On this page

Atomicorp WAF Rule 344366

Rule Summary

Description

This rule detects behavior identified by its current alert as “Remote Command Execution: Command Injection” in the request cookies, request argument names, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVEVulnerabilityProductCVSSSeverity
CVE-2013-2367HP SiteScope Remote Code Executionsitescope10.0 (v2.0)High
CVE-2024-13984Qi'anxin TianQing Management Center rptsvr Arbitrary File UploadTianQing Management Center10.0 (v4.0)Critical
CVE-2025-34030sar2html <=3.2.2 Plot Parameter - Remote Code Executionsar2html10.0 (v4.0)Critical
CVE-2025-34037Linksys E-Series TheMoon Remote Command InjectionE420010.0 (v4.0)Critical
CVE-2026-100382Unauthenticated remote code execution through wikitext in ExternalDataMediawiki - ExternalData Extension10.0 (v4.0)Critical
CVE-2026-10134Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flowslangflow10.0 (v3.1)Critical
CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectioncloud backup suite10.0 (v4.0)Critical
CVE-2026-108576TOZED X300 IPPingDiagnostics process_ping os command injectionX30010.0 (v4.0)Critical
CVE-2026-19188Haiwell IoT Cloud HMI Gateway OS Command InjectionHaiwell IoT Cloud HMI Gateway10.0 (v4.0)Critical
CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass RCECisco Secure Firewall Management Center (FMC)10.0 (v3.1)Critical
CVE-2026-26015Unauthenticated RCE in DocsGPT MCP STDIO Configurationdocsgpt10.0 (v4.0)Critical
CVE-2026-34234CtrlPanel <= 1.1.1 - Remote Code Executionctrlpanel10.0 (v3.1)Critical
CVE-2026-41900OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environmentopenlearnx10.0 (v3.1)Critical
CVE-2026-44181Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Executionenterprise gateway10.0 (v4.0)Critical
CVE-2026-44182Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Renderingenterprise gateway10.0 (v4.0)Critical
CVE-2026-45087Dalfox: Unauthenticated Remote Code Execution via found-action in Dalfox Server Modedalfox10.0 (v3.1)Critical
CVE-2026-47668DbGate - Remote Code Execution via Anonymous JWTdbgate10.0 (v3.1)Critical
CVE-2026-49869Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in AuthenticationFilterkestra10.0 (v3.1)Critical
CVE-2026-57572Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_argscrawl4ai10.0 (v3.1)Critical
CVE-2026-7411Eclipse BaSyx Arbitrary Code Execution VulnerabilityEclipse BaSyx10.0 (v3.1)Critical
CVE-2026-8054dotCMS Core Publish Audit API - Unauthenticated SQL Injectiondotcms10.0 (v4.0)Critical
CVE-2026-81735UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command ExecutiUI-TARS-desktop10.0 (v4.0)Critical
CVE-2026-8984Unauthenticated RCEmaxicharger single charger firmware10.0 (v4.0)Critical
CVE-2026-8985Unauthenticated Command Injectionmaxicharger single charger firmware10.0 (v4.0)Critical
CVE-2021-21345XStream < 1.4.16 - Remote Code Executionxstream9.9 (v3.1)Critical
CVE-2025-11539Arbitrary Code Execution in Grafana Image Renderer Plugingrafana-image-renderer9.9 (v3.1)Critical
CVE-2026-105691Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-colorpenpot9.9 (v3.1)Critical
CVE-2026-105697Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationlangflow9.9 (v3.1)Critical
CVE-2026-105740Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverlangflow9.9 (v3.1)Critical
CVE-2026-113708Argo CD: A Kustomize remote ref can run commands in the repo-serverargo-cd9.9 (v3.1)Critical
CVE-2026-34038Coolify authenticated remote command injection leading to RCE and secret exfiltrationcoolify9.9 (v3.1)Critical
CVE-2026-40933Flowise: Authenticated RCE Via MCP Adaptersflowise9.9 (v3.1)Critical
CVE-2026-42454Termix: OS Command Injection in Docker Container Management EndpointsTermix9.9 (v3.1)Critical
CVE-2026-44450Lumiverse: RCE via MCP stdio argument injectionLumiverse9.9 (v3.1)Critical
CVE-2026-45629Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpointdokploy9.9 (v3.1)Critical
CVE-2026-45632Dokploy: Schedule Authorization Bypass Enables Host/Server Command Executiondokploy9.9 (v3.1)Critical
CVE-2026-46512Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escapingfrogman9.9 (v3.1)Critical
CVE-2026-48030Pheditor 2.0.1-2.0.3 - OS Command Injectionpheditor9.9 (v3.1)Critical
CVE-2026-55565Yamcs: Authenticated remote code execution via unescaped StreamSQL LIKE pattern compiled by Janino (LikeExpression)yamcs9.9 (v3.1)Critical
CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field Namepimcore9.9 (v3.1)Critical
CVE-2026-57155OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importercore9.9 (v3.1)Critical
CVE-2026-63298LXD arbitrary lxc.conf directive injection via NVIDIA instance configurationlxd9.9 (v3.1)Critical
CVE-2026-64637All Plesk Versions below 18.0.79.5 Reseller Privilege Escalation to RootPlesk9.9 (v3.0)Critical
CVE-2026-69084SiYuan - SQL Executionsiyuan9.9 (v4.0)Critical
CVE-2026-72738Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameterdokploy9.9 (v3.1)Critical
CVE-2026-72740Dokploy: OS Command Injection via SSH-form customGitUrl domain in ssh-keyscandokploy9.9 (v3.1)Critical
CVE-2026-72865Dokploy: OS Command Injection via compose composePathdokploy9.9 (v3.1)Critical
CVE-2026-72867Dokploy <= 0.29.12 - Authenticated RCE via Command Injectiondokploy9.9 (v3.1)Critical
CVE-2026-72868Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injectiondokploy9.9 (v3.1)Critical
CVE-2026-72869Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCEdokploy9.9 (v3.1)Critical
CVE-2026-72872Dokploy: OS Command Injection via Bitbucket owner/repository in git clonedokploy9.9 (v3.1)Critical
CVE-2026-72876Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*dokploy9.9 (v3.1)Critical
CVE-2026-72882Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed serversdokploy9.9 (v3.1)Critical
CVE-2026-72902Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryByIddokploy9.9 (v3.1)Critical
CVE-2026-73263Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-pathprowler9.9 (v3.1)Critical
CVE-2026-73294Semaphore U: OS Command Injectionsemaphore9.9 (v3.1)Critical
CVE-2026-79920Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install taskajenti9.9 (v3.1)Critical
CVE-2026-8481Remote Code Execution via Code Validation Endpointlangflow9.9 (v3.1)Critical
CVE-2013-2251Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Executionarchiva9.8 (v3.1)Critical
CVE-2014-3206Seagate BlackArmor NAS - Command Injectionblackarmor nas 220 firmware9.8 (v3.0)Critical
CVE-2015-3934Fiyo CMS 2.0_1.9.1 - SQL Injectionfiyo cms9.8 (v3.0)Critical
CVE-2016-10108Western Digital MyCloud unauthenticated command injectionmycloud nas9.8 (v3.0)Critical
CVE-2016-1555Netgear Devices Unauthenticated Remote Command Executionwnap320 firmware9.8 (v3.1)Critical
CVE-2016-7547Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Executionthreat discovery appliance9.8 (v3.0)Critical
CVE-2016-7552Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Executionthreat discovery appliance9.8 (v3.0)Critical
CVE-2017-18371TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection5200w-t firmware9.8 (v3.0)Critical
CVE-2018-16167LogonTracer <=1.2.0 - Remote Command Injectionlogontracer9.8 (v3.0)Critical
CVE-2018-19276OpenMRS Platform < 2.24.0 - Insecure Object Deserializationopenmrs9.8 (v3.1)Critical
CVE-2018-7841Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injectionu.motion builder9.8 (v3.1)Critical
CVE-2019-12985Citrix SD-WAN Center - Remote Command Injectionnetscaler sd-wan9.8 (v3.0)Critical
CVE-2019-12986Citrix SD-WAN Center - Remote Command Injectionnetscaler sd-wan9.8 (v3.0)Critical
CVE-2019-16920D-Link Routers - Remote Code Executiondir-655 firmware9.8 (v3.1)Critical
CVE-2019-5893OpenSource ERP 6.3.1. - SQL Injectionopen source erp9.8 (v3.0)Critical
CVE-2020-10987Tenda AC15 AC1900 version 15.03.05.19 - Command Injectionac15 firmware9.8 (v3.1)Critical
CVE-2020-13117Wavlink Multiple AP - Remote Command Injectionwn575a49.8 (v3.1)Critical
CVE-2020-18662Gnuboard5 5.3.2.8 - SQL Injectiongnuboard9.8 (v3.1)Critical
CVE-2020-25223Sophos UTM Preauth - Remote Code Executionunified threat management9.8 (v3.1)Critical
CVE-2020-25494SCO Openserver 5.0.7 - 'outputform' Command Injectionopenserver9.8 (v3.1)Critical
CVE-2020-5722Grandstream UCM62xx IP PBX sendPasswordEmail RCEucm6200 firmware9.8 (v3.1)Critical
CVE-2021-1472Cisco Small Business RV Series Authentication Bypass and Command Injectionrv160 firmware9.8 (v3.1)Critical
CVE-2021-1498Cisco HyperFlex HX Data Platform Command Executionhyperflex hx data platform9.8 (v3.1)Critical
CVE-2021-21307Lucee Administrator imgProcess.cfm Arbitrary File Writelucee server9.8 (v3.1)Critical
CVE-2021-22502Micro Focus Operations Bridge Reporter Unauthenticated Command Injectionoperation bridge reporter9.8 (v3.1)Critical
CVE-2021-31856Layer5 Meshery 0.5.2 - SQL Injectionmeshery9.8 (v3.1)Critical
CVE-2021-32305Websvn <2.6.1 - Remote Code Executionwebsvn9.8 (v3.1)Critical
CVE-2021-33357RaspAP <=2.6.5 - Remote Command Injectionraspap9.8 (v3.1)Critical
CVE-2021-4039Zyxel NWA-1100-NH - Command Injectionnwa1100-nh firmware9.8 (v3.1)Critical
CVE-2021-42237Sitecore Experience Platform (XP) PreAuth Deserialization RCEexperience platform9.8 (v3.1)Critical
CVE-2022-24112APISIX Admin API default access token RCEapisix9.8 (v3.1)Critical
CVE-2022-2486Wavlink WN535K2/WN535K3 - OS Command Injectionwl-wn535k29.8 (v3.1)Critical
CVE-2022-2488Wavlink WN535K2/WN535K3 - OS Command Injectionwl-wn535k2 firmware9.8 (v3.1)Critical
CVE-2022-29303SolarView Compact 6.0 - OS Command Injectionsv-cpt-mc310 firmware9.8 (v3.1)Critical
CVE-2022-31499Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injectionemerge e3 firmware9.8 (v3.1)Critical
CVE-2022-40022Symmetricom SyncServer Unauthenticated Remote Command Executionsyncserver s650 firmware9.8 (v3.1)Critical
CVE-2022-44276responsive filemanager Unrestricted Upload of File with Dangerous Type Vulnerabilityresponsive filemanager9.8 (v3.1)Critical
CVE-2022-44877Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)webpanel9.8 (v3.1)Critical
CVE-2022-45699APsystems ECU-R Firmware - Command Injectionecu-r firmware9.8 (v3.1)Critical
CVE-2023-22527Atlassian Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2023-22527)confluence data center9.8 (v3.1)Critical
CVE-2023-25280D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injectiondir820la1 firmware9.8 (v3.1)Critical
CVE-2023-26035ZoneMinder Snapshots - Command Injectionzoneminder9.8 (v3.1)Critical
CVE-2023-27637PrestaShop tshirtecommerce Module - SQL Injectioncustom product designer9.8 (v3.1)Critical
CVE-2023-30194Prestashop posstaticfooter <= 1.0.0 - SQL Injectionpoststaticfooter9.8 (v3.1)Critical
CVE-2023-30258MagnusBilling - Remote Code Executionmagnusbilling9.8 (v3.1)Critical
CVE-2023-34124Sonicwallanalytics9.8 (v3.1)Critical
CVE-2023-34132Sonicwallanalytics9.8 (v3.1)Critical
CVE-2023-39361Cacti 1.2.24 - SQL Injectioncacti9.8 (v3.1)Critical
CVE-2023-45498Vinchin Backup and Recovery Command Injectionvinchin backup and recovery9.8 (v3.1)Critical
CVE-2023-45499Vinchin Backup and Recovery Command Injectionvinchin backup and recovery9.8 (v3.1)Critical
CVE-2023-46347PrestaShop Step by Step products Pack - SQL Injectionndk steppingpack9.8 (v3.1)Critical
CVE-2023-6655Hongjing e-HR 2020 - SQL Injectione-hr9.8 (v3.1)Critical
CVE-2023-7116WeiYe-Jing datax-web <= 2.1.2 - OS Command Injectiondatax-web9.8 (v3.1)Critical
CVE-2024-23692Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Executionhttp file server9.8 (v3.1)Critical
CVE-2024-24495Daily Habit Tracker 1.0 - SQL Injectiondaily habit tracker9.8 (v3.1)Critical
CVE-2024-32641Masa CMS Vulnerable to Pre-Auth RCE via JSON APImasacms9.8 (v3.1)Critical
CVE-2024-6671WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypasswhatsup gold9.8 (v3.1)Critical
CVE-2025-65719Open Source Kubectl MCP Server v1.1.1 Arbitrary Code Execution Vulnerability-9.8 (v3.1)Critical
CVE-2025-66401MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URLmcp watch9.8 (v3.1)Critical
CVE-2025-67489@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development servevite-plugin-react9.8 (v3.1)Critical
CVE-2026-1038893D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter3D Product configurator for WooCommerce9.8 (v3.1)Critical
CVE-2026-104586AUTOM8N (WHM/cPanel plugin) through commit 82821f7 Command Injection Vulnerability-9.8 (v3.1)Critical
CVE-2026-104798My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'aMy Calendar – Accessible Event Manager9.8 (v3.1)Critical
CVE-2026-110392Samsung QA-Board — Unauthenticated OS command injection via output redo/tuningQA-Board9.8 (v3.1)Critical
CVE-2026-12940Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpointlangflow9.8 (v3.1)Critical
CVE-2026-18482neo-mjs Command Injection Vulnerabilityneo-mjs9.8 (v3.1)Critical
CVE-2026-30993Slah CMS v1.5.0 and below Arbitrary Code Execution VulnerabilitySlah CMS v1.5.0 and below9.8 (v3.1)Critical
CVE-2026-31040stata-mcp Code Injection Vulnerabilitystata-mcp9.8 (v3.1)Critical
CVE-2026-3296Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry MetadataEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder9.8 (v3.1)Critical
CVE-2026-34243wenxian: Command Injection in GitHub Actions Workflow via issue_comment.bodywenxian9.8 (v3.1)Critical
CVE-2026-35048Piwigo RCE via PHP Code Injection into Config File in InstallerPiwigo9.8 (v3.1)Critical
CVE-2026-35847the CheckUils.php file Arbitrary Code Execution Vulnerabilitythe CheckUils.php file9.8 (v3.1)Critical
CVE-2026-37281the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 Command Injection Vulnerabilitythe /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.09.8 (v3.1)Critical
