	8.6 (v4.0)	High
CVE-2026-113390	DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection	Vigor2960	8.6 (v4.0)	High
CVE-2026-22100	Comnand injection in OCPP ReserveLogin message	DC-80	8.6 (v4.0)	High
CVE-2026-40187	Authenticated RCE via Malicious eTemplate Upload in EGroupware	egroupware	8.6 (v4.0)	High
CVE-2026-41587	CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution	ci4ms	8.6 (v4.0)	High
CVE-2026-42785	OpenKM 6.3.12 Remote Code Execution via Administrative Scripting	OpenKM Community Edition	8.6 (v4.0)	High
CVE-2026-44011	Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior	cms	8.6 (v4.0)	High
CVE-2026-54710	FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)	freepbx	8.6 (v4.0)	High
CVE-2026-55182	LibreNMS: Remote Code Execution by Signal Alert Transportation Module	librenms	8.6 (v4.0)	High
CVE-2026-56382	Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController	cms	8.6 (v4.0)	High
CVE-2026-56703	Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO	adminer	8.6 (v4.0)	High
CVE-2026-61517	Netis NX10 OS Command Injection via Ping Diagnostic Handler	NX10	8.6 (v4.0)	High
CVE-2026-61523	WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor	WebsiteBaker CMS	8.6 (v4.0)	High
CVE-2026-63725	sysPass FileBackupService Authenticated OS Command Injection via Backup Path	sysPass	8.6 (v4.0)	High
CVE-2026-65693	Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates	microweber	8.6 (v4.0)	High
CVE-2026-65711	sysPass 3.2.11 Authenticated OS Command Injection via Backup Path	sysPass	8.6 (v4.0)	High
CVE-2026-67599	ClearOS 7.9 OS Command Injection via Log Viewer filter parameter	ClearOS	8.6 (v4.0)	High
CVE-2026-67608	Telenia TVox 26.5.3 OS Command Injection via action_audio.php	TVox	8.6 (v4.0)	High
CVE-2026-69088	Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint	grav	8.6 (v4.0)	High
CVE-2026-71906	DrayTek VigorAP Multiple Models OS Command Injection via setLan	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71907	DrayTek VigorAP Multiple Models OS Command Injection via setcamset	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71908	DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71913	DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71915	DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71918	DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71919	DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71923	DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71925	DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71926	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71927	DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71928	DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71929	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71930	DrayTek VigorSwitch Multiple Models OS Command Injection via setTime	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71943	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-73664	FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module	backup	8.6 (v4.0)	High
CVE-2026-75121	PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-75123	PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_post	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-84194	LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname	librenms	8.6 (v4.0)	High
CVE-2026-85223	D-Link DNS-340L CGI dropbox.cgi os command injection	DNS-340L	8.6 (v4.0)	High
CVE-2026-86437	Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload	laradashboard	8.6 (v4.0)	High
CVE-2026-86733	Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore	snipe-it	8.6 (v4.0)	High
CVE-2025-34332	AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE	fax server	8.5 (v4.0)	High
CVE-2025-34333	AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE	fax server	8.5 (v4.0)	High
CVE-2026-101009	aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection	BaoTa	8.5 (v4.0)	High
CVE-2026-22244	OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE	openmetadata	8.5 (v4.0)	High
CVE-2026-82691	D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection	DNS-320L	8.5 (v4.0)	High
CVE-2026-104078	Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass	Obsidian Desktop	8.4 (v4.0)	High
CVE-2026-55786	Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`	flyto-core	8.4 (v3.1)	High
CVE-2024-58274	CSMP iSecure Center OS Command Injection Vulnerability	CSMP iSecure Center	8.3 (v3.1)	High
CVE-2025-59711	biztalk360 Path Traversal Vulnerability	biztalk360	8.3 (v3.1)	High
