On this page

Atomicorp WAF Rule 344370

Rule Summary

Rule ID: 344370
Status: Active
Alert message: Atomicorp.com WAF Rules: RCE Bypass Technique
Observed CWEs: CWE-15 (1), CWE-19 (1), CWE-20 (32), CWE-22 (49), CWE-23 (1), CWE-59 (4), CWE-61 (2), CWE-73 (9), CWE-74 (72), CWE-77 (236), CWE-78 (489), CWE-79 (64), CWE-83 (1), CWE-88 (10), CWE-89 (61), CWE-91 (3), CWE-93 (4), CWE-94 (213), CWE-95 (12), CWE-96 (1), CWE-98 (3), CWE-112 (1), CWE-116 (1), CWE-119 (1), CWE-120 (1), CWE-121 (5), CWE-144 (1), CWE-183 (1), CWE-184 (5), CWE-187 (1), CWE-200 (15), CWE-250 (3), CWE-253 (1), CWE-255 (6), CWE-264 (3), CWE-266 (1), CWE-269 (10), CWE-276 (2), CWE-284 (16), CWE-285 (1), CWE-287 (11), CWE-288 (3), CWE-290 (2), CWE-295 (2), CWE-303 (1), CWE-305 (1), CWE-306 (27), CWE-310 (2), CWE-321 (1), CWE-326 (2), CWE-327 (1), CWE-350 (1), CWE-352 (16), CWE-361 (1), CWE-362 (1), CWE-424 (2), CWE-425 (1), CWE-434 (47), CWE-436 (1), CWE-470 (10), CWE-479 (1), CWE-494 (2), CWE-502 (48), CWE-522 (1), CWE-552 (1), CWE-601 (1), CWE-610 (4), CWE-611 (17), CWE-639 (2), CWE-641 (1), CWE-644 (1), CWE-669 (1), CWE-693 (5), CWE-697 (1), CWE-732 (3), CWE-787 (3), CWE-791 (3), CWE-798 (4), CWE-829 (5), CWE-835 (1), CWE-862 (16), CWE-863 (9), CWE-913 (1), CWE-915 (2), CWE-917 (2), CWE-918 (9), CWE-942 (2), CWE-1188 (2), CWE-1286 (1), CWE-1287 (1), CWE-1336 (13), CWE-1392 (1)
Revision: 2
Rule severity: Critical
Phase: 2 (request body)
Request surfaces: Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data, XML request data
Rule action: deny
HTTP status: 403
Public tags: RCE
Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “RCE Bypass Technique” in the request cookies, request argument names, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2009-0545	ZeroShell Remote Code Execution	zeroshell	10.0 (v2.0)	High
CVE-2009-3843	Apache Tomcat Manager Authenticated Upload Code Execution	operations manager	10.0 (v2.0)	High
CVE-2009-4188	Apache Tomcat Manager Authenticated Upload Code Execution	operations dashboard	10.0 (v2.0)	High
CVE-2009-4189	Apache Tomcat Manager Authenticated Upload Code Execution	operations manager	10.0 (v2.0)	High
CVE-2010-5324	Novell ZENworks Configuration Management Remote Execution	zenworks configuration management	10.0 (v2.0)	High
CVE-2011-1653	CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection	total defense	10.0 (v2.0)	High
CVE-2012-3260	HP SiteScope Remote Code Execution	sitescope	10.0 (v2.0)	High
CVE-2012-3261	HP SiteScope Remote Code Execution	sitescope	10.0 (v2.0)	High
CVE-2013-5755	Yealink VoIP Phone SIP-T38G - Remote Command Execution	sip-t38g	10.0 (v2.0)	High
CVE-2014-3828	Centreon SQL and Command Injection	centreon	10.0 (v2.0)	High
CVE-2014-3829	Centreon SQL and Command Injection	centreon	10.0 (v2.0)	High
CVE-2022-22947	Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947)	spring cloud gateway	10.0 (v3.1)	Critical
CVE-2022-24816	GeoServer Remote Code Injection caused by JAI-EXT (CVE-2022-24816/CVE-2023-35042)	jai-ext	10.0 (v3.1)	Critical
CVE-2024-13984	Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload	TianQing Management Center	10.0 (v4.0)	Critical
CVE-2024-28185	Judge0 sandbox escape	judge0	10.0 (v3.1)	Critical
CVE-2024-28189	Judge0 sandbox escape	judge0	10.0 (v3.1)	Critical
CVE-2024-46506	Unauthenticated RCE in NetAlertX	netalertx	10.0 (v3.1)	Critical
CVE-2025-34037	Linksys E-Series TheMoon Remote Command Injection	E4200	10.0 (v4.0)	Critical
CVE-2025-34073	Maltrail Unauthenticated Command Injection	Maltrail	10.0 (v4.0)	Critical
CVE-2025-49132	Pterodactyl Panel CVE-2025-49132 Remote Code Execution	panel	10.0 (v3.1)	Critical
CVE-2025-55182	React Server Components Flight Protocol Deserialization RCE (CVE-2025-55182)	react	10.0 (v3.1)	Critical
CVE-2025-57819	FreePBX ajax.php unauthenticated SQLi to RCE	freepbx	10.0 (v4.0)	Critical
CVE-2026-100382	Unauthenticated remote code execution through wikitext in ExternalData	Mediawiki - ExternalData Extension	10.0 (v4.0)	Critical
CVE-2026-10134	Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows	langflow	10.0 (v3.1)	Critical
CVE-2026-105134	Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection	cloud backup suite	10.0 (v4.0)	Critical
CVE-2026-108576	TOZED X300 IPPingDiagnostics process_ping os command injection	X300	10.0 (v4.0)	Critical
CVE-2026-19188	Haiwell IoT Cloud HMI Gateway OS Command Injection	Haiwell IoT Cloud HMI Gateway	10.0 (v4.0)	Critical
CVE-2026-20079	Cisco Secure Firewall Management Center Authentication Bypass RCE	Cisco Secure Firewall Management Center (FMC)	10.0 (v3.1)	Critical
CVE-2026-26015	Unauthenticated RCE in DocsGPT MCP STDIO Configuration	docsgpt	10.0 (v4.0)	Critical
CVE-2026-26216	Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter	crawl4ai	10.0 (v4.0)	Critical
CVE-2026-34234	CtrlPanel <= 1.1.1 - Remote Code Execution	ctrlpanel	10.0 (v3.1)	Critical
CVE-2026-41900	OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment	openlearnx	10.0 (v3.1)	Critical
CVE-2026-44181	Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution	enterprise gateway	10.0 (v4.0)	Critical
CVE-2026-45087	Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode	dalfox	10.0 (v3.1)	Critical
CVE-2026-45829	ChromaDB Deserialization of Untrusted Data Vulnerability	ChromaDB	10.0 (v4.0)	Critical
CVE-2026-47668	DbGate - Remote Code Execution via Anonymous JWT	dbgate	10.0 (v3.1)	Critical
CVE-2026-49869	Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`	kestra	10.0 (v3.1)	Critical
CVE-2026-57572	Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args	crawl4ai	10.0 (v3.1)	Critical
CVE-2026-7411	Eclipse BaSyx Arbitrary Code Execution Vulnerability	Eclipse BaSyx	10.0 (v3.1)	Critical
CVE-2026-81735	UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Executi	UI-TARS-desktop	10.0 (v4.0)	Critical
CVE-2026-8984	Unauthenticated RCE	maxicharger single charger firmware	10.0 (v4.0)	Critical