CVE-2026-38428kestra SQL Injection Vulnerabilitykestra9.8 (v3.1)Critical
CVE-2026-38431erpnext Code Injection Vulnerabilityerpnext9.8 (v3.1)Critical
CVE-2026-3960Remote Code Execution in h2oai/h2o-3h2o9.8 (v3.1)Critical
CVE-2026-42846ClipBucket: Remote Play URL Command Injectionclipbucket-v59.8 (v3.1)Critical
CVE-2026-45018Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code executionchainlit9.8 (v3.1)Critical
CVE-2026-45748Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injectiontermix9.8 (v3.1)Critical
CVE-2026-46562Yamcs: Remote Code Execution via Mission Database algorithm overrideyamcs9.8 (v3.1)Critical
CVE-2026-47391PraisonAI's unauthenticated A2A official example can reach real LLM-driven eval() tool executionPraisonAI9.8 (v3.1)Critical
CVE-2026-48687fastnetmon Command Injection Vulnerabilityfastnetmon9.8 (v3.1)Critical
CVE-2026-49819UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmdUpSnap9.8 (v3.1)Critical
CVE-2026-51861bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 Code Injection Vulnerability-9.8 (v3.1)Critical
CVE-2026-51866Code Injection-9.8 (v3.1)Critical
CVE-2026-51881deeptutor 1.4.0 Code Injection Vulnerability-9.8 (v3.1)Critical
CVE-2026-51886Arbitrary Code Execution-9.8 (v3.1)Critical
CVE-2026-51911vanna v2.0.2 Code Injection Vulnerabilityvanna v2.0.29.8 (v3.1)Critical
CVE-2026-53545Termix: Remote Code Execution via Tunnel Disconnect pkill Command InjectionTermix9.8 (v3.1)Critical
CVE-2026-55559Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)yamcs9.8 (v3.1)Critical
CVE-2026-55573e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chaine1079.8 (v3.1)Critical
CVE-2026-57124PraisonAI UI MCP connect endpoint allows unauthenticated local command executionPraisonAI9.8 (v3.1)Critical
CVE-2026-57131praisonai: Jobs API exposes agent-execution endpoints with no authenticationPraisonAI9.8 (v3.1)Critical
CVE-2026-62379OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackOpenAM9.8 (v3.1)Critical
CVE-2026-67827Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 Arbitrary Code Execution Vulnerability-9.8 (v3.1)Critical
CVE-2026-67919Halo 2.25.4 Arbitrary Code Execution Vulnerability-9.8 (v3.1)Critical
CVE-2026-72592dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Uploadphpfm9.8 (v3.1)Critical
CVE-2026-75031Interchange Arbitrary Code Execution VulnerabilityInterchange9.8 (v3.1)Critical
CVE-2026-75411JeecgBoot v3.9.2 Code Injection Vulnerability-9.8 (v3.1)Critical
CVE-2026-75414In AntFlow V2.0.0, ActivitiTest.java Code Injection Vulnerability-9.8 (v3.1)Critical
CVE-2026-79408MetaGPT 0.8.1 Command Injection VulnerabilityMetaGPT 0.8.19.8 (v3.1)Critical
CVE-2026-79538metatool-ai MetaMCP up to and including 2.4.22 Code Injection Vulnerability-9.8 (v3.1)Critical
CVE-2026-8037Progress ADC LoadMaster - Command Injectionconnection manager for objectscale9.8 (v3.1)Critical
CVE-2026-83627Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution viaHummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN9.8 (v3.1)Critical
CVE-2026-84372Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connectionspredis9.8 (v3.1)Critical
CVE-2026-86793SGLang Unsafe Deserialization VulnerabilitySGLang9.8 (v3.1)Critical
CVE-2026-88393WookTeam 1.6.6 and Earlier Code Injection Vulnerability-9.8 (v3.1)Critical
CVE-2026-107188Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code ExecutionArchibus9.6 (v3.1)Critical
CVE-2026-34449SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injectionsiyuan9.6 (v3.1)Critical
CVE-2026-35906An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 OS Command Injection Vulnerability-9.6 (v3.1)Critical
CVE-2026-48519Langflow: Unauthenticated RCE in Shareable Playgroundslangflow9.6 (v3.1)Critical
CVE-2026-53649Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCEjoro9.6 (v3.1)Critical
CVE-2026-72878Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell argumentsdokploy9.6 (v3.1)Critical
CVE-2026-70477Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerabilityflowise9.5 (v4.0)Critical
CVE-2026-88062OmniRoute < 3.8.49 - Unauthenticated RCEOmniRoute9.5 (v4.0)Critical
CVE-2026-8986Command Injection via Malicious OCPP Servermaxicharger single charger firmware9.5 (v4.0)Critical
CVE-2013-10060Netgear DGN2200B pppoe.cgi Remote Command Executiondgn2200b firmware9.4 (v4.0)Critical
CVE-2014-125118eScan Web Management Console Command InjectioneScan Web Management Console9.4 (v4.0)Critical
CVE-2019-16383MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injectionmoveit transfer9.4 (v3.1)Critical
CVE-2020-36856Nagios XI < 5.6.14 Authenticated RCE command_test.php via addressnagios xi9.4 (v4.0)Critical
CVE-2024-9264Grafana SQL Expressions Remote Code Execution (CVE-2024-9264)grafana9.4 (v4.0)Critical
CVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attackray9.4 (v4.0)Critical
CVE-2025-66210Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Importcoolify9.4 (v4.0)Critical
CVE-2026-100714Froxlor before 2.3.12 Command Injection via letsencryptchallengepathfroxlor9.4 (v4.0)Critical
CVE-2026-103056AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTRAiSOC9.4 (v4.0)Critical
CVE-2026-33324SQLBot prompt injection allows arbitrary SQL execution and remote code executionsqlbot9.4 (v4.0)Critical
CVE-2026-39932OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injectionopenemr9.4 (v4.0)Critical
CVE-2026-45272MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config Filetalebook9.4 (v4.0)Critical
CVE-2026-47670DbGate - Remote Code Execution via Dynamic Import Bypassdbgate9.4 (v4.0)Critical
CVE-2026-55413ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code ExecutionToolJet9.4 (v4.0)Critical
CVE-2026-58146Unauthorized remote code execution in T-Mobile 5G Box IDU routersT-Mobile 5G Box IDU9.4 (v4.0)Critical
CVE-2026-637329router before 0.4.60 Remote Code Execution via default password9router9.4 (v4.0)Critical
CVE-2026-66398phpMyFAQ before 4.1.6 Remote Code Execution via Configuration APIphpMyFAQ9.4 (v4.0)Critical
CVE-2026-6644A command injection vulnerability was found in the PPTP VPN Clients on the ADMdata master9.4 (v4.0)Critical
CVE-2026-69256Flowise: Remote Code Execution Vulnerability in CSVAgentflowise9.4 (v4.0)Critical
CVE-2026-72879Dokploy: Command Injection via Registry Credentials in Swarm Uploaddokploy9.4 (v4.0)Critical
CVE-2026-73041SiYuan before v3.7.4 Remote Code Execution via PDF Annotationssiyuan9.4 (v4.0)Critical
CVE-2026-73042SiYuan before v3.7.4 Remote Code Execution via Menu Metadatasiyuan9.4 (v4.0)Critical
CVE-2026-73483Flowise before 3.1.3 Sandbox Escape via Puppeteerflowise9.4 (v4.0)Critical
CVE-2026-82244Budibase before 3.41.3 Remote Code Execution via Plugin eval()server9.4 (v4.0)Critical
CVE-2026-93985OpenPanel js-runtime JavaScript Template Sandbox Escape RCEopenpanel9.4 (v4.0)Critical
CVE-2009-20006osCommerce 2.2 Arbitrary PHP Code ExecutionosCommerce9.3 (v4.0)Critical
CVE-2009-20010Dogfood CRM spell.php RCEDogfood CRM9.3 (v4.0)Critical
CVE-2013-2642Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilitiesweb appliance firmware9.3 (v2.0)High
CVE-2017-20198DC/OS Marathon UI Docker ExploitDC/OS Marathon9.3 (v4.0)Critical
CVE-2017-20251WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST APIWoody Code Snippets9.3 (v4.0)Critical
CVE-2018-25357Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.phpdolibarr erp/crm9.3 (v4.0)Critical
CVE-2019-25687Pegasus CMS 1.0 Remote Code Execution via extra_fields.phppegasus cms9.3 (v4.0)Critical
CVE-2024-33559Wordpress Theme XStore 9.3.8 - SQLiXStore9.3 (v3.1)Critical
CVE-2024-58348WordPress Background Image Cropper 1.2 Remote Code ExecutionBackground Image Cropper9.3 (v4.0)Critical
CVE-2024-5910Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)expedition9.3 (v4.0)Critical
CVE-2025-10364Unauthenticated Arbitrary Command Injection in Evertz SDVN3080ipx-10G9.3 (v4.0)Critical
CVE-2025-31114Fooocus webui vulnerable to Remote Code ExecutionFooocus9.3 (v4.0)Critical
CVE-2025-34125D-Link Cookie Command ExecutionDSP-W110A19.3 (v4.0)Critical
CVE-2025-59735Multiple vulnerabilities in AndSoft's e-TMSe-tms9.3 (v4.0)Critical
CVE-2025-59736Multiple vulnerabilities in AndSoft's e-TMSe-tms9.3 (v4.0)Critical
CVE-2025-59737Multiple vulnerabilities in AndSoft's e-TMSe-tms9.3 (v4.0)Critical
CVE-2025-59738Multiple vulnerabilities in AndSoft's e-TMSe-tms9.3 (v4.0)Critical
CVE-2025-59739Multiple vulnerabilities in AndSoft's e-TMSe-tms9.3 (v4.0)Critical
CVE-2025-59740Multiple vulnerabilities in AndSoft's e-TMSe-tms9.3 (v4.0)Critical
CVE-2025-59741Multiple vulnerabilities in AndSoft's e-TMSe-tms9.3 (v4.0)Critical
CVE-2025-71284Synway SMG Gateway Management Software OS Command Injection via radius_addresssmg gateway management software9.3 (v4.0)Critical
CVE-2025-71336Flowise - Unsandboxed Remote Code Execution via Custom MCPflowise9.3 (v4.0)Critical
CVE-2025-71429GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.pyGPT-SoVITS9.3 (v4.0)Critical
CVE-2026-101001Netcore NBR200V2 Web Management network_tools eval os command injectionNBR200V29.3 (v4.0)Critical
CVE-2026-101072Netcore NR289-GE CGI ap_ip.cgi system os command injectionNR289-GE9.3 (v4.0)Critical
CVE-2026-101075Netcore NR289-GE Location Time location_time.cgi system os command injectionNR289-GE9.3 (v4.0)Critical
CVE-2026-101076Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injectionNR289-GE9.3 (v4.0)Critical
CVE-2026-102240Netcore NAP930 Network Tools CGI network_tools eval os command injectionNAP9309.3 (v4.0)Critical
CVE-2026-105110Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI ParameterInnbox9.3 (v4.0)Critical
CVE-2026-107780Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameterskyeye9.3 (v4.0)Critical
CVE-2026-108598Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templatesfloci9.3 (v4.0)Critical
CVE-2026-108804TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injectionTEW-751DR9.3 (v4.0)Critical
CVE-2026-113802Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file HandlerWL-WN530BE1-A9.3 (v4.0)Critical
CVE-2026-12257Remote code execution in Mura Software’s CMSCMS9.3 (v4.0)Critical
CVE-2026-19586Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gatewayser7212pc firmware9.3 (v4.0)Critical
CVE-2026-34106Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.phplanguage-system9.3 (v4.0)Critical
CVE-2026-34108Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.phplanguage-system9.3 (v4.0)Critical
CVE-2026-34109Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.phplanguage-system9.3 (v4.0)Critical
CVE-2026-34110Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.phplanguage-system9.3 (v4.0)Critical
CVE-2026-34111Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.phplanguage-system9.3 (v4.0)Critical
CVE-2026-34112Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.phplanguage-system9.3 (v4.0)Critical
CVE-2026-34115Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.phplanguage-system9.3 (v4.0)Critical
CVE-2026-35047Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpointbravecms9.3 (v4.0)Critical
CVE-2026-41315mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Imdserver-web9.3 (v4.0)Critical
CVE-2026-41923WDR201A WiFi Extender OS Command Injection via internet.cgiWDR201A WiFi Extender9.3 (v4.0)Critical
CVE-2026-41925WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)WDR201A WiFi Extender9.3 (v4.0)Critical
CVE-2026-41939Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFlyCare Everywhere Gateway9.3 (v4.0)Critical
CVE-2026-42647JoomSport <= 5.7.7 - SQL Injectionjoomsport-sports-league-results-management9.3 (v3.1)Critical
CVE-2026-44402Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgiSNMP Web Pro9.3 (v4.0)Critical
CVE-2026-48768TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileNametypebot.io9.3 (v3.1)Critical
CVE-2026-53975OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/execOpenChamber9.3 (v4.0)Critical
CVE-2026-58138Orkes Conductor 3.21.21-3.30.1 - Remote Code Executionconductor9.3 (v4.0)Critical
CVE-2026-58147Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routersT-Mobile 5G Box IDU9.3 (v4.0)Critical
CVE-2026-58457Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.cspM300 Wi-Fi Repeater9.3 (v4.0)Critical
CVE-2026-60121Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.phpflamingo9.3 (v4.0)Critical
CVE-2026-61498Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.phpflamingo9.3 (v4.0)Critical
CVE-2026-61511vBulletin 6.x - Remote Code ExecutionvBulletin9.3 (v4.0)Critical
CVE-2026-63766GPT-SoVITS 20250606v2pro OS Command Injection via webui.pyGPT-SoVITS9.3 (v4.0)Critical
CVE-2026-64625AVideo before 29.0 OS Command Injection via execAsyncAVideo9.3 (v4.0)Critical
CVE-2026-64824Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restoreHome Assistant Core9.3 (v4.0)Critical
CVE-2026-65008Grav before 2.0.7 Remote Code Execution via Blueprint dynamicDatagrav9.3 (v4.0)Critical
CVE-2026-67308Wazuh GitHub Actions Shell Injection via Fork Pull Requestwazuh9.3 (v4.0)Critical
CVE-2026-70553MaxSite CMS Unauthenticated RCE via Install EndpointMaxSite CMS9.3 (v4.0)Critical
CVE-2026-71921DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgiVigorSwitch G2540xs9.3 (v4.0)Critical
CVE-2026-71944D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectelDWR-M9619.3 (v4.0)Critical
CVE-2026-71945D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocomDWR-M9619.3 (v4.0)Critical
CVE-2026-71946D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRunDWR-M9619.3 (v4.0)Critical
CVE-2026-71947D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRunDWR-M9619.3 (v4.0)Critical