CVE-2026-49471	Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE	serena	8.3 (v3.1)	High
CVE-2026-15983	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter	Super Forms – Drag & Drop Form Builder	8.1 (v3.1)	High
CVE-2026-19942	Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta	Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback	8.1 (v3.1)	High
CVE-2026-42588	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector	activemq	8.1 (v3.1)	High
CVE-2026-47398	PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-20	PraisonAI	8.1 (v3.1)	High
CVE-2026-48695	fastnetmon Command Injection Vulnerability	fastnetmon	8.1 (v3.1)	High
CVE-2026-55173	AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving	AVideo	8.1 (v3.1)	High
CVE-2026-71320	Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props	nuxt	8.1 (v3.1)	High
CVE-2015-4669	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	7.8 (v3.0)	High
CVE-2026-67179	Genkit improper host header validation	genkit	7.8 (v3.1)	High
CVE-2025-27621	UpTrain has a Constant Default API Key	uptrain	7.7 (v4.0)	High
CVE-2026-108161	FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download	fusionpbx	7.7 (v4.0)	High
CVE-2026-32271	Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget	commerce	7.7 (v4.0)	High
CVE-2026-40519	Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()	nginx-proxy-manager	7.7 (v4.0)	High
CVE-2026-42099	Race Condition in Sparx Pro Cloud Server	pro cloud server	7.7 (v4.0)	High
CVE-2026-57999	luci-app-tailscale-community - Command Injection via tailscale.do_login RPC	luci-app-tailscale-community	7.7 (v4.0)	High
CVE-2026-66738	SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite	SPIP	7.7 (v4.0)	High
CVE-2026-93872	Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter	Cotonti	7.7 (v4.0)	High
CVE-2025-63950	twittodon Unsafe Deserialization Vulnerability	twittodon	7.5 (v3.1)	High
CVE-2025-63951	phoniebox Unsafe Deserialization Vulnerability	phoniebox	7.5 (v3.1)	High
CVE-2026-107812	Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or M	nginx ui	7.5 (v3.1)	High
CVE-2026-111221	Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection	pfsense	7.5 (v4.0)	High
CVE-2026-19913	Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability	Kaltura HTML5 Video Player, html5lib library	7.5 (v3.1)	High
CVE-2026-34239	Chamilo Authenticated Remote Code Execution	chamilo-lms	7.5 (v4.0)	High
CVE-2026-36783	Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to Denial of Service Vulnerability	-	7.5 (v3.1)	High
CVE-2026-46581	mojarra Path Traversal Vulnerability	mojarra	7.5 (v3.1)	High
CVE-2026-51078	Dede CMS v.5.7.118 Information Disclosure Vulnerability	-	7.5 (v3.1)	High
CVE-2026-53599	Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mo	core	7.5 (v3.1)	High
CVE-2026-101860	RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management	raspap-webgui	7.4 (v4.0)	High
CVE-2026-10870	Shibby Tomato Web UI rc start_dhcpc os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-10871	Shibby Tomato Web UI rc start_6rd_tunnel os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-10873	Shibby Tomato Web UI rstats rstats_path os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-18900	H3C NX15 Backend RPC esps file.exec os command injection	NX15	7.3 (v4.0)	High
CVE-2026-19771	Baicells EG3661M LuCI Web luci os command injection	EG3661M	7.3 (v4.0)	High
CVE-2026-36540	Netis AC1200 Router NC21 V4.0.1.4296 Arbitrary Code Execution Vulnerability	-	7.3 (v3.1)	High
CVE-2026-53554	SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing	SQLBot	7.3 (v4.0)	High
CVE-2025-48868	Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive	horilla	7.2 (v3.1)	High
CVE-2025-58762	Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent	tautulli	7.2 (v3.1)	High
CVE-2025-62429	ClipBucket v5 executes arbitrary PHP code	clipbucket	7.2 (v3.1)	High
CVE-2026-29782	OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2	openstamanager	7.2 (v3.1)	High
CVE-2026-6020	ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API	ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin	7.2 (v3.1)	High
CVE-2026-71284	Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename	fledge	7.2 (v3.1)	High
CVE-2026-7693	Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter	Backup Migration	7.2 (v3.1)	High
CVE-2026-81669	IBM Guardium Data Protection is affected by multiple vulnerabilities.	guardium data protection	7.2 (v3.1)	High
CVE-2026-92263	SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/resto	SparkyFitness	7.2 (v3.1)	High