CVE-2026-8985	Unauthenticated Command Injection	maxicharger single charger firmware	10.0 (v4.0)	Critical
CVE-2019-15954	Total.js CMS 12 Widget JavaScript Code Injection	total.js cms	9.9 (v3.1)	Critical
CVE-2021-21881	Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection	premierwave 2050 firmware	9.9 (v3.1)	Critical
CVE-2025-11539	Arbitrary Code Execution in Grafana Image Renderer Plugin	grafana-image-renderer	9.9 (v3.1)	Critical
CVE-2026-105691	Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color	penpot	9.9 (v3.1)	Critical
CVE-2026-105697	Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration	langflow	9.9 (v3.1)	Critical
CVE-2026-105740	Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server	langflow	9.9 (v3.1)	Critical
CVE-2026-113708	Argo CD: A Kustomize remote ref can run commands in the repo-server	argo-cd	9.9 (v3.1)	Critical
CVE-2026-34038	Coolify authenticated remote command injection leading to RCE and secret exfiltration	coolify	9.9 (v3.1)	Critical
CVE-2026-34156	NocoBase - VM Sandbox Escape to Remote Code Execution	nocobase	9.9 (v3.1)	Critical
CVE-2026-34838	Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`	group-office	9.9 (v3.1)	Critical
CVE-2026-40933	Flowise: Authenticated RCE Via MCP Adapters	flowise	9.9 (v3.1)	Critical
CVE-2026-42454	Termix: OS Command Injection in Docker Container Management Endpoints	Termix	9.9 (v3.1)	Critical
CVE-2026-44450	Lumiverse: RCE via MCP stdio argument injection	Lumiverse	9.9 (v3.1)	Critical
CVE-2026-45629	Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint	dokploy	9.9 (v3.1)	Critical
CVE-2026-45632	Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution	dokploy	9.9 (v3.1)	Critical
CVE-2026-46512	Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping	frogman	9.9 (v3.1)	Critical
CVE-2026-48030	Pheditor 2.0.1-2.0.3 - OS Command Injection	pheditor	9.9 (v3.1)	Critical
CVE-2026-55565	Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)	yamcs	9.9 (v3.1)	Critical
CVE-2026-55634	Pimcore: Remote Code Execution via DataObject Class-Definition Field Name	pimcore	9.9 (v3.1)	Critical
CVE-2026-57155	OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer	core	9.9 (v3.1)	Critical
CVE-2026-63298	LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration	lxd	9.9 (v3.1)	Critical
CVE-2026-72738	Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter	dokploy	9.9 (v3.1)	Critical
CVE-2026-72740	Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`	dokploy	9.9 (v3.1)	Critical
CVE-2026-72865	Dokploy: OS Command Injection via compose `composePath`	dokploy	9.9 (v3.1)	Critical
CVE-2026-72868	Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection	dokploy	9.9 (v3.1)	Critical
CVE-2026-72869	Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE	dokploy	9.9 (v3.1)	Critical
CVE-2026-72872	Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`	dokploy	9.9 (v3.1)	Critical
CVE-2026-72876	Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*	dokploy	9.9 (v3.1)	Critical
CVE-2026-72882	Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers	dokploy	9.9 (v3.1)	Critical
CVE-2026-72902	Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById	dokploy	9.9 (v3.1)	Critical
CVE-2026-73263	Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path	prowler	9.9 (v3.1)	Critical
CVE-2026-73294	Semaphore U: OS Command Injection	semaphore	9.9 (v3.1)	Critical
CVE-2026-79920	Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task	ajenti	9.9 (v3.1)	Critical
CVE-2026-8481	Remote Code Execution via Code Validation Endpoint	langflow	9.9 (v3.1)	Critical
CVE-2012-0391	Apache Struts Remote Command Execution	struts	9.8 (v3.1)	Critical
CVE-2012-2576	Solarwinds Storage Manager 5.1.0 SQL Injection	backup profiler	9.8 (v3.0)	Critical
CVE-2012-5357	Ektron 8.02 XSLT Transform Remote Code Execution	ektron content management system	9.8 (v3.0)	Critical
CVE-2013-1359	SonicWALL GMS 6 Arbitrary File Upload	analyzer	9.8 (v3.1)	Critical
CVE-2013-2251	Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution	archiva	9.8 (v3.1)	Critical
CVE-2013-4864	MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities	veralite firmware	9.8 (v3.1)	Critical
CVE-2014-1203	Eyou E-Mail <3.6 - Remote Code Execution	eyou	9.8 (v3.1)	Critical
CVE-2014-8673	SO Planning 1.32 - Multiple Vulnerabilities	soplanning	9.8 (v3.1)	Critical
CVE-2014-8684	Seagate Business NAS Unauthenticated Remote Command Execution	codeigniter	9.8 (v3.0)	Critical
CVE-2014-8686	Seagate Business NAS Unauthenticated Remote Command Execution	codeigniter	9.8 (v3.0)	Critical
CVE-2014-8687	Seagate Business NAS Unauthenticated Remote Command Execution	business nas firmware	9.8 (v3.0)	Critical
CVE-2015-4664	Xceedium Xsuite - Multiple Vulnerabilities	privileged access manager	9.8 (v3.0)	Critical
CVE-2015-4667	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	9.8 (v3.0)	Critical
CVE-2015-8103	Jenkins-CI Unauthenticated Script-Console Scanner	openshift container platform	9.8 (v3.1)	Critical
CVE-2015-8249	ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability	desktop central	9.8 (v3.0)	Critical
CVE-2016-15043	WordPress WP Mobile Detector 3.5 Shell Upload	wp mobile detector	9.8 (v3.1)	Critical
CVE-2016-2555	ATutor 2.2.1 SQL Injection / Remote Code Execution	atutor	9.8 (v3.0)	Critical
CVE-2016-3087	Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution	struts	9.8 (v3.0)	Critical
CVE-2016-4010	Magento 2.0.6 Unserialize Remote Code Execution	magento	9.8 (v3.0)	Critical
CVE-2016-5734	phpMyAdmin Authenticated Remote Code Execution	phpmyadmin	9.8 (v3.0)	Critical
CVE-2016-7547	Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution	threat discovery appliance	9.8 (v3.0)	Critical
CVE-2016-7552	Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution	threat discovery appliance	9.8 (v3.0)	Critical