CVE-2026-71948D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRunDWR-M9619.3 (v4.0)Critical
CVE-2026-71949D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetupDWR-M9619.3 (v4.0)Critical
CVE-2026-71950D-Link DWR-M961 Command Injection via /boafrm/formSmsManageDWR-M9619.3 (v4.0)Critical
CVE-2026-71951D-Link DWR-M961 Command Injection via /boafrm/formIMEISetupDWR-M9619.3 (v4.0)Critical
CVE-2026-71952D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetupDWR-M9619.3 (v4.0)Critical
CVE-2026-71953D-Link DWR-M961 Command Injection via /boafrm/formNtpDWR-M9619.3 (v4.0)Critical
CVE-2026-71954D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetupDWR-M9619.3 (v4.0)Critical
CVE-2026-71955D-Link DWR-M961 Command Injection via /boafrm/formWscDWR-M9619.3 (v4.0)Critical
CVE-2026-71956D-Link DWR-M961 Command Injection via app.cgiDWR-M9619.3 (v4.0)Critical
CVE-2026-71984MSI Radix AXE6600 v781521 Command Injection via urlfilterRadix AXE66009.3 (v4.0)Critical
CVE-2026-71992MSI Radix AXE6600 v781521 Command Injection via macfilterRadix AXE66009.3 (v4.0)Critical
CVE-2026-72710SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue InjectionSPIP9.3 (v4.0)Critical
CVE-2026-76070Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password ParameterNC639.3 (v4.0)Critical
CVE-2026-76071Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost ParameterNC639.3 (v4.0)Critical
CVE-2026-85520Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop moduleGoogle Merchant Center Feed9.3 (v4.0)Critical
CVE-2026-89026Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originateIssabel Framework9.3 (v4.0)Critical
CVE-2026-89308Arbitrary command execution in TrxTimeATTENDANCETrxTimeATTENDANCE9.3 (v4.0)Critical
CVE-2026-9209mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspxmJobTime9.3 (v4.0)Critical
CVE-2026-96754orval @orval/hono before 8.29.0 Code Injection via OpenAPI Pathorval9.3 (v4.0)Critical
CVE-2023-7305SmartBI RMIServlet Unrestricted File Upload RCESmartBI9.2 (v4.0)Critical
CVE-2026-114053vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revisionvllm9.2 (v4.0)Critical
CVE-2026-598009Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint9router9.2 (v4.0)Critical
CVE-2026-63304AVideo through 29.0 OS Command Injection via listFFmpegProcessesAVideo9.2 (v4.0)Critical
CVE-2026-63305AVideo through 29.0 OS Command Injection via ffmpeg.json.phpAVideo9.2 (v4.0)Critical
CVE-2026-80138ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameterclipbucket-v59.2 (v4.0)Critical
CVE-2026-82531Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cachesmarty9.2 (v4.0)Critical
CVE-2021-21809Moodle SpellChecker Path Authenticated Remote Command Executionmoodle9.1 (v3.1)Critical
CVE-2021-34473Microsoft Exchange ProxyShell RCEexchange server9.1 (v3.1)Critical
CVE-2025-65473easyimages2.0 Arbitrary Code Execution Vulnerabilityeasyimages2.09.1 (v3.1)Critical
CVE-2025-66203StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injectionstreamvault9.1 (v3.1)Critical
CVE-2026-10131Totolink Arbitrary Code Execution VulnerabilityTotolink9.1 (v3.1)Critical
CVE-2026-10135Totolink Arbitrary Code Execution VulnerabilityTotolink9.1 (v3.1)Critical
CVE-2026-12486GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGV-I/O Box 4E9.1 (v3.1)Critical
CVE-2026-12849GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGV-I/O Box 4E9.1 (v3.1)Critical
CVE-2026-12850GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGV-I/O Box 4E9.1 (v3.1)Critical
CVE-2026-12851GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGV-I/O Box 4E9.1 (v3.1)Critical
CVE-2026-33568Totolink Arbitrary Code Execution VulnerabilityTotolink9.1 (v3.1)Critical
CVE-2026-35499Totolink Arbitrary Code Execution VulnerabilityTotolink9.1 (v3.1)Critical
CVE-2026-37637Alexantr filemanager v.1.0 Arbitrary Code Execution Vulnerability-9.1 (v3.1)Critical
CVE-2026-39353InvoicePlane: Remote Code Execution via Writable Templates DirectoryInvoicePlane9.1 (v3.1)Critical
CVE-2026-40484ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore FunctionCRM9.1 (v3.1)Critical
CVE-2026-40627Totolink Arbitrary Code Execution VulnerabilityTotolink9.1 (v3.1)Critical
CVE-2026-42555Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin usersvaltimo9.1 (v3.1)Critical
CVE-2026-46621Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injectionyamcs9.1 (v3.1)Critical
CVE-2026-50006Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE inanyquery9.1 (v3.1)Critical
CVE-2026-55511Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs executeSqlyamcs9.1 (v3.1)Critical
CVE-2026-57499Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)core9.1 (v3.1)Critical
CVE-2026-58400GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formattercore-geonetwork9.1 (v3.1)Critical
CVE-2026-58409ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin UploadCRM9.1 (v3.1)Critical
CVE-2026-79766Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/emailTermix9.1 (v3.1)Critical
CVE-2026-79916MaxKB AWS Bedrock model credential injection leads to remote code executionMaxKB9.1 (v3.1)Critical
CVE-2026-9814Totolink Arbitrary Code Execution VulnerabilityTotolink9.1 (v3.1)Critical
CVE-2021-34523Microsoft Exchange ProxyShell RCEexchange server9.0 (v3.1)Critical
CVE-2025-9501W3 Total Cache < 2.8.13 - Unauthenticated Command InjectionW3 Total Cache9.0 (v3.1)Critical
CVE-2026-102608ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)zoneminder9.0 (v3.1)Critical
CVE-2026-34612Kestra: Remote Code Execution via SQL Injectionkestra9.0 (v3.1)Critical
CVE-2026-42238Unauthenticated Remote Code Execution via Backup Restore in nginx-uinginx ui9.0 (v4.0)Critical
CVE-2026-45630Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statementdokploy9.0 (v3.1)Critical
CVE-2026-45750Termix Vulnerable to Arbitrary Command Execution in File Managertermix9.0 (v3.1)Critical
CVE-2026-47252Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)anyquery9.0 (v3.1)Critical
CVE-2026-62674Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCEomnigent9.0 (v3.1)Critical
CVE-2026-69251Flowise RCE via TypeORM DataSourceflowise9.0 (v4.0)Critical
CVE-2026-73485Flowise before 3.1.3 Remote Code Execution via Airtable Agentflowise9.0 (v4.0)Critical
CVE-2026-73486Flowise before 3.1.3 Code Injection via CSV Agent customReadCSVflowise9.0 (v4.0)Critical
CVE-2026-73487Flowise before 3.1.3 Prompt Injection RCE via CSV Agentflowise9.0 (v4.0)Critical
CVE-2026-91931Flowise before 3.1.4 Remote Code Execution via Custom MCP npxFlowise9.0 (v4.0)Critical
CVE-2026-33765Pi-hole Web Interface has a Command Injection Vulnerabilityweb interface8.9 (v4.0)High
CVE-2026-41304WWBN AVideo vulnerable to RCE caused by clonesite pluginavideo8.9 (v4.0)High
CVE-2026-43945FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration InjectionFUXA8.9 (v4.0)High
CVE-2026-5850Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5851Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5852Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5853Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5854Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5975Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5976Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5977Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5978Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5993Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5994Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5996Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injectionA7100RU8.9 (v4.0)High
CVE-2026-5997Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6025Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6026Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6028Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6029Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6112Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6113Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6114Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6115Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6116Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6131Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6132Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6138Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6139Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6140Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6154Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6155Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6156Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injectionA7100RU8.9 (v4.0)High
CVE-2026-6195Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injectionA7100RU8.9 (v4.0)High
CVE-2026-7121Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7122Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7123Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7124Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7125Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7136Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7137Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7138Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7139Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7140Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7152Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7153Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7154Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7155Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7156Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7202Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7203Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7204Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7240Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7241Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7242Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7243Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-7244Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-73570zimbra collaboration suite Arbitrary Code Execution Vulnerabilityzimbra collaboration suite8.9 (v3.1)High
CVE-2026-7538Totolink A8000RU CGI cstecgi.cgi vulnerability os command injectionA8000RU8.9 (v4.0)High
CVE-2026-77956EEx template evaluation of prompt content in AshAi enables remote code executionash ai8.9 (v4.0)High
CVE-2026-7823Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9384Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9385Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9386Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9387Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9388Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9404Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9405Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9406Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9407Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9408Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9432Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9433Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9434Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9435Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9436Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9454Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9455Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9456Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9457Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9458Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9475Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9476Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9477Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injectionA8000RU8.9 (v4.0)High
CVE-2026-9478Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injectionA8000RU8.9 (v4.0)High
CVE-2016-0792Jenkins XStream Groovy classpath Deserialization Vulnerabilityjenkins8.8 (v3.0)High
CVE-2016-10709pfSense authenticated graph status RCEpfsense8.8 (v3.0)High
CVE-2016-4808Web2py 2.14.5 - Multiple Vulnerabilitiesweb2py8.8 (v3.0)High
CVE-2017-18370TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection5200w-t firmware8.8 (v3.0)High
CVE-2017-6398Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Executioninterscan messaging security virtual appliance8.8 (v3.0)High
CVE-2017-6884Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injectionemg2926 firmware8.8 (v3.1)High
CVE-2018-15877Wordpress Plainview Activity Monitor RCEplainview activity monitor8.8 (v3.1)High
CVE-2018-7765Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injectionu.motion builder8.8 (v3.0)High
CVE-2019-10867Pimcore Unserialize RCEpimcore8.8 (v3.0)High
CVE-2019-15642Webmin < 1.920 - Authenticated Remote Code Executionwebmin8.8 (v3.0)High
CVE-2019-25066Ajenti auth username Command Injectionajenti8.8 (v3.1)High
CVE-2019-9189Prima Access Control 2.3.35 - Arbitrary File Uploadflexair8.8 (v3.0)High
CVE-2020-10221rConfig <= 3.9.4 - Authenticated OS Command Injectionrconfig8.8 (v3.1)High
CVE-2020-15874Command Injection-8.8 (v3.1)High
CVE-2020-17505Artica proxy 4.30.000000 Auth Bypass service-cmds-peform Command Injectionweb proxy8.8 (v3.1)High
CVE-2020-26217XStream <1.4.14 - Remote Code Executionxstream8.8 (v3.1)High
CVE-2020-5776MAGMI - Cross-Site Request Forgerymagmi8.8 (v3.1)High
CVE-2021-20039SonicWall SMA 100 Series Authenticated Command Injectionsma 200 firmware8.8 (v3.1)High
CVE-2022-3800IBAX - SQL Injectiongo-ibax8.8 (v3.1)High
CVE-2023-34127Sonicwallanalytics8.8 (v3.1)High