CVE-2026-96896	Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request	Malcure Malware Shield — Removal, Repair, Monitor	7.2 (v3.1)	High
CVE-2026-9777	ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability	unizon	7.2 (v3.0)	High
CVE-2026-48997	e107: Command Injection via shell expansion in ImageMagick resize destination path	e107	7.1 (v3.1)	High
CVE-2026-71964	CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload	cyberpanel	7.1 (v4.0)	High
CVE-2026-77939	Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint	flextype	7.1 (v4.0)	High
CVE-2024-9474	Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution	pan-os	6.9 (v4.0)	Medium
CVE-2025-71257	BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass	footprints itsm	6.9 (v4.0)	Medium
CVE-2026-11450	GL.iNet GL-MT3000 Path Normalization dlopen command injection	GL-MT3000	6.9 (v4.0)	Medium
CVE-2026-19983	GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection	A1300	6.9 (v4.0)	Medium
CVE-2026-5739	PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection	PowerJob	6.9 (v4.0)	Medium
CVE-2026-97865	Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization	Open-Web-Analytics	6.9 (v4.0)	Medium
CVE-2025-59709	biztalk360 Path Traversal Vulnerability	biztalk360	6.8 (v3.1)	Medium
CVE-2026-10821	Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE	Yoast SEO Premium	6.6 (v3.1)	Medium
CVE-2026-34216	CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php	panel	6.6 (v3.1)	Medium
CVE-2026-79761	Termix: Command injection in SSH key deployment verification	Termix	6.6 (v3.1)	Medium
CVE-2025-11372	LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	6.5 (v3.1)	Medium
CVE-2025-14545	YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation	YML for Yandex Market	6.5 (v3.1)	Medium
CVE-2026-40909	WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Dir	avideo	6.5 (v3.1)	Medium
CVE-2026-4502	Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API	langflow desktop	6.5 (v3.1)	Medium
CVE-2026-55679	WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection	WeGIA	6.5 (v3.1)	Medium
CVE-2026-72739	Dokploy: Command Injection via Compose Shell Execution	dokploy	6.5 (v3.1)	Medium
CVE-2025-7825	Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation	Schema Plugin For Divi, Gutenberg & Shortcodes	6.3 (v3.1)	Medium
CVE-2026-44287	FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*(/ is bypassable	FastGPT	6.3 (v3.1)	Medium
CVE-2026-45626	Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter	arcane	6.3 (v3.1)	Medium
CVE-2015-4668	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	6.1 (v3.0)	Medium
CVE-2026-47250	mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration	mcp-server-kubernetes	6.1 (v3.1)	Medium
CVE-2025-13439	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserializatio	Fancy Product Designer	5.9 (v3.1)	Medium
CVE-2025-13786	taosir WTCMS index.php fetch code injection	wtcms	5.5 (v4.0)	Medium
CVE-2025-13792	Qualitor getResumo.php eval code injection	the file /html/st/stdeslocamento/request/getResumo.php	5.5 (v4.0)	Medium
CVE-2026-10214	zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection	chatgpt-on-wechat	5.5 (v4.0)	Medium
CVE-2026-102874	HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection	AnyTool	5.5 (v4.0)	Medium
CVE-2026-11344	code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload	Vehicle Management System	5.5 (v4.0)	Medium
CVE-2026-18641	Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginC	Operation and Maintenance Security Management System	5.5 (v4.0)	Medium
CVE-2026-19379	EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection	ipTIME AX8004M	5.5 (v4.0)	Medium
CVE-2026-5333	DefaultFuction Content-Management-System tools.php command injection	content management system	5.5 (v4.0)	Medium
CVE-2026-54611	InstantCMS has Remote Code Execution in package installer	icms2	5.5 (v3.1)	Medium
CVE-2026-5631	assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection	gpt-researcher	5.5 (v4.0)	Medium
CVE-2026-5677	Totolink A7100RU cstecgi.cgi CsteSystem os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5678	Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5688	Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5689	Totolink A7100RU cstecgi.cgi setNtpCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5690	Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5691	Totolink A7100RU cstecgi.cgi setFirewallType os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5692	Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5736	PowerJob detailPlus Endpoint InstanceController.java sql injection	PowerJob	5.5 (v4.0)	Medium