CVE-2017-0372	MediaWiki SyntaxHighlight extension option injection vulnerability	mediawiki	9.8 (v3.0)	Critical
CVE-2017-12611	Apache Struts2 S2-053 - Remote Code Execution	struts	9.8 (v3.0)	Critical
CVE-2017-12629	Apache Solr XML External Entity Injection (CVE-2017-12629)	solr	9.8 (v3.1)	Critical
CVE-2017-17672	vBulletin 5.x - 'cacheTemplates' Remote Arbitrary File Deletion	vbulletin	9.8 (v3.0)	Critical
CVE-2017-17731	DedeCMS 5.7 - SQL Injection	dedecms	9.8 (v3.0)	Critical
CVE-2017-18371	TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection	5200w-t firmware	9.8 (v3.0)	Critical
CVE-2017-8917	Joomla Component Fields SQLi Remote Code Execution	joomla!	9.8 (v3.0)	Critical
CVE-2018-1000861	Jenkins ACL Bypass and Metaprogramming RCE	jenkins	9.8 (v3.1)	Critical
CVE-2018-11535	Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection	slac	9.8 (v3.0)	Critical
CVE-2018-1273	Spring Data Commons - Remote Code Execution	spring data commons	9.8 (v3.1)	Critical
CVE-2018-15708	Nagios XI Magpie_debug.php Root Remote Code Execution	nagios xi	9.8 (v3.0)	Critical
CVE-2018-16763	FUEL CMS 1.4.1 - Remote Code Execution	fuel cms	9.8 (v3.1)	Critical
CVE-2018-17173	LG Supersign EZ CMS - Remote Code Execution	supersign cms	9.8 (v3.0)	Critical
CVE-2018-19276	OpenMRS Platform < 2.24.0 - Insecure Object Deserialization	openmrs	9.8 (v3.1)	Critical
CVE-2018-6220	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6223	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6228	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6229	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-7282	TITool PrintMonitor - Blind SQL Injection	printmonitor	9.8 (v3.1)	Critical
CVE-2018-7538	Tuleap 9.17.99.189 - Blind SQL Injection	tuleap	9.8 (v3.0)	Critical
CVE-2018-8733	Nagios XI Chained Remote Code Execution	nagios xi	9.8 (v3.0)	Critical
CVE-2018-8734	Nagios XI Chained Remote Code Execution	nagios xi	9.8 (v3.0)	Critical
CVE-2019-10068	Kentico CMS Staging SyncServer Unserialize Remote Command Execution	xperience	9.8 (v3.1)	Critical
CVE-2019-12725	Zeroshell 3.9.0 - Remote Command Execution	zeroshell	9.8 (v3.0)	Critical
CVE-2019-12985	Citrix SD-WAN Center - Remote Command Injection	netscaler sd-wan	9.8 (v3.0)	Critical
CVE-2019-12986	Citrix SD-WAN Center - Remote Command Injection	netscaler sd-wan	9.8 (v3.0)	Critical
CVE-2019-13372	D-Link Central WiFi Manager CWM(100) RCE	central wifimanager	9.8 (v3.1)	Critical
CVE-2019-16399	Western Digital My Book World II NAS 1.02.12 - Authentication Bypass / Command Execution	wd my book firmware	9.8 (v3.1)	Critical
CVE-2019-17564	Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization	dubbo	9.8 (v3.1)	Critical
CVE-2019-1935	Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	integrated management controller supervisor	9.8 (v3.1)	Critical
CVE-2019-1937	Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	integrated management controller supervisor	9.8 (v3.0)	Critical
CVE-2019-19781	Citrix ADC (NetScaler) Directory Traversal RCE	application delivery controller firmware	9.8 (v3.1)	Critical
CVE-2019-2729	Oracle WebLogic Server Administration Console - Remote Code Execution	communications diameter signaling router	9.8 (v3.1)	Critical
CVE-2019-5434	Revive Adserver 4.2 - Remote Code Execution	revive adserver	9.8 (v3.0)	Critical
CVE-2019-7238	Nexus Repository Manager 3 Unauthenticated Remote Code Execution (CVE-2019-7238)	nexus repository manager	9.8 (v3.1)	Critical
CVE-2019-7256	Linear eMerge E3-Series Access Controller Command Injection	linear emerge essential firmware	9.8 (v3.1)	Critical
CVE-2019-9670	Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF	zimbra collaboration suite	9.8 (v3.1)	Critical
CVE-2020-0646	SharePoint Workflows XOML Injection	.net framework	9.8 (v3.1)	Critical
CVE-2020-10987	Tenda AC15 AC1900 version 15.03.05.19 - Command Injection	ac15 firmware	9.8 (v3.1)	Critical
CVE-2020-13117	Wavlink Multiple AP - Remote Command Injection	wn575a4	9.8 (v3.1)	Critical
CVE-2020-13942	Apache Unomi Expression Language Injection RCE (CVE-2020-13942)	unomi	9.8 (v3.1)	Critical
CVE-2020-14750	Oracle WebLogic Server Administration Console Handle RCE	weblogic server	9.8 (v3.1)	Critical
CVE-2020-14882	Oracle WebLogic Server Administration Console Handle RCE	weblogic server	9.8 (v3.1)	Critical
CVE-2020-16152	Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE	aerohive netconfig	9.8 (v3.1)	Critical
CVE-2020-17456	SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution	slc-130	9.8 (v3.1)	Critical
CVE-2020-17496	vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution.	vbulletin	9.8 (v3.1)	Critical
CVE-2020-21224	Inspur ClusterEngine 4.0 - Remote Code Execution	clusterengine	9.8 (v3.1)	Critical
CVE-2020-25213	WordPress File Manager Unauthenticated Remote Code Execution	file manager	9.8 (v3.1)	Critical
CVE-2020-28188	TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution	tos	9.8 (v3.1)	Critical
CVE-2020-29390	Zeroshell 3.9.3 - Command Injection	zeroshell	9.8 (v3.1)	Critical
CVE-2020-3243	Cisco UCS Director Cloupia Script RCE	ucs director	9.8 (v3.1)	Critical
CVE-2020-3250	Cisco UCS Director Cloupia Script RCE	ucs director	9.8 (v3.1)	Critical
CVE-2020-35476	OpenTSDB Arbitrary Command Injection Remote Code Execution (CVE-2020-35476)	opentsdb	9.8 (v3.1)	Critical
CVE-2020-7356	Cayin xPost wayfinder_seqid SQLi to RCE	xpost	9.8 (v3.1)	Critical
CVE-2020-8518	Horde CSV import arbitrary PHP code execution	groupware	9.8 (v3.1)	Critical
CVE-2020-9054	Zyxel NAS Firmware 5.21- Remote Code Execution	nas326 firmware	9.8 (v3.1)	Critical
CVE-2021-1472	Cisco Small Business RV Series Authentication Bypass and Command Injection	rv160 firmware	9.8 (v3.1)	Critical
CVE-2021-1498	Cisco HyperFlex HX Data Platform Command Execution	hyperflex hx data platform	9.8 (v3.1)	Critical
CVE-2021-22175	GitLab CI Lint API - Server-Side Request Forgery	gitlab	9.8 (v3.1)	Critical