CVE-2023-43661Cachet vulnerable to Authenticated Remote Code Executioncachet8.8 (v3.1)High
CVE-2023-45375PrestaShop PireosPay - SQL Injectionpireospay8.8 (v3.1)High
CVE-2023-49084Cacti RCE via SQLi in pollers.phpcacti8.8 (v3.1)High
CVE-2023-49085Cacti RCE via SQLi in pollers.phpcacti8.8 (v3.1)High
CVE-2023-7137Client Details System 1.0 - SQL Injectionclient details system8.8 (v3.1)High
CVE-2024-39024In Packetfence 13.2.0, the WebGui interface setting Arbitrary Code Execution Vulnerability-8.8 (v3.1)High
CVE-2025-10706Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin InstallationClassifiedPro - reCommerce WordPress Theme8.8 (v3.1)High
CVE-2025-51457D-Link DAP-2610 up to 2.06B08r099 Command Injection VulnerabilityD-Link DAP-2610 up to 2.06B08r0998.8 (v3.1)High
CVE-2025-59710biztalk360 Arbitrary Code Execution Vulnerabilitybiztalk3608.8 (v3.1)High
CVE-2025-65471easyimages2.0 Arbitrary Code Execution Vulnerabilityeasyimages2.08.8 (v3.1)High
CVE-2025-66209Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backupcoolify8.8 (v3.1)High
CVE-2025-66438erpnext Information Disclosure Vulnerabilityerpnext8.8 (v3.1)High
CVE-2026-104851fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Executionfilesystem spec8.8 (v3.1)High
CVE-2026-105106Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled taskKoha8.8 (v3.1)High
CVE-2026-105797SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)simplechat8.8 (v3.1)High
CVE-2026-108963databasement Arbitrary Code Execution Vulnerabilitydatabasement8.8 (v3.1)High
CVE-2026-110908pfSense-pkg-frr Command Injection VulnerabilitypfSense-pkg-frr8.8 (v3.1)High
CVE-2026-14357DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code ExDevKit Pro8.8 (v3.1)High
CVE-2026-14498Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' ParameterQuery Wrangler8.8 (v3.1)High
CVE-2026-17196Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element AttributeSuper Forms – Drag & Drop Form Builder8.8 (v3.1)High
CVE-2026-24893openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansionopenitcockpit8.8 (v3.1)High
CVE-2026-26899OS Command Injection-8.8 (v3.1)High
CVE-2026-30971ZoneMinder: Authenticated RCE via command injection in monitor Device Pathzoneminder8.8 (v3.1)High
CVE-2026-33704Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpointchamilo lms8.8 (v3.1)High
CVE-2026-34057Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Namecoolify8.8 (v3.1)High
CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCEcoolify8.8 (v3.1)High
CVE-2026-34158Coolify: Command injection via single-quote breakout in Docker Compose custom commandscoolify8.8 (v3.1)High
CVE-2026-34197Apache ActiveMQ Jolokia Remote Code Execution (CVE-2026-34197)activemq8.8 (v3.1)High
CVE-2026-34594Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Managementcoolify8.8 (v3.1)High
CVE-2026-34599Coolify: Authenticated Remote Code Execution in GetLogs Livewire Componentcoolify8.8 (v3.1)High
CVE-2026-35031Jellyfin: Potential RCE via subtitle upload path traversal + .strm chainjellyfin8.8 (v3.1)High
CVE-2026-35196Chamilo LMS has OS Command Injection via export_all_certificates actionchamilo lms8.8 (v3.1)High
CVE-2026-35519Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injectionftldns8.8 (v3.1)High
CVE-2026-35520Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injectionftldns8.8 (v3.1)High
CVE-2026-41208Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Executionpaperclipai8.8 (v3.1)High
CVE-2026-4327The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_loThe Welcomizer8.8 (v3.1)High
CVE-2026-45505Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia addNetworkConnector Discovery Wrapper Bypassactivemq8.8 (v3.1)High
CVE-2026-45578WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URLavideo8.8 (v3.1)High
CVE-2026-45662Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)dokploy8.8 (v3.1)High
CVE-2026-48017DbGate: Remote Code Execution via functionName injection in loadReader endpointdbgate8.8 (v3.1)High
CVE-2026-52356D-Link DAP1160L A1_FW101WWb04 Command Injection VulnerabilityD-Link DAP1160L A1 FW101WWb048.8 (v3.1)High
CVE-2026-52483OS Command Injection-8.8 (v3.1)High
CVE-2026-52484MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 Arbitrary Code Execution Vulnerability-8.8 (v3.1)High
CVE-2026-54149MaxKB MCP tool import validation bypass allows post-authentication remote code executionMaxKB8.8 (v3.1)High
CVE-2026-55585QWED: Authenticated Remote Code Execution via Unsafe SymPy parse_expr()qwed-verification8.8 (v3.1)High
CVE-2026-57296Jenkins External Workspace Manager Plugin Arbitrary Code Execution VulnerabilityJenkins External Workspace Manager Plugin8.8 (v3.1)High
CVE-2026-58195Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into exagentic-flow8.8 (v3.1)High
CVE-2026-59734Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Executioncoolify8.8 (v3.1)High
CVE-2026-623129Router: Authenticated RCE via Unvalidated MCP Plugin Arguments9router8.8 (v3.1)High
CVE-2026-62675Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Toolsomnigent8.8 (v3.1)High
CVE-2026-6543Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpointlangflow desktop8.8 (v3.1)High
CVE-2026-65660Microsoft SharePoint Server Remote Code Execution Vulnerabilitysharepoint server8.8 (v3.1)High
CVE-2026-72875Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFiledokploy8.8 (v3.1)High
CVE-2026-73222Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio)claude-code-templates8.8 (v3.1)High
CVE-2026-76801FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege EscalationFireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment8.8 (v3.1)High
CVE-2026-77601OpenC3 COSMOS: Authenticated OS command injection via the pypi_url settingcosmos8.8 (v3.1)High
CVE-2026-78834Code Injection-8.8 (v3.1)High
CVE-2026-79423seacms v13.6 Arbitrary Code Execution Vulnerabilityseacms v13.68.8 (v3.1)High
CVE-2026-82217Eclipse Theia Path Traversal VulnerabilityEclipse Theia8.8 (v3.1)High
CVE-2026-82804Apache DolphinScheduler: Command Injection in the Alert Script PluginApache DolphinScheduler8.8 (v3.1)High
CVE-2026-84317Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the onginx-ui8.8 (v3.1)High
CVE-2026-84318Nginx UI: MCP nginx_config_add Bypasses Directive Validation — Authenticated RCEnginx-ui8.8 (v3.1)High
CVE-2026-85731oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)oras-go8.8 (v3.1)High
CVE-2026-88622NUUO Network Video Recorder 2.0.0 Command Injection Vulnerability-8.8 (v3.1)High
CVE-2026-96795Horilla: Authenticated RCE in Horilla List-View Exporthorilla-hr8.8 (v3.1)High
CVE-2005-10004Cacti graph_view.php Remote Command Executioncacti8.7 (v4.0)High
CVE-2015-10145Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.shgargoyle8.7 (v4.0)High
CVE-2019-25671VA MAX 8.3.4 Remote Code Execution via changeip.phpVA MAX8.7 (v4.0)High
CVE-2021-47938ImpressCMS 1.4.2 Remote Code Execution via AutotasksImpressCMS8.7 (v4.0)High
CVE-2021-47939Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module CreationEvolution CMS8.7 (v4.0)High
CVE-2021-47943TextPattern CMS 4.8.7 Remote Code Execution via File UploadTextPattern CMS8.7 (v4.0)High
CVE-2022-50944Aero CMS 0.0.1 PHP Code Injection via posts.phpAero CMS8.7 (v4.0)High
CVE-2023-54350WordPress Augmented-Reality Plugin Remote Code Execution UnauthenticatedAugmented Reality8.7 (v4.0)High
CVE-2025-30007HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Managementcontrol panel8.7 (v4.0)High
CVE-2025-34115OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.phpOP5 Monitor8.7 (v4.0)High
CVE-2025-34311IPFire < v2.29 Command Injection via Proxy Report Creationipfire8.7 (v4.0)High
CVE-2025-34312IPFire < v2.29 Command Injection via URL Filter Blacklistipfire8.7 (v4.0)High
CVE-2025-34334AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPEfax server8.7 (v4.0)High
CVE-2025-66474XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injectionxwiki-rendering8.7 (v4.0)High
CVE-2026-100852AzuraCast through 0.23.x Command Injection via Streamer UsernameAzuraCast8.7 (v4.0)High
CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay PasswordAzuraCast8.7 (v4.0)High
CVE-2026-100864heym before 0.0.91 Remote Code Execution via Expression Engineheym8.7 (v4.0)High
CVE-2026-105123W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload APIwcms8.7 (v4.0)High
CVE-2026-105985Authenticated RCE via render-components Entry Type overridescms8.7 (v4.0)High
CVE-2026-107639ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload FilenameILIAS8.7 (v4.0)High
CVE-2026-109308Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injectioncms8.7 (v4.0)High
CVE-2026-116009Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Actioncamaleon-cms8.7 (v4.0)High
CVE-2026-116811OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Templateopenpanel8.7 (v4.0)High
CVE-2026-28797RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Componeragflow8.7 (v4.0)High
CVE-2026-34228Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Writeemlog8.7 (v4.0)High
CVE-2026-34735Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in FileControllerwiki8.7 (v4.0)High
CVE-2026-34791Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injectionfirewall community8.7 (v4.0)High
CVE-2026-34792Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injectionfirewall community8.7 (v4.0)High
CVE-2026-34793Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injectionfirewall community8.7 (v4.0)High
CVE-2026-34794Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injectionfirewall community8.7 (v4.0)High
CVE-2026-34795Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injectionfirewall community8.7 (v4.0)High
CVE-2026-34796Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injectionfirewall community8.7 (v4.0)High
CVE-2026-34797Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injectionfirewall community8.7 (v4.0)High
CVE-2026-34965Cockpit CMS Authenticated Remote Code Execution via CollectionsCockpit CMS8.7 (v4.0)High
CVE-2026-40488OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Executionmagento8.7 (v4.0)High
CVE-2026-40521FrontAccounting < 2.4.20 Path Traversal RCE via attachment uploadFrontAccounting8.7 (v4.0)High
CVE-2026-41934Vvveb < 1.0.8.2 Authenticated RCE via Code EditorVvveb8.7 (v4.0)High
CVE-2026-46746sinec ins OS Command Injection Vulnerabilitysinec ins8.7 (v4.0)High
CVE-2026-49143BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handlerbrowserstack-runner8.7 (v4.0)High
CVE-2026-55094Taskcluster: Unauthenticated remote code execution in web-server via GraphQL filter argument (sift $where)taskcluster8.7 (v4.0)High
CVE-2026-58000luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKeyluci-proto-openvpn8.7 (v4.0)High
CVE-2026-58452JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC EndpointC492A-W6 Wi-Fi IP Camera8.7 (v4.0)High
CVE-2026-63722ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.phpICEcoder8.7 (v4.0)High
CVE-2026-64837ICEcoder through 8.1 OS Command Injection via lib/properties.phpICEcoder8.7 (v4.0)High
CVE-2026-64850Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()grav8.7 (v4.0)High
CVE-2026-67206Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Uploadwolfcms8.7 (v4.0)High
CVE-2026-69096OpenWrt luci-app-dockerman Read ACL Remote Code Executionluci8.7 (v4.0)High
CVE-2026-69100LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Executionlamp-cloud8.7 (v4.0)High
CVE-2026-71966CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfercyberpanel8.7 (v4.0)High
CVE-2026-72819Grav CMS before 2.0.13 Remote Code Execution via ZIP Uploadgrav8.7 (v4.0)High
CVE-2026-72827Grav CMS before 2.0.13 Remote Code Execution via Twiggrav8.7 (v4.0)High
CVE-2026-72830Grav API Plugin before 1.0.13 RCE via ConfigController scope bypassgrav8.7 (v4.0)High
CVE-2026-72870Dokploy: Command Injection via Docker Credentials in buildRemoteDockerdokploy8.7 (v4.0)High
CVE-2026-72874Dokploy: Command Injection via Unescaped Git URL in Clone Commandsdokploy8.7 (v4.0)High
CVE-2026-73680Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg FilenameCockpit CMS8.7 (v4.0)High
CVE-2026-7551HKUDS OpenHarness Remote Command Execution via /bridge Slash Commandopenharness8.7 (v4.0)High
CVE-2026-75574Grav before 4.2.2 Remote Code Execution via Email Twiggrav8.7 (v4.0)High
CVE-2026-76060OS Command Injection in PayRange APIZoneminder8.7 (v4.0)High
CVE-2026-76836AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group BypassAzuraCast8.7 (v4.0)High
CVE-2026-78416Authenticated RCE via condition.config JSON cleanse bypasscms8.7 (v4.0)High
CVE-2026-79756Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platformnuclio8.7 (v4.0)High
CVE-2026-79987Low-privilege RCE through element-search eager loadingcms8.7 (v4.0)High
CVE-2026-82278BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_oncebisheng8.7 (v4.0)High
CVE-2026-85604Grav before 2.0.19 Remote Code Execution via sort filtergrav8.7 (v4.0)High
CVE-2026-85610OpenPanel before 2.3.0 Remote Code Execution via chart formulasopenpanel8.7 (v4.0)High
CVE-2026-86732Craft CMS before 5.10.12 Remote Code Execution via element-indexcms8.7 (v4.0)High
CVE-2026-90770Spug through 3.4.0 Remote Code Execution via ping_checkspug8.7 (v4.0)High
CVE-2026-92580AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRFAVideo8.7 (v4.0)High
CVE-2013-10061Netgear DGN1000B setup.cgi Remote Command Executiondgn1000b firmware8.6 (v4.0)High
CVE-2024-12971Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_binpandora fms8.6 (v4.0)High
CVE-2024-20353adaptive security appliance software Denial of Service Vulnerabilityadaptive security appliance software8.6 (v3.1)High