CVE-2026-5741	suvarchal docker-mcp-server HTTP index.ts pull_image os command injection	docker-mcp-server	5.5 (v4.0)	Medium
CVE-2026-5802	idachev mcp-javadc HTTP os command injection	mcp-javadc	5.5 (v4.0)	Medium
CVE-2026-7061	Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection	chatgpt-mcp-server	5.5 (v4.0)	Medium
CVE-2026-7064	AgentDeskAI browser-tools-mcp browser-connector.ts os command injection	browser-tools-mcp	5.5 (v4.0)	Medium
CVE-2026-7066	choieastsea simple-openstack-mcp server.py exec_openstack os command injection	simple-openstack-mcp	5.5 (v4.0)	Medium
CVE-2026-7220	jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection	FastlyMCP	5.5 (v4.0)	Medium
CVE-2026-7416	PolarVista xcode-mcp-server MCP index.ts run_tests os command injection	xcode-mcp-server	5.5 (v4.0)	Medium
CVE-2026-7443	BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection	mcp-dnstwist	5.5 (v4.0)	Medium
CVE-2026-7590	eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection	p 69 branch monkey mcp	5.5 (v4.0)	Medium
CVE-2026-7630	innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication	InnoShop	5.5 (v4.0)	Medium
CVE-2026-76760	chenhg5 cc-connect webhook.go authenticate code injection	cc-connect	5.5 (v4.0)	Medium
CVE-2026-76761	chenhg5 cc-connect Management API engine.go shellExecCommand os command injection	cc-connect	5.5 (v4.0)	Medium
CVE-2026-7698	Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection	Easy7 Integrated Management Platform	5.5 (v4.0)	Medium
CVE-2026-82598	SeaCMS Template search.php parseIf code injection	SeaCMS	5.5 (v4.0)	Medium
CVE-2026-85137	SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection	SeaCMS	5.5 (v4.0)	Medium
CVE-2026-90617	GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection	PentestAgent	5.5 (v4.0)	Medium
CVE-2026-90690	0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection	HexStrike AI	5.5 (v4.0)	Medium
CVE-2026-90843	SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection	WebMap	5.5 (v4.0)	Medium
CVE-2026-9474	yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection	StudentManagementSystem	5.5 (v4.0)	Medium
CVE-2026-54543	Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields	froxlor	5.4 (v3.1)	Medium
CVE-2026-58391	OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout	core	5.4 (v3.1)	Medium
CVE-2023-7299	DataGear resolveSql sql injection	datagear	5.3 (v4.0)	Medium
CVE-2025-10097	SimStudioAI sim route.ts code injection	sim	5.3 (v4.0)	Medium
CVE-2026-19785	francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection	RosarioSIS	5.3 (v4.0)	Medium
CVE-2026-29202	cPanel Code Injection Vulnerability	cPanel	5.3 (v4.0)	Medium
CVE-2015-4666	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	5.0 (v2.0)	Medium
CVE-2026-112949	Vitest: Code injection via unauthenticated manual mock registration	vitest	4.7 (v3.1)	Medium
CVE-2015-4665	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	4.3 (v2.0)	Medium
CVE-2025-63739	rockoa Improper Access Control Vulnerability	rockoa	4.3 (v3.1)	Medium
CVE-2026-36239	PbootCMS v.3.2.11 Cross-site Scripting Vulnerability	PbootCMS v.3.2.11	4.3 (v3.1)	Medium
CVE-2026-16297	Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import	Clearfy Cache	4.1 (v3.1)	Medium
CVE-2023-3360	Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection	Weaver Show Posts	3.3 (v3.1)	Low
CVE-2026-42201	Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands	coolify	3.3 (v3.1)	Low
CVE-2025-14276	Ilevia EVE X1 Server leaf_search.php command injection	EVE X1 Server	2.9 (v4.0)	Low
CVE-2025-11138	mirweiye wenkucms common.php createPathOne os command injection	wenkucms	2.1 (v4.0)	Low
CVE-2025-11903	yanyutao0402 ChanCMS update sql injection	chancms	2.1 (v4.0)	Low
CVE-2025-11905	yanyutao0402 ChanCMS gather.js getArticle code injection	chancms	2.1 (v4.0)	Low
CVE-2025-14204	TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command inje	cherry-studio-TykoFork	2.1 (v4.0)	Low
CVE-2025-14731	CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine	ctcms	2.1 (v4.0)	Low
CVE-2026-10172	Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload	Multi-Store Inventory Management System	2.1 (v4.0)	Low
CVE-2026-101861	Langflow Code Execution via eval() in Component Input Schema	langflow	2.1 (v4.0)	Low
CVE-2026-10279	hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection	wezterm-mcp	2.1 (v4.0)	Low
CVE-2026-105329	TallCMS PluginManager ThemeManager.php code injection	TallCMS	2.1 (v4.0)	Low