CVE-2021-22986	F5 iControl REST Unauthenticated SSRF Token Generation RCE	big-ip access policy manager	9.8 (v3.1)	Critical
CVE-2021-25281	SaltStack Salt API Unauthenticated RCE through wheel_async client	salt	9.8 (v3.1)	Critical
CVE-2021-32305	Websvn <2.6.1 - Remote Code Execution	websvn	9.8 (v3.1)	Critical
CVE-2021-32682	elFinder ZIP Arguments Injection Leads to Commands Injection (CVE-2021-32682)	elfinder	9.8 (v3.1)	Critical
CVE-2021-33357	RaspAP <=2.6.5 - Remote Command Injection	raspap	9.8 (v3.1)	Critical
CVE-2021-42325	Froxlor 0.10.29.1 - SQL Injection (Authenticated)	froxlor	9.8 (v3.1)	Critical
CVE-2022-20705	Cisco RV Series Authentication Bypass and Command Injection	rv340 firmware	9.8 (v3.1)	Critical
CVE-2022-22954	VMware Workspace ONE Access CVE-2022-22954	identity manager	9.8 (v3.1)	Critical
CVE-2022-24086	Adobe Commerce (Magento) - Remote Code Execution	commerce	9.8 (v3.1)	Critical
CVE-2022-24112	APISIX Admin API default access token RCE	apisix	9.8 (v3.1)	Critical
CVE-2022-2486	Wavlink WN535K2/WN535K3 - OS Command Injection	wl-wn535k2	9.8 (v3.1)	Critical
CVE-2022-28219	ManageEngine ADAudit Plus CVE-2022-28219	manageengine adaudit plus	9.8 (v3.1)	Critical
CVE-2022-29078	Node.js Embedded JavaScript 3.1.6 - Template Injection	ejs	9.8 (v3.1)	Critical
CVE-2022-29806	ZoneMinder Language Settings Remote Code Execution	zoneminder	9.8 (v3.1)	Critical
CVE-2022-40022	Symmetricom SyncServer Unauthenticated Remote Command Execution	syncserver s650 firmware	9.8 (v3.1)	Critical
CVE-2022-40881	SolarView 6.00 - Remote Command Execution	solarview compact	9.8 (v3.1)	Critical
CVE-2022-42889	Apache Commons Text RCE	commons text	9.8 (v3.1)	Critical
CVE-2022-44276	responsive filemanager Unrestricted Upload of File with Dangerous Type Vulnerability	responsive filemanager	9.8 (v3.1)	Critical
CVE-2022-45297	EQ Enterprise management system v2.2.0 - SQL Injection	eq	9.8 (v3.1)	Critical
CVE-2022-46169	Cacti remote_agent.php Pre-Auth Command Injection (CVE-2022-46169)	cacti	9.8 (v3.1)	Critical
CVE-2022-47966	ManageEngine Endpoint Central Unauthenticated SAML RCE	manageengine access manager plus	9.8 (v3.1)	Critical
CVE-2022-47986	IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution	linux kernel	9.8 (v3.1)	Critical
CVE-2023-22518	Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518)	confluence data center	9.8 (v3.1)	Critical
CVE-2023-26469	Jorani unauthenticated Remote Code Execution	jorani	9.8 (v3.1)	Critical
CVE-2023-27350	PaperCut PaperCutNG Authentication Bypass	papercut mf	9.8 (v3.1)	Critical
CVE-2023-29300	Adobe ColdFusion XML Deserialization Leads to RCE (CVE-2023-29300)	coldfusion	9.8 (v3.1)	Critical
CVE-2023-29357	Sharepoint Dynamic Proxy Generator Unauth RCE	sharepoint server	9.8 (v3.1)	Critical
CVE-2023-29827	Embedded JavaScript(EJS) 3.1.6 - Template Injection	ejs	9.8 (v3.1)	Critical
CVE-2023-30145	Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)	camaleon cms	9.8 (v3.1)	Critical
CVE-2023-3368	Chamilo LMS <= v1.11.20 Unauthenticated Command Injection	chamilo	9.8 (v3.1)	Critical
CVE-2023-33831	FUXA - Unauthenticated Remote Code Execution	fuxa	9.8 (v3.1)	Critical
CVE-2023-34960	Chamilo unauthenticated command injection in PowerPoint upload	chamilo	9.8 (v3.1)	Critical
CVE-2023-38203	Adobe ColdFusion - Deserialization of Untrusted Data	coldfusion	9.8 (v3.1)	Critical
CVE-2023-38646	Metabase Pre-Auth JDBC Remote Code Execution (CVE-2023-38646)	metabase	9.8 (v3.1)	Critical
CVE-2023-41892	CraftCMS ConditionsController Pre-Auth Remote Code Execution (CVE-2023-41892)	craft cms	9.8 (v3.1)	Critical
CVE-2023-44353	Adobe ColdFusion WDDX Deserialization Gadgets	coldfusion	9.8 (v3.1)	Critical
CVE-2023-4450	JeecgBoot JimuReport FreeMarker Server Side Template Injection RCE (CVE-2023-4450)	jimureport	9.8 (v3.1)	Critical
CVE-2023-46359	cPH2 Charging Station v1.87.0 - OS Command Injection	cph2 echarge	9.8 (v3.1)	Critical
CVE-2024-2054	Artica Proxy Unauthenticated PHP Deserialization Vulnerability	artica proxy	9.8 (v3.1)	Critical
CVE-2024-23759	Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability	gambio	9.8 (v3.1)	Critical
CVE-2024-32641	Masa CMS Vulnerable to Pre-Auth RCE via JSON API	masacms	9.8 (v3.1)	Critical
CVE-2024-34102	CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)	commerce	9.8 (v3.1)	Critical
CVE-2024-36401	GeoServer Unauthenticated Remote Code Execution in Evaluating Property Name Expressions (CVE-2024-36401)	geoserver	9.8 (v3.1)	Critical
CVE-2024-37014	Langflow <= 1.0.12 - Remote Code Execution	langflow	9.8 (v3.1)	Critical
CVE-2024-39907	1Panel Control Panel PostAuth SQL Injection (CVE-2024-39907)	1panel	9.8 (v3.1)	Critical
CVE-2024-4358	Telerik Report Server Auth Bypass and Deserialization RCE	report server 2024	9.8 (v3.1)	Critical
CVE-2024-43917	WordPress TI WooCommerce Wishlist SQL Injection (CVE-2024-43917)	ti woocommerce wishlist	9.8 (v3.1)	Critical
CVE-2024-45507	Apache OFBiz SSRF and Remote Code Execution (CVE-2024-45507)	ofbiz	9.8 (v3.1)	Critical
CVE-2024-50603	Aviatrix Controller - Remote Code Execution	controller	9.8 (v3.1)	Critical
CVE-2024-5827	Vanna - SQL injection	vanna-ai/vanna	9.8 (v3.0)	Critical
CVE-2024-6782	Calibre Python Code Injection (CVE-2024-6782)	Calibre	9.8 (v3.1)	Critical
CVE-2024-7954	SPIP Unauthenticated RCE via porte_plume Plugin	SPIP	9.8 (v3.1)	Critical
CVE-2024-8353	GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection	givewp	9.8 (v3.1)	Critical
CVE-2024-9193	WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update	whmcs	9.8 (v3.1)	Critical
CVE-2025-11749	WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE	AI Engine – The Chatbot, AI Framework & MCP for WordPress	9.8 (v3.1)	Critical
CVE-2025-24799	GLPI Inventory Plugin Unauthenticated Blind Boolean SQLi	glpi	9.8 (v3.1)	Critical
CVE-2025-29306	FoxCMS v.1.2.5 - Remote Code Execution	foxcms	9.8 (v3.1)	Critical