CVE-2025-12061Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL ExecutionTAX SERVICE Electronic HDM8.6 (v3.1)High
CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behaviorcraft cms8.6 (v4.0)High
CVE-2025-68700RAGFlow Remote Code Execution Vulnerabilityragflow8.6 (v4.0)High
CVE-2026-100896TOTOLINK N150RT Web Management formWlSiteSurvey system os command injectionN150RT8.6 (v4.0)High
CVE-2026-102911zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injectionpi-llm-wiki8.6 (v4.0)High
CVE-2026-108540OpenSpug File Transfer transfer os command injectionSpug8.6 (v4.0)High
CVE-2026-108894Linksys E1700 Static Route addStaticRoute os command injectionE17008.6 (v4.0)High
CVE-2026-109108Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injectionWL-WN530BE1-A8.6 (v4.0)High
CVE-2026-109397Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing SpaceThelia8.6 (v4.0)High
CVE-2026-111214Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.phppfsense8.6 (v4.0)High
CVE-2026-111217Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHIDpfsense8.6 (v4.0)High
CVE-2026-111218Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiterspfsense8.6 (v4.0)High
CVE-2026-113390DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injectionVigor29608.6 (v4.0)High
CVE-2026-113506aaPanel File Manager common.py ExecShell os command injectionaaPanel8.6 (v4.0)High
CVE-2026-22100Comnand injection in OCPP ReserveLogin messageDC-808.6 (v4.0)High
CVE-2026-23698Vtiger CRM 8.4.0 Authenticated RCE via Module Import File UploadVtiger CRM8.6 (v4.0)High
CVE-2026-40187Authenticated RCE via Malicious eTemplate Upload in EGroupwareegroupware8.6 (v4.0)High
CVE-2026-41587CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Executionci4ms8.6 (v4.0)High
CVE-2026-42785OpenKM 6.3.12 Remote Code Execution via Administrative ScriptingOpenKM Community Edition8.6 (v4.0)High
CVE-2026-44011Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behaviorcms8.6 (v4.0)High
CVE-2026-53804OTRS Community Edition OS Command Injection via PGP ConfigurationOTRS Community Edition8.6 (v4.0)High
CVE-2026-54710FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)freepbx8.6 (v4.0)High
CVE-2026-55182LibreNMS: Remote Code Execution by Signal Alert Transportation Modulelibrenms8.6 (v4.0)High
CVE-2026-56382Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsControllercms8.6 (v4.0)High
CVE-2026-56703Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTOadminer8.6 (v4.0)High
CVE-2026-61517Netis NX10 OS Command Injection via Ping Diagnostic HandlerNX108.6 (v4.0)High
CVE-2026-61523WebsiteBaker CMS < 2.13.10 Code Injection via Droplets EditorWebsiteBaker CMS8.6 (v4.0)High
CVE-2026-63725sysPass FileBackupService Authenticated OS Command Injection via Backup PathsysPass8.6 (v4.0)High
CVE-2026-65693Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templatesmicroweber8.6 (v4.0)High
CVE-2026-65711sysPass 3.2.11 Authenticated OS Command Injection via Backup PathsysPass8.6 (v4.0)High
CVE-2026-67599ClearOS 7.9 OS Command Injection via Log Viewer filter parameterClearOS8.6 (v4.0)High
CVE-2026-67608Telenia TVox 26.5.3 OS Command Injection via action_audio.phpTVox8.6 (v4.0)High
CVE-2026-69088Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprintgrav8.6 (v4.0)High
CVE-2026-71906DrayTek VigorAP Multiple Models OS Command Injection via setLanVigorAP 918R8.6 (v4.0)High
CVE-2026-71907DrayTek VigorAP Multiple Models OS Command Injection via setcamsetVigorAP 918R8.6 (v4.0)High
CVE-2026-71908DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_testVigorAP 918R8.6 (v4.0)High
CVE-2026-71913DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgiVigorAP 918R8.6 (v4.0)High
CVE-2026-71915DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatusVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71918DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupActionVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71919DrayTek VigorSwitch Multiple Models OS Command Injection via sysrebootVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71923DrayTek VigorSwitch Multiple Models OS Command Injection via auth_setVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71924DrayTek VigorSwitch Multiple Models OS Command Injection via getVidVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71925DrayTek VigorSwitch Multiple Models OS Command Injection via getDetailVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71926DrayTek VigorSwitch Multiple Models OS Command Injection via setDeviceVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71927DrayTek VigorSwitch Multiple Models OS Command Injection via rebDeviceVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71928DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDeviceVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71929DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProtoVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71930DrayTek VigorSwitch Multiple Models OS Command Injection via setTimeVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71931DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgradeVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-71943DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNetVigorSwitch G2540xs8.6 (v4.0)High
CVE-2026-73664FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Modulebackup8.6 (v4.0)High
CVE-2026-75121PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_postPLANET GS-4210-16P2S V38.6 (v4.0)High
CVE-2026-75122PLANET GS-4210-16P2S Command Injection via httpuploadcert.cgiPLANET GS-4210-16P2S V38.6 (v4.0)High
CVE-2026-75123PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_postPLANET GS-4210-16P2S V38.6 (v4.0)High
CVE-2026-80214LibreNMS Virtualisation Discovery Module RCElibrenms8.6 (v4.0)High
CVE-2026-82692D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injectionDNS-340L8.6 (v4.0)High
CVE-2026-84194LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostnamelibrenms8.6 (v4.0)High
CVE-2026-85223D-Link DNS-340L CGI dropbox.cgi os command injectionDNS-340L8.6 (v4.0)High
CVE-2026-86299Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injectionRE70008.6 (v4.0)High
CVE-2026-86437Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Uploadlaradashboard8.6 (v4.0)High
CVE-2026-86438Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Actionlaradashboard8.6 (v4.0)High
CVE-2026-86733Snipe-IT before 8.7.0 Remote Code Execution via Backup Restoresnipe-it8.6 (v4.0)High
CVE-2026-90699D-Link DWR-M920 formPinManageSetup sub_41E60C os command injectionDWR-M9208.6 (v4.0)High
CVE-2024-24809Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)traccar8.5 (v3.1)High
CVE-2025-34332AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPEfax server8.5 (v4.0)High
CVE-2025-34333AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPEfax server8.5 (v4.0)High
CVE-2026-101009aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injectionBaoTa8.5 (v4.0)High
CVE-2026-22244OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCEopenmetadata8.5 (v4.0)High
CVE-2026-82690D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injectionDNS-327L8.5 (v4.0)High
CVE-2026-82691D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injectionDNS-320L8.5 (v4.0)High
CVE-2026-85222D-Link DNS-340L Add-On Center addon_center.cgi os command injectionDNS-340L8.5 (v4.0)High
CVE-2026-85224D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injectionDNS-320 ShareCenter8.5 (v4.0)High
CVE-2026-90702D-Link DWR-M921 formDiskFormat system os command injectionDWR-M9218.5 (v4.0)High
CVE-2026-90703D-Link DWR-M921 formDiskCreateShare system os command injectionDWR-M9218.5 (v4.0)High
CVE-2026-92397Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injectionRG-EW3000GX8.5 (v4.0)High
CVE-2026-92398Ruijie RG-EW3000GX user_list_note admin os command injectionRG-EW3000GX8.5 (v4.0)High
CVE-2026-104078Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter BypassObsidian Desktop8.4 (v4.0)High
CVE-2026-55786Flyto2 Core: Unauthenticated Command Execution via HTTP MCP execute_moduleflyto-core8.4 (v3.1)High
CVE-2024-58274CSMP iSecure Center OS Command Injection VulnerabilityCSMP iSecure Center8.3 (v3.1)High
CVE-2025-59711biztalk360 Path Traversal Vulnerabilitybiztalk3608.3 (v3.1)High
CVE-2026-49471Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCEserena8.3 (v3.1)High
CVE-2025-69755Neterbit NW-431F Router vNW-431F-20241014-IR03 Arbitrary Code Execution Vulnerability-8.2 (v3.1)High
CVE-2017-9805Apache Struts 2 REST Plugin XStream RCEstruts8.1 (v3.1)High
CVE-2024-5721Logsign Remote Command Injectionunified secops platform8.1 (v3.1)High
CVE-2026-15983Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' ParameterSuper Forms – Drag & Drop Form Builder8.1 (v3.1)High
CVE-2026-19942Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' MetaAtarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback8.1 (v3.1)High
CVE-2026-42588Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectoractivemq8.1 (v3.1)High
CVE-2026-45344LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instancesLinkAce8.1 (v3.1)High
CVE-2026-47398PraisonAI: Arbitrary code execution via unguarded spec.loader.exec_module in agents_generator.py - sibling of CVE-20PraisonAI8.1 (v3.1)High
CVE-2026-48695fastnetmon Command Injection Vulnerabilityfastnetmon8.1 (v3.1)High
CVE-2026-55173AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), givingAVideo8.1 (v3.1)High
CVE-2026-71320Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Propsnuxt8.1 (v3.1)High
CVE-2026-97875DNS rebinding vulnerability in rojo serve HTTP APIrojo8.1 (v3.1)High
CVE-2014-100005D-Link DIR-645 / DIR-815 diagnostic.php Command Executiondir-600 firmware8.0 (v3.1)High
CVE-2025-6204DELMIA Apriso - Command Injectiondelmia apriso8.0 (v3.1)High
CVE-2026-52831Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCEnuclio8.0 (v3.1)High
CVE-2026-79755Nuclio: Unauthenticated OS command injection via function namespace in docker ps –filter label (local Docker platform)nuclio8.0 (v3.1)High
CVE-2019-20499DLINK DWL-2600 Authenticated Remote Command Injectiondwl-2600ap firmware7.8 (v3.1)High
CVE-2019-20500D-Link DWL-2600AP - Multiple OS Command Injectiondwl-2600ap firmware7.8 (v3.1)High
CVE-2019-20501D-Link DWL-2600AP - Multiple OS Command Injectiondwl-2600ap firmware7.8 (v3.1)High
CVE-2026-67179Genkit improper host header validationgenkit7.8 (v3.1)High
CVE-2025-27621UpTrain has a Constant Default API Keyuptrain7.7 (v4.0)High
CVE-2026-105764Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCEimmich7.7 (v4.0)High
CVE-2026-108161FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Downloadfusionpbx7.7 (v4.0)High
CVE-2026-32271Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widgetcommerce7.7 (v4.0)High
CVE-2026-40519Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()nginx-proxy-manager7.7 (v4.0)High
CVE-2026-42099Race Condition in Sparx Pro Cloud Serverpro cloud server7.7 (v4.0)High
CVE-2026-57999luci-app-tailscale-community - Command Injection via tailscale.do_login RPCluci-app-tailscale-community7.7 (v4.0)High
CVE-2026-66738SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLiteSPIP7.7 (v4.0)High
CVE-2005-2799Linksys WRT54GL apply.cgi Command Executionwrt54g7.5 (v2.0)High
CVE-2010-3600Oracle Database Client System Analyzer Arbitrary File Uploaddatabase server7.5 (v2.0)High
CVE-2014-3704Drupal < 7.32 "Drupalgeddon" SQL Injection (CVE-2014-3704)drupal7.5 (v2.0)High
CVE-2014-3996ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injectionit3607.5 (v2.0)High
CVE-2015-1592SixApart MovableType Storable Perl Code Executiondebian linux7.5 (v2.0)High
CVE-2015-2824WordPress Plugin Simple Ads Manager - Multiple SQL Injectionssimple ads manager7.5 (v2.0)High
CVE-2016-4806Web2py 2.14.5 - Multiple Vulnerabilitiesweb2py7.5 (v3.0)High
CVE-2017-10271Weblogic < 10.3.6 'wls-wsat' XMLDecoder Deserialization Remote Command Execution (CVE-2017-10271)weblogic server7.5 (v3.1)High
CVE-2023-34133Sonicwallanalytics7.5 (v3.1)High
CVE-2025-11452Asgaros Forum < 3.2.0 - SQL InjectionAsgaros Forum7.5 (v3.1)High
CVE-2026-107812Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or Mnginx ui7.5 (v3.1)High
CVE-2026-111221Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injectionpfsense7.5 (v4.0)High
CVE-2026-34239Chamilo Authenticated Remote Code Executionchamilo-lms7.5 (v4.0)High
CVE-2026-36783Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to Denial of Service Vulnerability-7.5 (v3.1)High
CVE-2026-36796Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to Denial of Service Vulnerability-7.5 (v3.1)High
CVE-2026-46581mojarra Path Traversal Vulnerabilitymojarra7.5 (v3.1)High
CVE-2026-51078Dede CMS v.5.7.118 Information Disclosure Vulnerability-7.5 (v3.1)High
CVE-2026-53534JabRef CAYW Sublime Text integration permits operating-system command injectionjabref7.5 (v4.0)High
CVE-2026-53599Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mocore7.5 (v3.1)High
CVE-2026-101860RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges managementraspap-webgui7.4 (v4.0)High
CVE-2025-68619Signal K Server Vulnerable to Remote Code Execution via Malicious npm Packagesignal k server7.3 (v4.0)High
CVE-2026-1085939router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint9router7.3 (v4.0)High
CVE-2026-10870Shibby Tomato Web UI rc start_dhcpc os command injectionTomato7.3 (v4.0)High
CVE-2026-10871Shibby Tomato Web UI rc start_6rd_tunnel os command injectionTomato7.3 (v4.0)High
CVE-2026-10873Shibby Tomato Web UI rstats rstats_path os command injectionTomato7.3 (v4.0)High