CVE-2026-111986	AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection	stable-diffusion-webui	2.1 (v4.0)	Low
CVE-2026-112078	RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection	Retrieval-based-Voice-Conversion-WebUI	2.1 (v4.0)	Low
CVE-2026-11408	vertex-app vertex Log Viewer Endpoint LogMod.js os command injection	vertex	2.1 (v4.0)	Low
CVE-2026-12814	Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection	CF-WR631AX V3	2.1 (v4.0)	Low
CVE-2026-14691	SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code inject	Multi-Vendor Online Grocery Management System	2.1 (v4.0)	Low
CVE-2026-14698	SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload	Syllabus-Aligned Learning Management and Examination System	2.1 (v4.0)	Low
CVE-2026-15496	SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection	sonic-agent	2.1 (v4.0)	Low
CVE-2026-19932	DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection	Notice-System-Managent	2.1 (v4.0)	Low
CVE-2026-19958	iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection	pptr-mcp	2.1 (v4.0)	Low
CVE-2026-5351	Trendnet TEW-657BRM setup.cgi add_wps_client os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5352	Trendnet TEW-657BRM setup.cgi edit os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5353	Trendnet TEW-657BRM setup.cgi ping_test os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5354	Trendnet TEW-657BRM setup.cgi vpn_connect os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5355	Trendnet TEW-657BRM setup.cgi vpn_drop os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-6489	QueryMine sms Background Management addteacher.php unrestricted upload	sms	2.1 (v4.0)	Low
CVE-2026-7508	Bootstrap CMS Page Creation show.blade.php code injection	CMS	2.1 (v4.0)	Low
CVE-2026-7642	pskill9 website-downloader MCP index.ts download_website os command injection	website-downloader	2.1 (v4.0)	Low
CVE-2026-78166	provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection	kafka-ui	2.1 (v4.0)	Low
CVE-2026-8188	Wavlink NU516U1 adm.cgi change_wifi_password os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8189	Wavlink NU516U1 adm.cgi wzdrepeater os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8190	Wavlink NU516U1 adm.cgi wan os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8191	Wavlink NU516U1 adm.cgi wifi_region os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8192	Wavlink NU516U1 adm.cgi wzdap os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8227	Wavlink NU516U1 adm.cgi wzdapMesh os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8228	Wavlink NU516U1 wireless.cgi advance os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8229	Wavlink NU516U1 wireless.cgi WifiBasic os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8230	Wavlink NU516U1 login.cgi sys_login1 os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-90488	Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection	xxl-job	2.1 (v4.0)	Low
CVE-2026-90581	cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection	nginxWebUI	2.1 (v4.0)	Low
CVE-2026-91853	TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection	X5000R	2.1 (v4.0)	Low
CVE-2026-92993	Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection	mayfly-go	2.1 (v4.0)	Low
CVE-2026-9302	546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection	vps-inventory-monitoring	2.1 (v4.0)	Low
CVE-2026-9511	Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9512	Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9514	Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9515	Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9531	Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9532	Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9533	Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9534	Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2025-11141	Ruijie NBR2100G-E branch_passw.php listAction os command injection	NBR2100G-E	2.0 (v4.0)	Low
CVE-2025-13198	DouPHP file.class.php unrestricted upload	DouPHP	2.0 (v4.0)	Low
CVE-2025-14729	CTCMS Content Management System Backend App Configuration Ct_App.php save code injection	ctcms	2.0 (v4.0)	Low
CVE-2025-14837	ZZCMS Backend Website Settings siteconfig.php stripfxg code injection	zzcms	2.0 (v4.0)	Low
CVE-2025-15130	shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection	SyCms	2.0 (v4.0)	Low
CVE-2025-15148	CmsEasy Backend Template Management template_admin.php savetemp_action code injection	cmseasy	2.0 (v4.0)	Low