CVE-2025-3248	Langflow `validate/code` API Pre-Auth Remote Code Execution (CVE-2025-3248)	langflow	9.8 (v3.1)	Critical
CVE-2025-40536	SolarWinds Web Help Desk unauthenticated RCE	web help desk	9.8 (v3.1)	Critical
CVE-2025-40551	SolarWinds Web Help Desk unauthenticated RCE	web help desk	9.8 (v3.1)	Critical
CVE-2025-48827	vBulletin replaceAdTemplate Remote Code Execution	vbulletin	9.8 (v3.1)	Critical
CVE-2025-61882	Oracle E-Business Suite CVE-2025-61882 RCE	concurrent processing	9.8 (v3.1)	Critical
CVE-2025-62521	ChurchCRM Unauthenticated RCE via Setup Page	churchcrm	9.8 (v3.1)	Critical
CVE-2025-64446	Fortinet FortiWeb unauthenticated RCE	fortiweb	9.8 (v3.1)	Critical
CVE-2025-65719	Open Source Kubectl MCP Server v1.1.1 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2025-66401	MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL	mcp watch	9.8 (v3.1)	Critical
CVE-2025-66455	LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/con	lmdeploy	9.8 (v3.1)	Critical
CVE-2025-67489	@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development serve	vite-plugin-react	9.8 (v3.1)	Critical
CVE-2025-7441	WordPress StoryChief Plugin Unauthenticated RCE	StoryChief	9.8 (v3.1)	Critical
CVE-2026-0770	Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()	langflow	9.8 (v3.0)	Critical
CVE-2026-103889	3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter	3D Product configurator for WooCommerce	9.8 (v3.1)	Critical
CVE-2026-104586	AUTOM8N (WHM/cPanel plugin) through commit 82821f7 Command Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-104798	My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'a	My Calendar – Accessible Event Manager	9.8 (v3.1)	Critical
CVE-2026-110392	Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning	QA-Board	9.8 (v3.1)	Critical
CVE-2026-115806	Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Repla	Prime Mover – Backup and Migration	9.8 (v3.1)	Critical
CVE-2026-116692	MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-	mlflow	9.8 (v3.1)	Critical
CVE-2026-12940	Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoint	langflow	9.8 (v3.1)	Critical
CVE-2026-18482	neo-mjs Command Injection Vulnerability	neo-mjs	9.8 (v3.1)	Critical
CVE-2026-19912	Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability	Kaltura HTML5 Video Player, html5 library	9.8 (v3.1)	Critical
CVE-2026-30993	Slah CMS v1.5.0 and below Arbitrary Code Execution Vulnerability	Slah CMS v1.5.0 and below	9.8 (v3.1)	Critical
CVE-2026-31040	stata-mcp Code Injection Vulnerability	stata-mcp	9.8 (v3.1)	Critical
CVE-2026-3296	Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata	Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder	9.8 (v3.1)	Critical
CVE-2026-34243	wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`	wenxian	9.8 (v3.1)	Critical
CVE-2026-35048	Piwigo RCE via PHP Code Injection into Config File in Installer	Piwigo	9.8 (v3.1)	Critical
CVE-2026-35847	the CheckUils.php file Arbitrary Code Execution Vulnerability	the CheckUils.php file	9.8 (v3.1)	Critical
CVE-2026-37281	the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 Command Injection Vulnerability	the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0	9.8 (v3.1)	Critical
CVE-2026-38428	kestra SQL Injection Vulnerability	kestra	9.8 (v3.1)	Critical
CVE-2026-38431	erpnext Code Injection Vulnerability	erpnext	9.8 (v3.1)	Critical
CVE-2026-3960	Remote Code Execution in h2oai/h2o-3	h2o	9.8 (v3.1)	Critical
CVE-2026-42846	ClipBucket: Remote Play URL Command Injection	clipbucket-v5	9.8 (v3.1)	Critical
CVE-2026-45018	Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution	chainlit	9.8 (v3.1)	Critical
CVE-2026-45748	Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection	termix	9.8 (v3.1)	Critical
CVE-2026-46562	Yamcs: Remote Code Execution via Mission Database algorithm override	yamcs	9.8 (v3.1)	Critical
CVE-2026-47391	PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-48687	fastnetmon Command Injection Vulnerability	fastnetmon	9.8 (v3.1)	Critical
CVE-2026-49819	UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd	UpSnap	9.8 (v3.1)	Critical
CVE-2026-51861	bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-51866	Code Injection	-	9.8 (v3.1)	Critical
CVE-2026-51881	deeptutor 1.4.0 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-51886	Arbitrary Code Execution	-	9.8 (v3.1)	Critical
CVE-2026-51911	vanna v2.0.2 Code Injection Vulnerability	vanna v2.0.2	9.8 (v3.1)	Critical
CVE-2026-53545	Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection	Termix	9.8 (v3.1)	Critical
CVE-2026-55559	Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)	yamcs	9.8 (v3.1)	Critical
CVE-2026-55573	e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain	e107	9.8 (v3.1)	Critical
CVE-2026-57124	PraisonAI UI MCP connect endpoint allows unauthenticated local command execution	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-57131	praisonai: Jobs API exposes agent-execution endpoints with no authentication	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-62379	OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback	OpenAM	9.8 (v3.1)	Critical
CVE-2026-63030	WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution	WordPress	9.8 (v3.1)	Critical
CVE-2026-67827	Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-67919	Halo 2.25.4 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-72592	dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload	phpfm	9.8 (v3.1)	Critical
CVE-2026-75031	Interchange Arbitrary Code Execution Vulnerability	Interchange	9.8 (v3.1)	Critical
CVE-2026-75411	JeecgBoot v3.9.2 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-75414	In AntFlow V2.0.0, ActivitiTest.java Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-79408	MetaGPT 0.8.1 Command Injection Vulnerability	MetaGPT 0.8.1	9.8 (v3.1)	Critical