CVE-2026-18900H3C NX15 Backend RPC esps file.exec os command injectionNX157.3 (v4.0)High
CVE-2026-19771Baicells EG3661M LuCI Web luci os command injectionEG3661M7.3 (v4.0)High
CVE-2026-36540Netis AC1200 Router NC21 V4.0.1.4296 Arbitrary Code Execution Vulnerability-7.3 (v3.1)High
CVE-2026-53554SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import ProcessingSQLBot7.3 (v4.0)High
CVE-2023-1211phpIPAM 1.5.1 - SQL Injectionphpipam7.2 (v3.1)High
CVE-2023-31742Linksys WRT54GL Remote Command Executionwrt54gl firmware7.2 (v3.1)High
CVE-2025-29635D-Link DIR-823X set_prohibiting - Command Injectiondir-823x firmware7.2 (v3.1)High
CVE-2025-48868Horilla vulnerable to authenticated RCE via eval() in project_bulk_archivehorilla7.2 (v3.1)High
CVE-2025-58762Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and Script notification agenttautulli7.2 (v3.1)High
CVE-2025-58763Tautulli vulnerable to Authenticated Remote Code Execution via Command Injectiontautulli7.2 (v3.1)High
CVE-2025-62429ClipBucket v5 executes arbitrary PHP codeclipbucket7.2 (v3.1)High
CVE-2026-13392ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)ElementsKit Elementor Addons7.2 (v3.1)High
CVE-2026-15686Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution VulnerabilityAdminer7.2 (v3.0)High
CVE-2026-27891Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanismfacturascripts7.2 (v3.1)High
CVE-2026-6020ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST APIShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin7.2 (v3.1)High
CVE-2026-71284Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filenamefledge7.2 (v3.1)High
CVE-2026-7693Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' ParameterBackup Migration7.2 (v3.1)High
CVE-2026-81669IBM Guardium Data Protection is affected by multiple vulnerabilities.guardium data protection7.2 (v3.1)High
CVE-2026-92263SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restoSparkyFitness7.2 (v3.1)High
CVE-2026-96896Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_requestMalcure Malware Shield — Removal, Repair, Monitor7.2 (v3.1)High
CVE-2026-9777ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerabilityunizon7.2 (v3.0)High
CVE-2026-48997e107: Command Injection via shell expansion in ImageMagick resize destination pathe1077.1 (v3.1)High
CVE-2026-58502githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflowgithubtoplanguages7.1 (v4.0)High
CVE-2026-71964CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Uploadcyberpanel7.1 (v4.0)High
CVE-2026-77939Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpointflextype7.1 (v4.0)High
CVE-2024-11320Pandora FMS authenticated command injection leading to RCE via LDAP using default DB passwordpandora fms6.9 (v4.0)Medium
CVE-2026-11450GL.iNet GL-MT3000 Path Normalization dlopen command injectionGL-MT30006.9 (v4.0)Medium
CVE-2026-116253DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injectionDedeCMS6.9 (v4.0)Medium
CVE-2026-19983GL.iNet XE3000 NAS Command Service gl_nas_sys os command injectionA13006.9 (v4.0)Medium
CVE-2026-5739PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injectionPowerJob6.9 (v4.0)Medium
CVE-2025-59709biztalk360 Path Traversal Vulnerabilitybiztalk3606.8 (v3.1)Medium
CVE-2021-31207Microsoft Exchange ProxyShell RCEexchange server6.6 (v3.1)Medium
CVE-2026-10821Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCEYoast SEO Premium6.6 (v3.1)Medium
CVE-2026-34216CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.phppanel6.6 (v3.1)Medium
CVE-2026-79761Termix: Command injection in SSH key deployment verificationTermix6.6 (v3.1)Medium
CVE-2018-6671McAfee ePO 5.9.1 - Registered Executable Local Access Bypassepolicy orchestrator6.5 (v3.0)Medium
CVE-2024-4257BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injectionclinical browsing system6.5 (v3.1)Medium
CVE-2025-11372LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table ManipulationLearnPress – WordPress LMS Plugin for Create and Sell Online Courses6.5 (v3.1)Medium
CVE-2025-14545YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed GenerationYML for Yandex Market6.5 (v3.1)Medium
CVE-2026-40909WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Diravideo6.5 (v3.1)Medium
CVE-2026-4502Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 APIlangflow desktop6.5 (v3.1)Medium
CVE-2026-55679WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code InjectionWeGIA6.5 (v3.1)Medium
CVE-2026-63432Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Passwordhorilla-hr6.5 (v3.1)Medium
CVE-2026-72739Dokploy: Command Injection via Compose Shell Executiondokploy6.5 (v3.1)Medium
CVE-2024-32231Stash < 0.26.0 - SQL Injectionstash6.3 (v3.1)Medium
CVE-2026-44287FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*(/ is bypassableFastGPT6.3 (v3.1)Medium
CVE-2026-45626Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameterarcane6.3 (v3.1)Medium
CVE-2026-47250mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltrationmcp-server-kubernetes6.1 (v3.1)Medium
CVE-2026-61852Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Toolchartbrew5.8 (v4.0)Medium
CVE-2025-10090Jinher OA - SQL Injectionjinher oa5.5 (v4.0)Medium
CVE-2025-13262lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversallsfusion platform5.5 (v4.0)Medium
CVE-2025-13786taosir WTCMS index.php fetch code injectionwtcms5.5 (v4.0)Medium
CVE-2025-13792Qualitor getResumo.php eval code injectionthe file /html/st/stdeslocamento/request/getResumo.php5.5 (v4.0)Medium
CVE-2025-9596itsourcecode Sports Management System login.php sql injectionsports management system5.5 (v4.0)Medium
CVE-2026-10214zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injectionchatgpt-on-wechat5.5 (v4.0)Medium
CVE-2026-102874HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injectionAnyTool5.5 (v4.0)Medium
CVE-2026-112252Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sqlWubang Five-in-One Safety Production Management Information System5.5 (v4.0)Medium
CVE-2026-11344code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted uploadVehicle Management System5.5 (v4.0)Medium
CVE-2026-18641Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginCOperation and Maintenance Security Management System5.5 (v4.0)Medium
CVE-2026-19379EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injectionipTIME AX8004M5.5 (v4.0)Medium
CVE-2026-5333DefaultFuction Content-Management-System tools.php command injectioncontent management system5.5 (v4.0)Medium
CVE-2026-54611InstantCMS has Remote Code Execution in package installericms25.5 (v3.1)Medium
CVE-2026-5631assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injectiongpt-researcher5.5 (v4.0)Medium
CVE-2026-5677Totolink A7100RU cstecgi.cgi CsteSystem os command injectionA7100RU5.5 (v4.0)Medium
CVE-2026-5678Totolink A7100RU cstecgi.cgi setScheduleCfg os command injectionA7100RU5.5 (v4.0)Medium
CVE-2026-5688Totolink A7100RU cstecgi.cgi setDdnsCfg os command injectionA7100RU5.5 (v4.0)Medium
CVE-2026-5689Totolink A7100RU cstecgi.cgi setNtpCfg os command injectionA7100RU5.5 (v4.0)Medium
CVE-2026-5690Totolink A7100RU cstecgi.cgi setRemoteCfg os command injectionA7100RU5.5 (v4.0)Medium
CVE-2026-5691Totolink A7100RU cstecgi.cgi setFirewallType os command injectionA7100RU5.5 (v4.0)Medium
CVE-2026-5692Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injectionA7100RU5.5 (v4.0)Medium
CVE-2026-5736PowerJob detailPlus Endpoint InstanceController.java sql injectionPowerJob5.5 (v4.0)Medium
CVE-2026-5741suvarchal docker-mcp-server HTTP index.ts pull_image os command injectiondocker-mcp-server5.5 (v4.0)Medium
CVE-2026-5802idachev mcp-javadc HTTP os command injectionmcp-javadc5.5 (v4.0)Medium
CVE-2026-7061Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injectionchatgpt-mcp-server5.5 (v4.0)Medium
CVE-2026-7062Intina47 context-sync Git Integration git-integration.ts os command injectioncontext-sync5.5 (v4.0)Medium
CVE-2026-7064AgentDeskAI browser-tools-mcp browser-connector.ts os command injectionbrowser-tools-mcp5.5 (v4.0)Medium
CVE-2026-7066choieastsea simple-openstack-mcp server.py exec_openstack os command injectionsimple-openstack-mcp5.5 (v4.0)Medium
CVE-2026-7220jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injectionFastlyMCP5.5 (v4.0)Medium
CVE-2026-7416PolarVista xcode-mcp-server MCP index.ts run_tests os command injectionxcode-mcp-server5.5 (v4.0)Medium
CVE-2026-7443BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injectionmcp-dnstwist5.5 (v4.0)Medium
CVE-2026-7590eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injectionp 69 branch monkey mcp5.5 (v4.0)Medium
CVE-2026-7630innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authenticationInnoShop5.5 (v4.0)Medium
CVE-2026-76760chenhg5 cc-connect webhook.go authenticate code injectioncc-connect5.5 (v4.0)Medium
CVE-2026-76761chenhg5 cc-connect Management API engine.go shellExecCommand os command injectioncc-connect5.5 (v4.0)Medium
CVE-2026-7698Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injectionEasy7 Integrated Management Platform5.5 (v4.0)Medium
CVE-2026-82598SeaCMS Template search.php parseIf code injectionSeaCMS5.5 (v4.0)Medium
CVE-2026-85137SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injectionSeaCMS5.5 (v4.0)Medium
CVE-2026-90617GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injectionPentestAgent5.5 (v4.0)Medium
CVE-2026-906190x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injectionHexStrike AI5.5 (v4.0)Medium
CVE-2026-906900x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injectionHexStrike AI5.5 (v4.0)Medium
CVE-2026-90843SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injectionWebMap5.5 (v4.0)Medium
CVE-2026-9474yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injectionStudentManagementSystem5.5 (v4.0)Medium
CVE-2017-12544HPE System Management - Cross-Site Scriptingsystem management homepage5.4 (v3.0)Medium
CVE-2026-54543Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsfroxlor5.4 (v3.1)Medium
CVE-2026-58391OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakoutcore5.4 (v3.1)Medium
CVE-2023-7299DataGear resolveSql sql injectiondatagear5.3 (v4.0)Medium
CVE-2025-10097SimStudioAI sim route.ts code injectionsim5.3 (v4.0)Medium
CVE-2025-11344ILIAS Certificate Import code injectionilias5.3 (v4.0)Medium
CVE-2026-15485TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injectionTEW-821DAP5.3 (v4.0)Medium
CVE-2026-19785francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injectionRosarioSIS5.3 (v4.0)Medium
CVE-2026-29202cPanel Code Injection VulnerabilitycPanel5.3 (v4.0)Medium
CVE-2026-5547Tenda AC10 httpd formAddMacfilterRule os command injectionac10 firmware5.3 (v4.0)Medium
CVE-2025-59751Multiple vulnerabilities in AndSoft's e-TMSe-tms5.1 (v4.0)Medium
CVE-2025-59752Multiple vulnerabilities in AndSoft's e-TMSe-tms5.1 (v4.0)Medium
CVE-2025-59753Multiple vulnerabilities in AndSoft's e-TMSe-tms5.1 (v4.0)Medium
CVE-2025-59754Multiple vulnerabilities in AndSoft's e-TMSe-tms5.1 (v4.0)Medium
CVE-2025-59759Multiple vulnerabilities in AndSoft's e-TMSe-tms5.1 (v4.0)Medium
CVE-2025-59773Multiple vulnerabilities in AndSoft's e-TMSe-tms5.1 (v4.0)Medium
CVE-2025-59774Multiple vulnerabilities in AndSoft's e-TMSe-tms5.1 (v4.0)Medium
CVE-2013-2641Sophos Web Protection Appliance patience.cgi Directory Traversalweb appliance firmware5.0 (v2.0)Medium
CVE-2016-4807Web2py 2.14.5 - Multiple Vulnerabilitiesweb2py4.8 (v3.0)Medium
CVE-2026-112949Vitest: Code injection via unauthenticated manual mock registrationvitest4.7 (v3.1)Medium
CVE-2013-2643Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilitiesweb appliance firmware4.3 (v2.0)Medium
CVE-2025-63739rockoa Improper Access Control Vulnerabilityrockoa4.3 (v3.1)Medium
CVE-2026-36239PbootCMS v.3.2.11 Cross-site Scripting VulnerabilityPbootCMS v.3.2.114.3 (v3.1)Medium
CVE-2025-67737AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCEazuracast3.7 (v3.1)Low
CVE-2026-42201Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commandscoolify3.3 (v3.1)Low
CVE-2025-14276Ilevia EVE X1 Server leaf_search.php command injectionEVE X1 Server2.9 (v4.0)Low
CVE-2026-38924Serena Incorrect Resource Transfer Between Spheres VulnerabilitySerena2.9 (v3.1)Low
CVE-2025-11138mirweiye wenkucms common.php createPathOne os command injectionwenkucms2.1 (v4.0)Low
CVE-2025-11490wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injectiondesktopcommandermcp2.1 (v4.0)Low
CVE-2025-11902yanyutao0402 ChanCMS findField sql injectionchancms2.1 (v4.0)Low
CVE-2025-11903yanyutao0402 ChanCMS update sql injectionchancms2.1 (v4.0)Low
CVE-2025-11905yanyutao0402 ChanCMS gather.js getArticle code injectionchancms2.1 (v4.0)Low
CVE-2025-12266Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injectionCentral Authentication Service2.1 (v4.0)Low
CVE-2025-14204TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injecherry-studio-TykoFork2.1 (v4.0)Low
CVE-2025-14731CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template enginectcms2.1 (v4.0)Low
CVE-2026-10172Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted uploadMulti-Store Inventory Management System2.1 (v4.0)Low
CVE-2026-101859RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injectionraspap-webgui2.1 (v4.0)Low
CVE-2026-101861Langflow Code Execution via eval() in Component Input Schemalangflow2.1 (v4.0)Low
CVE-2026-10279hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injectionwezterm-mcp2.1 (v4.0)Low
CVE-2026-1029060xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injectiongithub-mcp-server2.1 (v4.0)Low
CVE-2026-103540formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engineForm Tools2.1 (v4.0)Low