CVE-2025-15394	iCMS POST Parameter ConfigAdmincp.php save code injection	icms	2.0 (v4.0)	Low
CVE-2025-15438	PluXml Media Management medias.php __destruct deserialization	pluxml	2.0 (v4.0)	Low
CVE-2026-105226	osCommerce osCommerce2 Newsletter Management newsletters.php include code injection	osCommerce2	2.0 (v4.0)	Low
CVE-2026-112195	FusionPBX Dialplan Editor dialplan.php os command injection	FusionPBX	2.0 (v4.0)	Low
CVE-2026-19964	Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection	Jij-MCP-Server	2.0 (v4.0)	Low
CVE-2026-5848	jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection	JimuReport	2.0 (v4.0)	Low
CVE-2026-78140	Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine	UJCMS	2.0 (v4.0)	Low
CVE-2026-85040	ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection	CRMEB	2.0 (v4.0)	Low
CVE-2026-90788	magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection	MacCMS10	2.0 (v4.0)	Low
CVE-2026-94103	RooCMS Frontend Rendering site_pagePHP.php eval code injection	RooCMS	2.0 (v4.0)	Low
CVE-2026-113388	opensource-socialnetwork Cache Settings dynamic.php input code injection	opensource-socialnetwork	1.9 (v4.0)	Low
CVE-2026-16129	princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist	SafestClaw	1.9 (v4.0)	Low
CVE-2026-5621	ChrisChinchilla Vale-MCP HTTP index.ts os command injection	Vale-MCP	1.9 (v4.0)	Low
CVE-2026-19353	DedeCMS Installation Wizard index.php _4_Setup file inclusion	DedeCMS	1.3 (v4.0)	Low

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-15	CVE-2026-45087
CWE-20	CVE-2026-47668 , CVE-2015-4664 , CVE-2026-19912 , CVE-2026-35048 , CVE-2026-57499 , CVE-2026-24893 , CVE-2026-34197 , CVE-2026-45505 , CVE-2026-84317 , CVE-2026-55094 , CVE-2026-54710 , CVE-2026-42588 , CVE-2026-19913 , CVE-2026-97865 , CVE-2025-15438
CWE-22	CVE-2024-13984 , CVE-2026-7411 , CVE-2026-57155 , CVE-2026-19912 , CVE-2019-25687 , CVE-2026-48768 , CVE-2026-64824 , CVE-2026-50006 , CVE-2026-57296 , CVE-2026-82217 , CVE-2026-85731 , CVE-2019-25671 , CVE-2026-116009 , CVE-2026-40521 , CVE-2025-59711 , CVE-2026-19942 , CVE-2026-46581 , CVE-2026-53554 , CVE-2026-9777 , CVE-2025-59709 , CVE-2026-40909 , CVE-2026-4502 , CVE-2015-4666
CWE-59	CVE-2026-85731 , CVE-2026-71964
CWE-73	CVE-2024-13984 , CVE-2026-57155 , CVE-2026-85520 , CVE-2025-65473 , CVE-2026-50006 , CVE-2026-15983 , CVE-2026-19913 , CVE-2025-58762 , CVE-2026-19353
CWE-74	CVE-2018-16763 , CVE-2022-35914 , CVE-2026-71320 , CVE-2026-11450 , CVE-2026-5739 , CVE-2026-10821 , CVE-2025-13786 , CVE-2025-13792 , CVE-2026-5333 , CVE-2026-5631 , CVE-2026-5736 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2026-9474 , CVE-2026-54543 , CVE-2023-7299 , CVE-2025-10097 , CVE-2026-19785 , CVE-2025-14276 , CVE-2025-11903 , CVE-2025-11905 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-7508 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-14729 , CVE-2025-14837 , CVE-2025-15130 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-94103 , CVE-2026-113388
CWE-77	CVE-2026-105134 , CVE-2026-108576 , CVE-2026-26015 , CVE-2026-72869 , CVE-2014-1203 , CVE-2026-35847 , CVE-2026-47670 , CVE-2025-10364 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-41304 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2020-15874 , CVE-2025-51457 , CVE-2026-88622 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-109108 , CVE-2026-113390 , CVE-2026-55182 , CVE-2026-85223 , CVE-2026-101009 , CVE-2026-82691 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2026-36540 , CVE-2026-7693 , CVE-2026-11450 , CVE-2026-19983 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5333 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90690 , CVE-2026-90843 , CVE-2025-14276 , CVE-2025-11138 , CVE-2025-14204 , CVE-2026-10279 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7642 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-85040 , CVE-2026-90788 , CVE-2026-5621