CVE-2026-79538	metatool-ai MetaMCP up to and including 2.4.22 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-8037	Progress ADC LoadMaster - Command Injection	connection manager for objectscale	9.8 (v3.1)	Critical
CVE-2026-83627	Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via	Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals \| Critical CSS \| Minify CSS \| Defer CSS Javascript \| CDN	9.8 (v3.1)	Critical
CVE-2026-84372	Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections	predis	9.8 (v3.1)	Critical
CVE-2026-86793	SGLang Unsafe Deserialization Vulnerability	SGLang	9.8 (v3.1)	Critical
CVE-2026-88393	WookTeam 1.6.6 and Earlier Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-93674	Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution	langflow	9.8 (v3.1)	Critical
CVE-2026-107188	Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution	Archibus	9.6 (v3.1)	Critical
CVE-2026-34449	SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection	siyuan	9.6 (v3.1)	Critical
CVE-2026-35906	An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 OS Command Injection Vulnerability	-	9.6 (v3.1)	Critical
CVE-2026-48519	Langflow: Unauthenticated RCE in Shareable Playgrounds	langflow	9.6 (v3.1)	Critical
CVE-2026-53649	Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE	joro	9.6 (v3.1)	Critical
CVE-2026-72878	Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments	dokploy	9.6 (v3.1)	Critical
CVE-2026-70477	Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability	flowise	9.5 (v4.0)	Critical
CVE-2026-88062	OmniRoute < 3.8.49 - Unauthenticated RCE	OmniRoute	9.5 (v4.0)	Critical
CVE-2026-8986	Command Injection via Malicious OCPP Server	maxicharger single charger firmware	9.5 (v4.0)	Critical
CVE-2020-36856	Nagios XI < 5.6.14 Authenticated RCE command_test.php via address	nagios xi	9.4 (v4.0)	Critical
CVE-2024-9264	Grafana SQL Expressions Remote Code Execution (CVE-2024-9264)	grafana	9.4 (v4.0)	Critical
CVE-2025-34074	Lucee Authenticated Scheduled Job Code Execution	Lucee	9.4 (v4.0)	Critical
CVE-2025-34292	BeWelcome/Rox PHP Object Injection RCE	Rox	9.4 (v4.0)	Critical
CVE-2025-62593	Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack	ray	9.4 (v4.0)	Critical
CVE-2025-66210	Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import	coolify	9.4 (v4.0)	Critical
CVE-2026-100714	Froxlor before 2.3.12 Command Injection via letsencryptchallengepath	froxlor	9.4 (v4.0)	Critical
CVE-2026-103056	AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR	AiSOC	9.4 (v4.0)	Critical
CVE-2026-33324	SQLBot prompt injection allows arbitrary SQL execution and remote code execution	sqlbot	9.4 (v4.0)	Critical
CVE-2026-39932	OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection	openemr	9.4 (v4.0)	Critical
CVE-2026-45272	MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File	talebook	9.4 (v4.0)	Critical
CVE-2026-47670	DbGate - Remote Code Execution via Dynamic Import Bypass	dbgate	9.4 (v4.0)	Critical
CVE-2026-55413	ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution	ToolJet	9.4 (v4.0)	Critical
CVE-2026-58146	Unauthorized remote code execution in T-Mobile 5G Box IDU routers	T-Mobile 5G Box IDU	9.4 (v4.0)	Critical
CVE-2026-63732	9router before 0.4.60 Remote Code Execution via default password	9router	9.4 (v4.0)	Critical
CVE-2026-66398	phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API	phpMyFAQ	9.4 (v4.0)	Critical
CVE-2026-6644	A command injection vulnerability was found in the PPTP VPN Clients on the ADM	data master	9.4 (v4.0)	Critical
CVE-2026-69256	Flowise: Remote Code Execution Vulnerability in CSVAgent	flowise	9.4 (v4.0)	Critical
CVE-2026-72879	Dokploy: Command Injection via Registry Credentials in Swarm Upload	dokploy	9.4 (v4.0)	Critical
CVE-2026-73041	SiYuan before v3.7.4 Remote Code Execution via PDF Annotations	siyuan	9.4 (v4.0)	Critical
CVE-2026-73042	SiYuan before v3.7.4 Remote Code Execution via Menu Metadata	siyuan	9.4 (v4.0)	Critical
CVE-2026-73483	Flowise before 3.1.3 Sandbox Escape via Puppeteer	flowise	9.4 (v4.0)	Critical
CVE-2026-82078	PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)	papercut mf	9.4 (v4.0)	Critical
CVE-2026-82244	Budibase before 3.41.3 Remote Code Execution via Plugin eval()	server	9.4 (v4.0)	Critical
CVE-2026-93985	OpenPanel js-runtime JavaScript Template Sandbox Escape RCE	openpanel	9.4 (v4.0)	Critical
CVE-2009-20006	osCommerce 2.2 Arbitrary PHP Code Execution	osCommerce	9.3 (v4.0)	Critical
CVE-2009-20010	Dogfood CRM spell.php RCE	Dogfood CRM	9.3 (v4.0)	Critical
CVE-2013-10033	Kimai v0.9.2 'db_restore.php' SQL Injection	Kimai	9.3 (v4.0)	Critical
CVE-2013-10049	Raidsonic NAS Devices Unauthenticated Remote Command Execution	IB-NAS5220	9.3 (v4.0)	Critical
CVE-2014-125113	Dell KACE K1000 File Upload	KACE K1000 Systems Management Appliance	9.3 (v4.0)	Critical
CVE-2014-125116	HybridAuth install.php PHP Code Execution	HybridAuth	9.3 (v4.0)	Critical
CVE-2017-20198	DC/OS Marathon UI Docker Exploit	DC/OS Marathon	9.3 (v4.0)	Critical
CVE-2017-20251	WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API	Woody Code Snippets	9.3 (v4.0)	Critical
CVE-2018-25114	osCommerce 2.3.4.1 - Remote Code Execution	Online Merchant	9.3 (v4.0)	Critical
CVE-2018-25357	Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php	dolibarr erp/crm	9.3 (v4.0)	Critical
CVE-2019-25687	Pegasus CMS 1.0 Remote Code Execution via extra_fields.php	pegasus cms	9.3 (v4.0)	Critical
CVE-2023-54398	Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet	U8 Cloud	9.3 (v4.0)	Critical
CVE-2024-0012	Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution	pan-os	9.3 (v4.0)	Critical
CVE-2024-4879	ServiceNow UI Macros - Template Injection	servicenow	9.3 (v4.0)	Critical
CVE-2024-58348	WordPress Background Image Cropper 1.2 Remote Code Execution	Background Image Cropper	9.3 (v4.0)	Critical
CVE-2025-10364	Unauthenticated Arbitrary Command Injection in Evertz SDVN	3080ipx-10G	9.3 (v4.0)	Critical