CVE-2026-105329TallCMS PluginManager ThemeManager.php code injectionTallCMS2.1 (v4.0)Low
CVE-2026-111986AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injectionstable-diffusion-webui2.1 (v4.0)Low
CVE-2026-112078RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injectionRetrieval-based-Voice-Conversion-WebUI2.1 (v4.0)Low
CVE-2026-11408vertex-app vertex Log Viewer Endpoint LogMod.js os command injectionvertex2.1 (v4.0)Low
CVE-2026-12814Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injectionCF-WR631AX V32.1 (v4.0)Low
CVE-2026-13560Edimax EW-7478APC POST Request formAccept os command injectionEW-7478APC2.1 (v4.0)Low
CVE-2026-13561Edimax EW-7478APC POST Request formiNICbasic os command injectionEW-7478APC2.1 (v4.0)Low
CVE-2026-13581Edimax EW-7478APC POST Request formStaDrvSetup os command injectionEW-7478APC2.1 (v4.0)Low
CVE-2026-14691SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injectMulti-Vendor Online Grocery Management System2.1 (v4.0)Low
CVE-2026-14698SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted uploadSyllabus-Aligned Learning Management and Examination System2.1 (v4.0)Low
CVE-2026-15496SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injectionsonic-agent2.1 (v4.0)Low
CVE-2026-15512pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injectionPig2.1 (v4.0)Low
CVE-2026-19932DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injectionNotice-System-Managent2.1 (v4.0)Low
CVE-2026-19958iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injectionpptr-mcp2.1 (v4.0)Low
CVE-2026-5351Trendnet TEW-657BRM setup.cgi add_wps_client os command injectiontew-657brm firmware2.1 (v4.0)Low
CVE-2026-5352Trendnet TEW-657BRM setup.cgi edit os command injectiontew-657brm firmware2.1 (v4.0)Low
CVE-2026-5353Trendnet TEW-657BRM setup.cgi ping_test os command injectiontew-657brm firmware2.1 (v4.0)Low
CVE-2026-5354Trendnet TEW-657BRM setup.cgi vpn_connect os command injectiontew-657brm firmware2.1 (v4.0)Low
CVE-2026-5355Trendnet TEW-657BRM setup.cgi vpn_drop os command injectiontew-657brm firmware2.1 (v4.0)Low
CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionwarm-flow2.1 (v4.0)Low
CVE-2026-6489QueryMine sms Background Management addteacher.php unrestricted uploadsms2.1 (v4.0)Low
CVE-2026-7508Bootstrap CMS Page Creation show.blade.php code injectionCMS2.1 (v4.0)Low
CVE-2026-7600ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injectionyii2-mcp-server2.1 (v4.0)Low
CVE-2026-7642pskill9 website-downloader MCP index.ts download_website os command injectionwebsite-downloader2.1 (v4.0)Low
CVE-2026-7653r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injectionmcp-server-rijksmuseum2.1 (v4.0)Low
CVE-2026-7683Edimax BR-6428nC Web setWAN command injectionBR-6428nC2.1 (v4.0)Low
CVE-2026-78166provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injectionkafka-ui2.1 (v4.0)Low
CVE-2026-8188Wavlink NU516U1 adm.cgi change_wifi_password os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8189Wavlink NU516U1 adm.cgi wzdrepeater os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8190Wavlink NU516U1 adm.cgi wan os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8191Wavlink NU516U1 adm.cgi wifi_region os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8192Wavlink NU516U1 adm.cgi wzdap os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8227Wavlink NU516U1 adm.cgi wzdapMesh os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8228Wavlink NU516U1 wireless.cgi advance os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8229Wavlink NU516U1 wireless.cgi WifiBasic os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8230Wavlink NU516U1 login.cgi sys_login1 os command injectionwl-nu516u1 firmware2.1 (v4.0)Low
CVE-2026-8264Tenda AC6 httpd WifiApScan formWifiApScan os command injectionac6 firmware2.1 (v4.0)Low
CVE-2026-90488Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injectionxxl-job2.1 (v4.0)Low
CVE-2026-90581cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injectionnginxWebUI2.1 (v4.0)Low
CVE-2026-91853TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injectionX5000R2.1 (v4.0)Low
CVE-2026-92993Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injectionmayfly-go2.1 (v4.0)Low
CVE-2026-9302546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injectionvps-inventory-monitoring2.1 (v4.0)Low
CVE-2026-9343Edimax EW-7438RPn webs formWpsStart os command injectionEW-7438RPn2.1 (v4.0)Low
CVE-2026-9347Edimax EW-7438RPn webs formWizSurvey os command injectionEW-7438RPn2.1 (v4.0)Low
CVE-2026-9424Edimax EW-7438RPn Content-Type formWlanMP os command injectionEW-7438RPn2.1 (v4.0)Low
CVE-2026-9511Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2026-9512Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2026-9514Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2026-9515Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2026-9531Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2026-9532Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2026-9533Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2026-9534Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injectionCA750-PoE2.1 (v4.0)Low
CVE-2025-11073Keyfactor RG-EW5100BE HTTP POST Request cmd command injectionRG-EW5100BE2.0 (v4.0)Low
CVE-2025-11141Ruijie NBR2100G-E branch_passw.php listAction os command injectionNBR2100G-E2.0 (v4.0)Low
CVE-2025-13198DouPHP file.class.php unrestricted uploadDouPHP2.0 (v4.0)Low
CVE-2025-14729CTCMS Content Management System Backend App Configuration Ct_App.php save code injectionctcms2.0 (v4.0)Low
CVE-2025-14730CTCMS Content Management System Backend System Configuration Ct_Config.php code injectionctcms2.0 (v4.0)Low
CVE-2025-14837ZZCMS Backend Website Settings siteconfig.php stripfxg code injectionzzcms2.0 (v4.0)Low
CVE-2025-15130shanyu SyCms Administrative Panel FileManageController.class.php addPost code injectionSyCms2.0 (v4.0)Low
CVE-2025-15148CmsEasy Backend Template Management template_admin.php savetemp_action code injectioncmseasy2.0 (v4.0)Low
CVE-2025-15394iCMS POST Parameter ConfigAdmincp.php save code injectionicms2.0 (v4.0)Low
CVE-2026-105226osCommerce osCommerce2 Newsletter Management newsletters.php include code injectionosCommerce22.0 (v4.0)Low
CVE-2026-112195FusionPBX Dialplan Editor dialplan.php os command injectionFusionPBX2.0 (v4.0)Low
CVE-2026-19964Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injectionJij-MCP-Server2.0 (v4.0)Low
CVE-2026-5848jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injectionJimuReport2.0 (v4.0)Low
CVE-2026-78140Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engineUJCMS2.0 (v4.0)Low
CVE-2026-8259Tenda AC6 httpd telnet os command injectionac6 firmware2.0 (v4.0)Low
CVE-2026-8265Tenda AC6 httpd getLogFile get_log_file os command injectionac6 firmware2.0 (v4.0)Low
CVE-2026-82678diem-project diem Administrative Console actions.class.php executeCommand os command injectiondiem2.0 (v4.0)Low
CVE-2026-82702Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injectionBR-6214K2.0 (v4.0)Low
CVE-2026-82703Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injectionBR-6214K2.0 (v4.0)Low
CVE-2026-85040ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injectionCRMEB2.0 (v4.0)Low
CVE-2026-90705D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injectionDWR-M9212.0 (v4.0)Low
CVE-2026-90706D-Link DWR-M921 formWsc os command injectionDWR-M9212.0 (v4.0)Low
CVE-2026-90709Yot CMS Admin Console admin.php eval code injectionCMS2.0 (v4.0)Low
CVE-2026-90788magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injectionMacCMS102.0 (v4.0)Low
CVE-2026-94103RooCMS Frontend Rendering site_pagePHP.php eval code injectionRooCMS2.0 (v4.0)Low
CVE-2026-113388opensource-socialnetwork Cache Settings dynamic.php input code injectionopensource-socialnetwork1.9 (v4.0)Low
CVE-2026-16129princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklistSafestClaw1.9 (v4.0)Low
CVE-2026-5621ChrisChinchilla Vale-MCP HTTP index.ts os command injectionVale-MCP1.9 (v4.0)Low
CVE-2026-19353DedeCMS Installation Wizard index.php _4_Setup file inclusionDedeCMS1.3 (v4.0)Low
CVE-2026-108827Zen Cart Administrative Module Management general.php zen_call_function code injectionZen Cart1.2 (v4.0)Low

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWERelated Published CVEs
CWE-15CVE-2026-45087
CWE-20CVE-2026-47668 , CVE-2026-72867 , CVE-2014-3206 , CVE-2026-35048 , CVE-2026-57499 , CVE-2016-0792 , CVE-2026-24893 , CVE-2026-34197 , CVE-2026-35031 , CVE-2026-45505 , CVE-2026-84317 , CVE-2025-34115 , CVE-2026-28797 , CVE-2026-55094 , CVE-2026-54710 , CVE-2026-42588 , CVE-2026-27891
CWE-22CVE-2024-13984 , CVE-2026-7411 , CVE-2026-57155 , CVE-2016-7552 , CVE-2019-25687 , CVE-2026-48768 , CVE-2026-64824 , CVE-2026-50006 , CVE-2026-35031 , CVE-2026-57296 , CVE-2026-82217 , CVE-2026-85731 , CVE-2019-25671 , CVE-2026-116009 , CVE-2026-40521 , CVE-2025-59711 , CVE-2026-19942 , CVE-2026-46581 , CVE-2026-53554 , CVE-2026-9777 , CVE-2025-59709 , CVE-2026-40909 , CVE-2026-4502 , CVE-2025-13262 , CVE-2013-2641
CWE-27CVE-2024-24809
CWE-59CVE-2026-85731 , CVE-2026-71964
CWE-73CVE-2024-13984 , CVE-2026-57155 , CVE-2026-85520 , CVE-2025-65473 , CVE-2026-50006 , CVE-2026-15983 , CVE-2025-58762 , CVE-2026-19353
CWE-74CVE-2026-44182 , CVE-2013-2251 , CVE-2023-22527 , CVE-2023-43661 , CVE-2026-45344 , CVE-2026-71320 , CVE-2015-1592 , CVE-2026-11450 , CVE-2026-116253 , CVE-2026-5739 , CVE-2026-10821 , CVE-2025-10090 , CVE-2025-13786 , CVE-2025-13792 , CVE-2025-9596 , CVE-2026-112252 , CVE-2026-5333 , CVE-2026-5631 , CVE-2026-5736 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2026-9474 , CVE-2026-54543 , CVE-2023-7299 , CVE-2025-10097 , CVE-2025-11344 , CVE-2026-19785 , CVE-2025-14276 , CVE-2025-11902 , CVE-2025-11903 , CVE-2025-11905 , CVE-2025-12266 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-15512 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-6125 , CVE-2026-7508 , CVE-2026-7683 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-11073 , CVE-2025-14729 , CVE-2025-14730 , CVE-2025-14837 , CVE-2025-15130 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-90709 , CVE-2026-94103 , CVE-2026-113388 , CVE-2026-108827
CWE-77CVE-2026-105134 , CVE-2026-108576 , CVE-2026-26015 , CVE-2026-72869 , CVE-2016-10108 , CVE-2016-1555 , CVE-2020-13117 , CVE-2021-1498 , CVE-2022-40022 , CVE-2023-30258 , CVE-2023-45498 , CVE-2026-34243 , CVE-2026-35847 , CVE-2026-8037 , CVE-2024-9264 , CVE-2026-47670 , CVE-2025-10364 , CVE-2025-59735 , CVE-2025-59736 , CVE-2025-59737 , CVE-2025-59738 , CVE-2025-59739 , CVE-2025-59740 , CVE-2025-59741 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-102240 , CVE-2026-108804 , CVE-2026-41304 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9408 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9475 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2020-15874 , CVE-2025-51457 , CVE-2026-88622 , CVE-2024-12971 , CVE-2026-100896 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-108894 , CVE-2026-109108 , CVE-2026-113390 , CVE-2026-113506 , CVE-2026-55182 , CVE-2026-82692 , CVE-2026-85223 , CVE-2026-86299 , CVE-2026-90699 , CVE-2026-101009 , CVE-2026-82690 , CVE-2026-82691 , CVE-2026-85222 , CVE-2026-85224 , CVE-2026-90702 , CVE-2026-90703 , CVE-2026-92397 , CVE-2026-92398 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2026-36540 , CVE-2023-31742 , CVE-2025-29635 , CVE-2026-7693 , CVE-2024-11320 , CVE-2026-11450 , CVE-2026-19983 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5333 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7062 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90619 , CVE-2026-90690 , CVE-2026-90843 , CVE-2026-15485 , CVE-2026-5547 , CVE-2025-14276 , CVE-2025-11138 , CVE-2025-11490 , CVE-2025-14204 , CVE-2026-101859 , CVE-2026-10279 , CVE-2026-102906 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-13560 , CVE-2026-13561 , CVE-2026-13581 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7600 , CVE-2026-7642 , CVE-2026-7653 , CVE-2026-7683 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-8264 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9343 , CVE-2026-9347 , CVE-2026-9424 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11073 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-8259 , CVE-2026-8265 , CVE-2026-82678 , CVE-2026-82702 , CVE-2026-82703 , CVE-2026-85040 , CVE-2026-90705 , CVE-2026-90706 , CVE-2026-90788 , CVE-2026-5621