CWE-78	CVE-2025-34037 , CVE-2026-105134 , CVE-2026-108576 , CVE-2026-19188 , CVE-2026-34234 , CVE-2026-41900 , CVE-2026-45087 , CVE-2026-49869 , CVE-2026-8985 , CVE-2026-105691 , CVE-2026-105697 , CVE-2026-105740 , CVE-2026-40933 , CVE-2026-45632 , CVE-2026-57155 , CVE-2026-63298 , CVE-2026-72868 , CVE-2026-72869 , CVE-2026-72882 , CVE-2026-73263 , CVE-2026-73294 , CVE-2019-12725 , CVE-2019-15107 , CVE-2019-16920 , CVE-2020-15920 , CVE-2020-29390 , CVE-2020-9054 , CVE-2022-31137 , CVE-2024-53584 , CVE-2025-66401 , CVE-2026-110392 , CVE-2026-12940 , CVE-2026-18482 , CVE-2026-37281 , CVE-2026-45018 , CVE-2026-48687 , CVE-2026-57124 , CVE-2026-79408 , CVE-2026-72878 , CVE-2026-8986 , CVE-2025-66210 , CVE-2026-103056 , CVE-2026-47670 , CVE-2026-58146 , CVE-2026-6644 , CVE-2026-72879 , CVE-2026-73483 , CVE-2009-20010 , CVE-2025-71284 , CVE-2025-71336 , CVE-2025-71429 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-105110 , CVE-2026-19586 , CVE-2026-41315 , CVE-2026-41923 , CVE-2026-41925 , CVE-2026-53975 , CVE-2026-58147 , CVE-2026-58457 , CVE-2026-60121 , CVE-2026-61498 , CVE-2026-63766 , CVE-2026-64625 , CVE-2026-71921 , CVE-2026-71956 , CVE-2026-71984 , CVE-2026-71992 , CVE-2026-89308 , CVE-2026-63304 , CVE-2026-63305 , CVE-2026-80138 , CVE-2025-66203 , CVE-2026-12486 , CVE-2026-12849 , CVE-2026-12850 , CVE-2026-12851 , CVE-2026-57499 , CVE-2026-79766 , CVE-2026-79916 , CVE-2026-102608 , CVE-2026-45630 , CVE-2026-91931 , CVE-2026-33765 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-73570 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2017-14535 , CVE-2017-6884 , CVE-2025-66209 , CVE-2026-105106 , CVE-2026-110908 , CVE-2026-24893 , CVE-2026-30971 , CVE-2026-34057 , CVE-2026-34153 , CVE-2026-34158 , CVE-2026-34197 , CVE-2026-34594 , CVE-2026-34599 , CVE-2026-35196 , CVE-2026-45578 , CVE-2026-45662 , CVE-2026-52483 , CVE-2026-54149 , CVE-2026-58195 , CVE-2026-72875 , CVE-2026-73222 , CVE-2026-77601 , CVE-2026-79423 , CVE-2026-82804 , CVE-2005-10004 , CVE-2025-30007 , CVE-2025-34311 , CVE-2025-34312 , CVE-2025-34334 , CVE-2026-100852 , CVE-2026-34791 , CVE-2026-34792 , CVE-2026-34793 , CVE-2026-34795 , CVE-2026-34796 , CVE-2026-34797 , CVE-2026-58000 , CVE-2026-58452 , CVE-2026-64837 , CVE-2026-69096 , CVE-2026-71966 , CVE-2026-72870 , CVE-2026-73680 , CVE-2026-76060 , CVE-2026-79756 , CVE-2026-90770 , CVE-2026-92580 , CVE-2025-68700 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-109108 , CVE-2026-111214 , CVE-2026-111217 , CVE-2026-111218 , CVE-2026-113390 , CVE-2026-22100 , CVE-2026-40187 , CVE-2026-61517 , CVE-2026-63725 , CVE-2026-65711 , CVE-2026-67599 , CVE-2026-67608 , CVE-2026-71906 , CVE-2026-71907 , CVE-2026-71908 , CVE-2026-71913 , CVE-2026-71915 , CVE-2026-71918 , CVE-2026-71919 , CVE-2026-71923 , CVE-2026-71925 , CVE-2026-71926 , CVE-2026-71927 , CVE-2026-71928 , CVE-2026-71929 , CVE-2026-71930 , CVE-2026-71943 , CVE-2026-75121 , CVE-2026-75123 , CVE-2026-84194 , CVE-2026-85223 , CVE-2026-86733 , CVE-2026-101009 , CVE-2026-82691 , CVE-2026-55786 , CVE-2024-58274 , CVE-2026-48695 , CVE-2026-55173 , CVE-2026-108161 , CVE-2026-40519 , CVE-2026-57999 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2026-71284 , CVE-2026-81669 , CVE-2026-92263 , CVE-2026-48997 , CVE-2024-9474 , CVE-2026-19983 , CVE-2026-79761 , CVE-2026-55679 , CVE-2026-72739 , CVE-2026-45626 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90690 , CVE-2026-90843 , CVE-2026-42201 , CVE-2025-11138 , CVE-2025-14204 , CVE-2026-10279 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7642 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-85040 , CVE-2026-90788 , CVE-2026-5621
CWE-79	CVE-2026-73041 , CVE-2026-73042 , CVE-2026-48768 , CVE-2024-39024 , CVE-2026-104078 , CVE-2026-58391 , CVE-2015-4665 , CVE-2026-36239
CWE-83	CVE-2026-58391
CWE-88	CVE-2026-57572 , CVE-2026-113708 , CVE-2026-44450 , CVE-2026-73294 , CVE-2020-21224 , CVE-2026-100714 , CVE-2026-108963 , CVE-2026-47250
CWE-89	CVE-2026-33324 , CVE-2015-4669 , CVE-2026-32271 , CVE-2026-55679 , CVE-2026-5736 , CVE-2026-9474 , CVE-2023-7299 , CVE-2026-19785 , CVE-2025-11903
CWE-93	CVE-2026-84372 , CVE-2026-111221
CWE-94	CVE-2026-41900 , CVE-2026-45829 , CVE-2026-47668 , CVE-2026-57572 , CVE-2026-8984 , CVE-2025-11539 , CVE-2026-46512 , CVE-2025-24893 , CVE-2025-65719 , CVE-2026-104586 , CVE-2026-30993 , CVE-2026-31040 , CVE-2026-38431 , CVE-2026-3960 , CVE-2026-46562 , CVE-2026-51866 , CVE-2026-51911 , CVE-2026-57131 , CVE-2026-62379 , CVE-2026-67827 , CVE-2026-67919 , CVE-2026-75031 , CVE-2026-75411 , CVE-2026-75414 , CVE-2026-79538 , CVE-2026-83627 , CVE-2026-86793 , CVE-2026-88393 , CVE-2026-48519 , CVE-2026-88062 , CVE-2025-62593 , CVE-2026-45272 , CVE-2026-55413 , CVE-2026-82244 , CVE-2026-93985 , CVE-2018-25114 , CVE-2018-25357 , CVE-2026-12257 , CVE-2026-70553 , CVE-2026-114053 , CVE-2026-82531 , CVE-2026-37637 , CVE-2026-42555 , CVE-2026-46621 , CVE-2026-55511 , CVE-2026-58400 , CVE-2026-14602 , CVE-2026-42238 , CVE-2026-47252 , CVE-2026-73485 , CVE-2026-73486 , CVE-2026-73487 , CVE-2026-43945 , CVE-2020-8163 , CVE-2025-66438 , CVE-2026-104851 , CVE-2026-34197 , CVE-2026-4327 , CVE-2026-45505 , CVE-2026-48017 , CVE-2026-55585 , CVE-2026-62675 , CVE-2026-65660 , CVE-2026-78834 , CVE-2026-96795 , CVE-2021-47938 , CVE-2022-50944 , CVE-2026-100864 , CVE-2026-109308 , CVE-2026-116811 , CVE-2026-47722 , CVE-2026-49143 , CVE-2026-55094 , CVE-2026-69100 , CVE-2026-72819 , CVE-2026-82278 , CVE-2026-86732 , CVE-2026-42785 , CVE-2026-54710 , CVE-2026-56382 , CVE-2026-56703 , CVE-2026-61523 , CVE-2026-65693 , CVE-2026-69088 , CVE-2026-22244 , CVE-2026-42588 , CVE-2026-47398 , CVE-2026-71320 , CVE-2026-66738 , CVE-2026-46581 , CVE-2025-62429 , CVE-2026-77939 , CVE-2026-5739 , CVE-2026-55679 , CVE-2026-44287 , CVE-2025-13786 , CVE-2025-13792 , CVE-2026-54611 , CVE-2026-5631 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2025-10097 , CVE-2026-29202 , CVE-2026-112949 , CVE-2025-11905 , CVE-2026-101861 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-7508 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-14729 , CVE-2025-14837 , CVE-2025-15130 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-94103 , CVE-2026-113388
CWE-95	CVE-2024-7954 , CVE-2025-24893 , CVE-2026-46562 , CVE-2026-47391 , CVE-2025-31114 , CVE-2026-61511 , CVE-2026-55094 , CVE-2026-40187 , CVE-2025-48868 , CVE-2026-101861
CWE-96	CVE-2025-7825
CWE-98	CVE-2026-39353
CWE-116	CVE-2026-112949
CWE-121	CVE-2026-76071 , CVE-2026-36783
CWE-183	CVE-2026-16129
CWE-184	CVE-2026-49869 , CVE-2026-41934 , CVE-2026-44287 , CVE-2026-16129
CWE-200	CVE-2026-51078 , CVE-2025-13439
CWE-250	CVE-2026-41900 , CVE-2026-9209 , CVE-2026-55094
CWE-266	CVE-2026-101860
CWE-269	CVE-2026-45632 , CVE-2026-104798 , CVE-2026-40484 , CVE-2026-76801 , CVE-2026-72830 , CVE-2026-73664 , CVE-2026-101860
CWE-276	CVE-2025-34332 , CVE-2025-34333
CWE-284	CVE-2026-34234 , CVE-2026-41900 , CVE-2026-50006 , CVE-2026-43945 , CVE-2026-73664 , CVE-2026-11344 , CVE-2025-63739 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-285	CVE-2026-34239
CWE-287	CVE-2026-49869 , CVE-2025-27621 , CVE-2026-7630
CWE-288	CVE-2026-43945
CWE-306	CVE-2026-45087 , CVE-2026-81735 , CVE-2026-47391 , CVE-2026-57124 , CVE-2026-57131 , CVE-2026-53649 , CVE-2026-88062 , CVE-2024-0012 , CVE-2026-105110 , CVE-2026-9209 , CVE-2026-73222 , CVE-2023-54350 , CVE-2026-55094 , CVE-2026-63722 , CVE-2026-55786 , CVE-2026-49471 , CVE-2025-71257 , CVE-2026-112949
CWE-321	CVE-2026-89026
CWE-352	CVE-2026-53649 , CVE-2025-62593 , CVE-2026-73222 , CVE-2026-34228 , CVE-2025-12061 , CVE-2026-49471
CWE-362	CVE-2026-42099
CWE-434	CVE-2022-44276 , CVE-2026-72592 , CVE-2026-53649 , CVE-2009-20006 , CVE-2018-25114 , CVE-2024-58348 , CVE-2026-35047 , CVE-2026-44402 , CVE-2026-40484 , CVE-2026-50006 , CVE-2026-58409 , CVE-2025-59710 , CVE-2025-65471 , CVE-2026-17196 , CVE-2026-33704 , CVE-2021-47943 , CVE-2026-105123 , CVE-2026-34735 , CVE-2026-40488 , CVE-2026-67206 , CVE-2026-109397 , CVE-2026-41587 , CVE-2026-53599 , CVE-2026-11344 , CVE-2026-54611 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-470	CVE-2026-46562 , CVE-2026-62379 , CVE-2026-58400 , CVE-2026-79987 , CVE-2025-68455 , CVE-2026-6020 , CVE-2026-34216
CWE-479	CVE-2026-44011
CWE-494	CVE-2026-66398 , CVE-2026-107812
CWE-502	CVE-2026-45829 , CVE-2026-34838 , CVE-2025-66455 , CVE-2026-3296 , CVE-2026-55573 , CVE-2025-34292 , CVE-2023-54398 , CVE-2025-66571 , CVE-2026-10042 , CVE-2026-87930 , CVE-2026-47168 , CVE-2023-2288 , CVE-2026-113779 , CVE-2026-8365 , CVE-2025-71260 , CVE-2026-71981 , CVE-2026-93872 , CVE-2025-63950 , CVE-2025-63951 , CVE-2026-29782 , CVE-2026-97865 , CVE-2026-16297 , CVE-2023-3360 , CVE-2025-15438
CWE-552	CVE-2026-40484
CWE-601	CVE-2015-4668
CWE-641	CVE-2026-46581
CWE-644	CVE-2026-67179
CWE-693	CVE-2026-41900 , CVE-2026-39353 , CVE-2026-84317 , CVE-2026-84318
CWE-732	CVE-2026-39353 , CVE-2026-73664
CWE-791	CVE-2025-14731 , CVE-2026-78140
CWE-798	CVE-2015-4667
CWE-829	CVE-2026-45272 , CVE-2026-47398
CWE-835	CVE-2024-20353
CWE-862	CVE-2026-45632 , CVE-2026-72868 , CVE-2026-79920 , CVE-2026-57131 , CVE-2026-41315 , CVE-2026-50006 , CVE-2025-10706 , CVE-2026-14357 , CVE-2025-12061 , CVE-2026-96896 , CVE-2025-11372
CWE-863	CVE-2026-43945 , CVE-2026-86437
CWE-913	CVE-2020-15568
CWE-915	CVE-2026-72710 , CVE-2026-78416
CWE-918	CVE-2026-49869
CWE-942	CVE-2026-34449 , CVE-2026-53649
CWE-1188	CVE-2026-47668 , CVE-2026-104078
CWE-1286	CVE-2024-7954
CWE-1336	CVE-2026-44181 , CVE-2025-66438 , CVE-2026-104851 , CVE-2026-22244 , CVE-2026-77939 , CVE-2025-14731 , CVE-2026-78140

Atomicorp WAF Rule 340023

Rule Summary

Description

Selected Related CVEs

Observed CWEs