CVE-2025-25034	SugarCRM REST Unserialize PHP Code Execution	SugarCRM	9.3 (v4.0)	Critical
CVE-2025-31114	Fooocus webui vulnerable to Remote Code Execution	Fooocus	9.3 (v4.0)	Critical
CVE-2025-34125	D-Link Cookie Command Execution	DSP-W110A1	9.3 (v4.0)	Critical
CVE-2025-59735	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59736	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59737	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59738	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59739	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59740	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59741	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-66571	UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection	UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4	9.3 (v4.0)	Critical
CVE-2025-71243	SPIP Saisies Plugin Unauthenticated RCE	saisies	9.3 (v4.0)	Critical
CVE-2025-71284	Synway SMG Gateway Management Software OS Command Injection via radius_address	smg gateway management software	9.3 (v4.0)	Critical
CVE-2025-71336	Flowise - Unsandboxed Remote Code Execution via Custom MCP	flowise	9.3 (v4.0)	Critical
CVE-2025-71429	GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py	GPT-SoVITS	9.3 (v4.0)	Critical
CVE-2026-101001	Netcore NBR200V2 Web Management network_tools eval os command injection	NBR200V2	9.3 (v4.0)	Critical
CVE-2026-101072	Netcore NR289-GE CGI ap_ip.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-101075	Netcore NR289-GE Location Time location_time.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-101076	Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-102240	Netcore NAP930 Network Tools CGI network_tools eval os command injection	NAP930	9.3 (v4.0)	Critical
CVE-2026-105110	Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter	Innbox	9.3 (v4.0)	Critical
CVE-2026-107780	Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter	skyeye	9.3 (v4.0)	Critical
CVE-2026-108598	Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates	floci	9.3 (v4.0)	Critical
CVE-2026-108804	TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection	TEW-751DR	9.3 (v4.0)	Critical
CVE-2026-113802	Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler	WL-WN530BE1-A	9.3 (v4.0)	Critical
CVE-2026-12257	Remote code execution in Mura Software’s CMS	CMS	9.3 (v4.0)	Critical
CVE-2026-19586	Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways	er7212pc firmware	9.3 (v4.0)	Critical
CVE-2026-27174	MajorDoMo Console Eval Unauthenticated RCE	majordomo	9.3 (v4.0)	Critical
CVE-2026-34106	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34108	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34109	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34110	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34111	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34112	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34115	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php	language-system	9.3 (v4.0)	Critical
CVE-2026-35047	Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint	bravecms	9.3 (v4.0)	Critical
CVE-2026-41315	mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command I	mdserver-web	9.3 (v4.0)	Critical
CVE-2026-41923	WDR201A WiFi Extender OS Command Injection via internet.cgi	WDR201A WiFi Extender	9.3 (v4.0)	Critical
CVE-2026-41925	WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)	WDR201A WiFi Extender	9.3 (v4.0)	Critical
CVE-2026-41939	Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly	Care Everywhere Gateway	9.3 (v4.0)	Critical
CVE-2026-44402	Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi	SNMP Web Pro	9.3 (v4.0)	Critical
CVE-2026-48768	TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName	typebot.io	9.3 (v3.1)	Critical
CVE-2026-53975	OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec	OpenChamber	9.3 (v4.0)	Critical
CVE-2026-58147	Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers	T-Mobile 5G Box IDU	9.3 (v4.0)	Critical
CVE-2026-58457	Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp	M300 Wi-Fi Repeater	9.3 (v4.0)	Critical
CVE-2026-60121	Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php	flamingo	9.3 (v4.0)	Critical
CVE-2026-61498	Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php	flamingo	9.3 (v4.0)	Critical
CVE-2026-61511	vBulletin 6.x - Remote Code Execution	vBulletin	9.3 (v4.0)	Critical
CVE-2026-63766	GPT-SoVITS 20250606v2pro OS Command Injection via webui.py	GPT-SoVITS	9.3 (v4.0)	Critical
CVE-2026-64625	AVideo before 29.0 OS Command Injection via execAsync	AVideo	9.3 (v4.0)	Critical
CVE-2026-64824	Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore	Home Assistant Core	9.3 (v4.0)	Critical
CVE-2026-65008	Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData	grav	9.3 (v4.0)	Critical
CVE-2026-67308	Wazuh GitHub Actions Shell Injection via Fork Pull Request	wazuh	9.3 (v4.0)	Critical
CVE-2026-70553	MaxSite CMS Unauthenticated RCE via Install Endpoint	MaxSite CMS	9.3 (v4.0)	Critical
CVE-2026-71921	DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi	VigorSwitch G2540xs	9.3 (v4.0)	Critical
CVE-2026-71944	D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71945	D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71946	D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71947	D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71948	D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71949	D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71950	D-Link DWR-M961 Command Injection via /boafrm/formSmsManage	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71951	D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71952	D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71953	D-Link DWR-M961 Command Injection via /boafrm/formNtp	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71954	D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71955	D-Link DWR-M961 Command Injection via /boafrm/formWsc	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71956	D-Link DWR-M961 Command Injection via app.cgi	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71984	MSI Radix AXE6600 v781521 Command Injection via urlfilter	Radix AXE6600	9.3 (v4.0)	Critical