CWE-78CVE-2025-34030 , CVE-2025-34037 , CVE-2026-100382 , CVE-2026-105134 , CVE-2026-108576 , CVE-2026-19188 , CVE-2026-34234 , CVE-2026-41900 , CVE-2026-45087 , CVE-2026-49869 , CVE-2026-8985 , CVE-2021-21345 , CVE-2026-105691 , CVE-2026-105697 , CVE-2026-105740 , CVE-2026-34038 , CVE-2026-40933 , CVE-2026-42454 , CVE-2026-45629 , CVE-2026-45632 , CVE-2026-48030 , CVE-2026-57155 , CVE-2026-63298 , CVE-2026-72738 , CVE-2026-72740 , CVE-2026-72865 , CVE-2026-72867 , CVE-2026-72868 , CVE-2026-72869 , CVE-2026-72872 , CVE-2026-72876 , CVE-2026-72882 , CVE-2026-72902 , CVE-2026-73263 , CVE-2026-73294 , CVE-2018-16167 , CVE-2019-12985 , CVE-2019-12986 , CVE-2019-16920 , CVE-2020-10987 , CVE-2020-25223 , CVE-2020-25494 , CVE-2021-1498 , CVE-2021-22502 , CVE-2021-32305 , CVE-2021-33357 , CVE-2021-4039 , CVE-2022-2486 , CVE-2022-2488 , CVE-2022-29303 , CVE-2022-31499 , CVE-2022-44877 , CVE-2022-45699 , CVE-2023-25280 , CVE-2023-30258 , CVE-2023-7116 , CVE-2025-66401 , CVE-2026-110392 , CVE-2026-12940 , CVE-2026-18482 , CVE-2026-34243 , CVE-2026-37281 , CVE-2026-42846 , CVE-2026-45018 , CVE-2026-45748 , CVE-2026-48687 , CVE-2026-49819 , CVE-2026-53545 , CVE-2026-57124 , CVE-2026-79408 , CVE-2026-35906 , CVE-2026-72878 , CVE-2026-8986 , CVE-2013-10060 , CVE-2014-125118 , CVE-2020-36856 , CVE-2025-66210 , CVE-2026-103056 , CVE-2026-47670 , CVE-2026-58146 , CVE-2026-63732 , CVE-2026-6644 , CVE-2026-72879 , CVE-2026-73483 , CVE-2009-20010 , CVE-2013-2642 , CVE-2025-34125 , CVE-2025-59735 , CVE-2025-59736 , CVE-2025-59737 , CVE-2025-59738 , CVE-2025-59739 , CVE-2025-59740 , CVE-2025-59741 , CVE-2025-71284 , CVE-2025-71336 , CVE-2025-71429 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-102240 , CVE-2026-105110 , CVE-2026-107780 , CVE-2026-108804 , CVE-2026-113802 , CVE-2026-19586 , CVE-2026-34106 , CVE-2026-34108 , CVE-2026-34109 , CVE-2026-34110 , CVE-2026-34111 , CVE-2026-34112 , CVE-2026-34115 , CVE-2026-41315 , CVE-2026-41923 , CVE-2026-41925 , CVE-2026-53975 , CVE-2026-58147 , CVE-2026-58457 , CVE-2026-60121 , CVE-2026-61498 , CVE-2026-63766 , CVE-2026-64625 , CVE-2026-67308 , CVE-2026-71921 , CVE-2026-71944 , CVE-2026-71945 , CVE-2026-71946 , CVE-2026-71947 , CVE-2026-71948 , CVE-2026-71949 , CVE-2026-71950 , CVE-2026-71951 , CVE-2026-71952 , CVE-2026-71953 , CVE-2026-71954 , CVE-2026-71955 , CVE-2026-71956 , CVE-2026-71984 , CVE-2026-71992 , CVE-2026-89308 , CVE-2026-59800 , CVE-2026-63304 , CVE-2026-63305 , CVE-2026-80138 , CVE-2021-21809 , CVE-2025-66203 , CVE-2026-10131 , CVE-2026-10135 , CVE-2026-12486 , CVE-2026-12849 , CVE-2026-12850 , CVE-2026-12851 , CVE-2026-33568 , CVE-2026-35499 , CVE-2026-40627 , CVE-2026-57499 , CVE-2026-79766 , CVE-2026-79916 , CVE-2026-9814 , CVE-2026-102608 , CVE-2026-45630 , CVE-2026-45750 , CVE-2026-91931 , CVE-2026-33765 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-73570 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9408 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9475 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2016-10709 , CVE-2017-18370 , CVE-2017-6398 , CVE-2017-6884 , CVE-2018-15877 , CVE-2019-25066 , CVE-2020-10221 , CVE-2020-17505 , CVE-2020-26217 , CVE-2021-20039 , CVE-2023-34127 , CVE-2025-66209 , CVE-2026-105106 , CVE-2026-105797 , CVE-2026-110908 , CVE-2026-24893 , CVE-2026-26899 , CVE-2026-30971 , CVE-2026-34057 , CVE-2026-34153 , CVE-2026-34158 , CVE-2026-34197 , CVE-2026-34594 , CVE-2026-34599 , CVE-2026-35196 , CVE-2026-35519 , CVE-2026-35520 , CVE-2026-41208 , CVE-2026-45578 , CVE-2026-45662 , CVE-2026-52483 , CVE-2026-52484 , CVE-2026-54149 , CVE-2026-58195 , CVE-2026-59734 , CVE-2026-62312 , CVE-2026-72875 , CVE-2026-73222 , CVE-2026-77601 , CVE-2026-79423 , CVE-2026-82804 , CVE-2005-10004 , CVE-2015-10145 , CVE-2025-30007 , CVE-2025-34115 , CVE-2025-34311 , CVE-2025-34312 , CVE-2025-34334 , CVE-2026-100852 , CVE-2026-28797 , CVE-2026-34791 , CVE-2026-34792 , CVE-2026-34793 , CVE-2026-34794 , CVE-2026-34795 , CVE-2026-34796 , CVE-2026-34797 , CVE-2026-46746 , CVE-2026-58000 , CVE-2026-58452 , CVE-2026-64837 , CVE-2026-69096 , CVE-2026-71966 , CVE-2026-72870 , CVE-2026-72874 , CVE-2026-73680 , CVE-2026-7551 , CVE-2026-76060 , CVE-2026-79756 , CVE-2026-90770 , CVE-2026-92580 , CVE-2013-10061 , CVE-2025-68700 , CVE-2026-100896 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-108894 , CVE-2026-109108 , CVE-2026-111214 , CVE-2026-111217 , CVE-2026-111218 , CVE-2026-113390 , CVE-2026-113506 , CVE-2026-22100 , CVE-2026-40187 , CVE-2026-53804 , CVE-2026-61517 , CVE-2026-63725 , CVE-2026-65711 , CVE-2026-67599 , CVE-2026-67608 , CVE-2026-71906 , CVE-2026-71907 , CVE-2026-71908 , CVE-2026-71913 , CVE-2026-71915 , CVE-2026-71918 , CVE-2026-71919 , CVE-2026-71923 , CVE-2026-71924 , CVE-2026-71925 , CVE-2026-71926 , CVE-2026-71927 , CVE-2026-71928 , CVE-2026-71929 , CVE-2026-71930 , CVE-2026-71931 , CVE-2026-71943 , CVE-2026-75121 , CVE-2026-75122 , CVE-2026-75123 , CVE-2026-80214 , CVE-2026-82692 , CVE-2026-84194 , CVE-2026-85223 , CVE-2026-86299 , CVE-2026-86733 , CVE-2026-90699 , CVE-2026-101009 , CVE-2026-82690 , CVE-2026-82691 , CVE-2026-85222 , CVE-2026-85224 , CVE-2026-90702 , CVE-2026-90703 , CVE-2026-92397 , CVE-2026-92398 , CVE-2026-55786 , CVE-2024-58274 , CVE-2025-69755 , CVE-2026-48695 , CVE-2026-55173 , CVE-2026-52831 , CVE-2026-79755 , CVE-2019-20499 , CVE-2019-20500 , CVE-2019-20501 , CVE-2026-108161 , CVE-2026-40519 , CVE-2026-57999 , CVE-2026-53534 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2025-58763 , CVE-2026-71284 , CVE-2026-81669 , CVE-2026-92263 , CVE-2026-48997 , CVE-2026-58502 , CVE-2026-19983 , CVE-2026-79761 , CVE-2026-55679 , CVE-2026-72739 , CVE-2026-45626 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7062 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90619 , CVE-2026-90690 , CVE-2026-90843 , CVE-2026-15485 , CVE-2026-5547 , CVE-2026-42201 , CVE-2025-11138 , CVE-2025-11490 , CVE-2025-14204 , CVE-2026-101859 , CVE-2026-10279 , CVE-2026-102906 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-13560 , CVE-2026-13561 , CVE-2026-13581 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7600 , CVE-2026-7642 , CVE-2026-7653 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-8264 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9343 , CVE-2026-9347 , CVE-2026-9424 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-8259 , CVE-2026-8265 , CVE-2026-82678 , CVE-2026-82702 , CVE-2026-82703 , CVE-2026-85040 , CVE-2026-90705 , CVE-2026-90706 , CVE-2026-90788 , CVE-2026-5621
CWE-79CVE-2026-73041 , CVE-2026-73042 , CVE-2026-48768 , CVE-2024-39024 , CVE-2026-104078 , CVE-2017-12544 , CVE-2026-58391 , CVE-2025-59751 , CVE-2025-59752 , CVE-2025-59753 , CVE-2025-59754 , CVE-2025-59759 , CVE-2025-59773 , CVE-2025-59774 , CVE-2016-4807 , CVE-2013-2643 , CVE-2026-36239
CWE-83CVE-2026-58391
CWE-88CVE-2026-57572 , CVE-2026-113708 , CVE-2026-44450 , CVE-2026-73294 , CVE-2026-100714 , CVE-2026-108963 , CVE-2026-107639 , CVE-2026-47250
CWE-89CVE-2026-8054 , CVE-2026-55634 , CVE-2026-69084 , CVE-2015-3934 , CVE-2018-7841 , CVE-2019-5893 , CVE-2020-18662 , CVE-2020-5722 , CVE-2021-31856 , CVE-2023-27637 , CVE-2023-30194 , CVE-2023-39361 , CVE-2023-46347 , CVE-2023-6655 , CVE-2024-24495 , CVE-2024-6671 , CVE-2026-38428 , CVE-2019-16383 , CVE-2026-33324 , CVE-2024-33559 , CVE-2026-42647 , CVE-2026-34612 , CVE-2018-7765 , CVE-2022-3800 , CVE-2023-45375 , CVE-2023-49085 , CVE-2023-7137 , CVE-2026-32271 , CVE-2014-3704 , CVE-2014-3996 , CVE-2015-2824 , CVE-2023-34133 , CVE-2025-11452 , CVE-2023-1211 , CVE-2024-4257 , CVE-2026-55679 , CVE-2024-32231 , CVE-2026-61852 , CVE-2025-10090 , CVE-2025-9596 , CVE-2026-112252 , CVE-2026-5736 , CVE-2026-9474 , CVE-2023-7299 , CVE-2026-19785 , CVE-2025-11902 , CVE-2025-11903
CWE-93CVE-2026-84372 , CVE-2026-35519 , CVE-2026-35520 , CVE-2026-111221
CWE-94CVE-2026-10134 , CVE-2026-41900 , CVE-2026-47668 , CVE-2026-57572 , CVE-2026-8984 , CVE-2021-21345 , CVE-2025-11539 , CVE-2026-46512 , CVE-2026-55565 , CVE-2026-55634 , CVE-2026-8481 , CVE-2022-45699 , CVE-2024-23692 , CVE-2024-32641 , CVE-2025-65719 , CVE-2025-67489 , CVE-2026-104586 , CVE-2026-30993 , CVE-2026-31040 , CVE-2026-38431 , CVE-2026-3960 , CVE-2026-46562 , CVE-2026-51861 , CVE-2026-51866 , CVE-2026-51881 , CVE-2026-51886 , CVE-2026-51911 , CVE-2026-55559 , CVE-2026-57131 , CVE-2026-62379 , CVE-2026-67827 , CVE-2026-67919 , CVE-2026-75031 , CVE-2026-75411 , CVE-2026-75414 , CVE-2026-79538 , CVE-2026-83627 , CVE-2026-86793 , CVE-2026-88393 , CVE-2026-48519 , CVE-2026-70477 , CVE-2026-88062 , CVE-2024-9264 , CVE-2025-62593 , CVE-2026-45272 , CVE-2026-55413 , CVE-2026-69256 , CVE-2026-82244 , CVE-2026-93985 , CVE-2017-20251 , CVE-2018-25357 , CVE-2026-108598 , CVE-2026-12257 , CVE-2026-58138 , CVE-2026-65008 , CVE-2026-70553 , CVE-2026-96754 , CVE-2026-114053 , CVE-2026-82531 , CVE-2026-37637 , CVE-2026-42555 , CVE-2026-46621 , CVE-2026-55511 , CVE-2026-58400 , CVE-2026-42238 , CVE-2026-47252 , CVE-2026-62674 , CVE-2026-69251 , CVE-2026-73485 , CVE-2026-73486 , CVE-2026-73487 , CVE-2026-43945 , CVE-2026-77956 , CVE-2019-15642 , CVE-2023-43661 , CVE-2025-66438 , CVE-2026-104851 , CVE-2026-34197 , CVE-2026-4327 , CVE-2026-45505 , CVE-2026-48017 , CVE-2026-55585 , CVE-2026-62675 , CVE-2026-6543 , CVE-2026-65660 , CVE-2026-78834 , CVE-2026-96795 , CVE-2021-47938 , CVE-2021-47939 , CVE-2022-50944 , CVE-2025-66474 , CVE-2026-100856 , CVE-2026-100864 , CVE-2026-109308 , CVE-2026-116811 , CVE-2026-28797 , CVE-2026-34965 , CVE-2026-49143 , CVE-2026-55094 , CVE-2026-64850 , CVE-2026-69100 , CVE-2026-72819 , CVE-2026-76836 , CVE-2026-82278 , CVE-2026-85604 , CVE-2026-85610 , CVE-2026-86732 , CVE-2026-42785 , CVE-2026-54710 , CVE-2026-56382 , CVE-2026-56703 , CVE-2026-61523 , CVE-2026-65693 , CVE-2026-69088 , CVE-2026-22244 , CVE-2026-42588 , CVE-2026-47398 , CVE-2026-71320 , CVE-2025-6204 , CVE-2026-105764 , CVE-2026-66738 , CVE-2026-46581 , CVE-2025-68619 , CVE-2026-108593 , CVE-2025-62429 , CVE-2026-13392 , CVE-2026-77939 , CVE-2026-116253 , CVE-2026-5739 , CVE-2026-55679 , CVE-2026-63432 , CVE-2026-44287 , CVE-2025-13786 , CVE-2025-13792 , CVE-2026-54611 , CVE-2026-5631 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2025-10097 , CVE-2025-11344 , CVE-2026-29202 , CVE-2026-112949 , CVE-2025-11905 , CVE-2025-12266 , CVE-2026-101861 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-15512 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-6125 , CVE-2026-7508 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-14729 , CVE-2025-14730 , CVE-2025-14837 , CVE-2025-15130 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-90709 , CVE-2026-94103 , CVE-2026-113388 , CVE-2026-108827
CWE-95CVE-2026-46562 , CVE-2026-47391 , CVE-2026-39932 , CVE-2025-31114 , CVE-2026-61511 , CVE-2025-66474 , CVE-2026-55094 , CVE-2026-40187 , CVE-2025-48868 , CVE-2026-101861
CWE-98CVE-2026-39353 , CVE-2023-49084
CWE-116CVE-2026-112949
CWE-119CVE-2021-1472
CWE-120CVE-2026-36796
CWE-121CVE-2026-76070 , CVE-2026-76071 , CVE-2026-36783
CWE-183CVE-2026-16129
CWE-184CVE-2026-49869 , CVE-2026-41934 , CVE-2026-44287 , CVE-2026-16129
CWE-187CVE-2026-35031
CWE-200CVE-2025-69755 , CVE-2016-4806 , CVE-2026-51078 , CVE-2026-63432
CWE-250CVE-2026-41900 , CVE-2026-9209 , CVE-2026-55094
CWE-253CVE-2026-15686
CWE-266CVE-2026-101860
CWE-269CVE-2026-45632 , CVE-2026-64637 , CVE-2026-104798 , CVE-2026-49819 , CVE-2026-40484 , CVE-2019-25066 , CVE-2026-76801 , CVE-2026-72830 , CVE-2026-73664 , CVE-2026-101860
CWE-276CVE-2025-34332 , CVE-2025-34333
CWE-284CVE-2026-34234 , CVE-2026-41900 , CVE-2026-50006 , CVE-2026-43945 , CVE-2026-73664 , CVE-2026-11344 , CVE-2025-63739 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-285CVE-2026-34239
CWE-287CVE-2026-49869 , CVE-2021-1472 , CVE-2023-34124 , CVE-2025-27621 , CVE-2026-7630
CWE-288CVE-2026-20079 , CVE-2026-43945
CWE-290CVE-2022-24112
CWE-305CVE-2023-34124
CWE-306CVE-2026-45087 , CVE-2026-81735 , CVE-2026-47391 , CVE-2026-49819 , CVE-2026-57124 , CVE-2026-57131 , CVE-2026-53649 , CVE-2026-88062 , CVE-2014-125118 , CVE-2024-5910 , CVE-2026-105110 , CVE-2026-9209 , CVE-2026-73222 , CVE-2023-54350 , CVE-2025-34115 , CVE-2026-55094 , CVE-2026-63722 , CVE-2026-55786 , CVE-2026-49471 , CVE-2024-5721 , CVE-2017-10271 , CVE-2026-112949
CWE-321CVE-2026-89026
CWE-350CVE-2026-97875
CWE-352CVE-2026-53649 , CVE-2025-62593 , CVE-2016-4808 , CVE-2020-5776 , CVE-2026-73222 , CVE-2026-34228 , CVE-2025-12061 , CVE-2026-49471 , CVE-2014-100005
CWE-361CVE-2016-7547
CWE-362CVE-2026-42099
CWE-434CVE-2022-44276 , CVE-2026-103889 , CVE-2026-72592 , CVE-2026-107188 , CVE-2026-53649 , CVE-2009-20006 , CVE-2024-58348 , CVE-2026-35047 , CVE-2026-44402 , CVE-2023-7305 , CVE-2026-40484 , CVE-2026-50006 , CVE-2026-58409 , CVE-2019-9189 , CVE-2025-59710 , CVE-2025-65471 , CVE-2026-14498 , CVE-2026-17196 , CVE-2026-33704 , CVE-2021-47943 , CVE-2026-105123 , CVE-2026-34735 , CVE-2026-40488 , CVE-2026-67206 , CVE-2026-109397 , CVE-2026-23698 , CVE-2026-41587 , CVE-2024-24809 , CVE-2026-53599 , CVE-2026-27891 , CVE-2021-31207 , CVE-2026-11344 , CVE-2026-54611 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-470CVE-2026-46562 , CVE-2026-55559 , CVE-2026-62379 , CVE-2026-58400 , CVE-2026-79987 , CVE-2025-68455 , CVE-2026-6020 , CVE-2026-34216
CWE-479CVE-2026-44011
CWE-494CVE-2026-66398 , CVE-2026-107812
CWE-502CVE-2021-21345 , CVE-2018-19276 , CVE-2021-42237 , CVE-2026-3296 , CVE-2026-55573 , CVE-2019-10867 , CVE-2017-9805
CWE-552CVE-2026-40484
CWE-602CVE-2026-72867
CWE-639CVE-2026-72876 , CVE-2026-45750
CWE-641CVE-2026-46581
CWE-644CVE-2026-67179
CWE-669CVE-2026-38924
CWE-693CVE-2026-41900 , CVE-2026-39353 , CVE-2026-84317 , CVE-2026-84318
CWE-707CVE-2022-3800
CWE-732CVE-2017-20198 , CVE-2026-39353 , CVE-2026-73664
CWE-791CVE-2025-14731 , CVE-2026-103540 , CVE-2026-78140
CWE-798CVE-2017-18371 , CVE-2023-45499
CWE-829CVE-2026-45272 , CVE-2026-47398
CWE-835CVE-2024-20353
CWE-836CVE-2023-34132
CWE-862CVE-2026-45632 , CVE-2026-72868 , CVE-2026-72876 , CVE-2026-79920 , CVE-2021-21307 , CVE-2023-26035 , CVE-2026-49819 , CVE-2026-57131 , CVE-2026-41315 , CVE-2026-50006 , CVE-2025-10706 , CVE-2026-14357 , CVE-2025-12061 , CVE-2026-86438 , CVE-2026-96896 , CVE-2025-11372 , CVE-2025-67737
CWE-863CVE-2026-43945 , CVE-2026-105797 , CVE-2026-76836 , CVE-2026-86437
CWE-915CVE-2026-72710 , CVE-2026-78416
CWE-918CVE-2026-49869 , CVE-2021-34473
CWE-942CVE-2026-34449 , CVE-2026-53649
CWE-1188CVE-2026-47668 , CVE-2026-104078
CWE-1336CVE-2026-44181 , CVE-2024-23692 , CVE-2026-55559 , CVE-2025-66438 , CVE-2026-104851 , CVE-2026-105985 , CVE-2026-28797 , CVE-2026-72827 , CVE-2026-75574 , CVE-2026-22244 , CVE-2026-77939 , CVE-2025-14731 , CVE-2026-103540 , CVE-2026-78140
CWE-1392CVE-2026-41939