CVE-2026-71992	MSI Radix AXE6600 v781521 Command Injection via macfilter	Radix AXE6600	9.3 (v4.0)	Critical
CVE-2026-72710	SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection	SPIP	9.3 (v4.0)	Critical
CVE-2026-76070	Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter	NC63	9.3 (v4.0)	Critical
CVE-2026-76071	Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter	NC63	9.3 (v4.0)	Critical
CVE-2026-85520	Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module	Google Merchant Center Feed	9.3 (v4.0)	Critical
CVE-2026-89026	Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate	Issabel Framework	9.3 (v4.0)	Critical
CVE-2026-89308	Arbitrary command execution in TrxTimeATTENDANCE	TrxTimeATTENDANCE	9.3 (v4.0)	Critical
CVE-2026-9209	mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx	mJobTime	9.3 (v4.0)	Critical
CVE-2026-96754	orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path	orval	9.3 (v4.0)	Critical
CVE-2023-7305	SmartBI RMIServlet Unrestricted File Upload RCE	SmartBI	9.2 (v4.0)	Critical
CVE-2024-5217	ServiceNow - Incomplete Input Validation	servicenow	9.2 (v4.0)	Critical
CVE-2026-10042	manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model	manga-image-translator	9.2 (v4.0)	Critical
CVE-2026-114053	vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision	vllm	9.2 (v4.0)	Critical
CVE-2026-27760	OpenCATS Installer PHP Code Injection	OpenCATS	9.2 (v4.0)	Critical
CVE-2026-41179	RClone RC - Command Injection	rclone	9.2 (v4.0)	Critical
CVE-2026-59800	9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint	9router	9.2 (v4.0)	Critical
CVE-2026-63304	AVideo through 29.0 OS Command Injection via listFFmpegProcesses	AVideo	9.2 (v4.0)	Critical
CVE-2026-63305	AVideo through 29.0 OS Command Injection via ffmpeg.json.php	AVideo	9.2 (v4.0)	Critical
CVE-2026-80138	ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter	clipbucket-v5	9.2 (v4.0)	Critical
CVE-2026-82531	Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache	smarty	9.2 (v4.0)	Critical
CVE-2026-87930	MaxSite CMS through 109.6 PHP Object Injection via ci_session	MaxSite CMS	9.2 (v4.0)	Critical
CVE-2014-7236	TWiki Debugenableplugins Remote Code Execution	twiki	9.1 (v3.1)	Critical
CVE-2020-24589	WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection	api manager	9.1 (v3.1)	Critical
CVE-2021-25282	SaltStack Salt API Unauthenticated RCE through wheel_async client	salt	9.1 (v3.1)	Critical
CVE-2024-51092	LibreNMS Authenticated RCE (CVE-2024-51092)	librenms	9.1 (v3.1)	Critical
CVE-2025-65473	easyimages2.0 Arbitrary Code Execution Vulnerability	easyimages2.0	9.1 (v3.1)	Critical
CVE-2025-66203	StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection	streamvault	9.1 (v3.1)	Critical
CVE-2026-10131	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-10135	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-12486	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12849	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12850	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12851	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-33568	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-35499	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-37637	Alexantr filemanager v.1.0 Arbitrary Code Execution Vulnerability	-	9.1 (v3.1)	Critical
CVE-2026-39353	InvoicePlane: Remote Code Execution via Writable Templates Directory	InvoicePlane	9.1 (v3.1)	Critical
CVE-2026-40484	ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function	CRM	9.1 (v3.1)	Critical
CVE-2026-40627	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-41042	Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution	gravitino	9.1 (v3.1)	Critical
CVE-2026-42555	Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users	valtimo	9.1 (v3.1)	Critical
CVE-2026-46621	Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection	yamcs	9.1 (v3.1)	Critical
CVE-2026-47168	EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params	espocrm	9.1 (v3.1)	Critical
CVE-2026-50006	Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in	anyquery	9.1 (v3.1)	Critical
CVE-2026-55511	Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`	yamcs	9.1 (v3.1)	Critical
CVE-2026-57499	Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)	core	9.1 (v3.1)	Critical
CVE-2026-58256	GRR vulnerable to Remote Code Execution Via PHP Code Injection	GRR	9.1 (v3.1)	Critical
CVE-2026-58400	GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter	core-geonetwork	9.1 (v3.1)	Critical
CVE-2026-58409	ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload	CRM	9.1 (v3.1)	Critical
CVE-2026-79766	Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email	Termix	9.1 (v3.1)	Critical
CVE-2026-79916	MaxKB AWS Bedrock model credential injection leads to remote code execution	MaxKB	9.1 (v3.1)	Critical
CVE-2026-9814	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2010-3585	Oracle VM Server Virtual Server Agent Command Injection	vm	9.0 (v2.0)	High
CVE-2013-5758	Yealink VoIP Phone SIP-T38G - Privilege Escalation	sip-t38g	9.0 (v2.0)	High
CVE-2015-7765	ManageEngine OpManager Remote Code Execution	manageengine opmanager	9.0 (v2.0)	High
CVE-2015-7766	ManageEngine OpManager Remote Code Execution	manageengine opmanager	9.0 (v2.0)	High
CVE-2025-9501	W3 Total Cache < 2.8.13 - Unauthenticated Command Injection	W3 Total Cache	9.0 (v3.1)	Critical
CVE-2026-102608	ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)	zoneminder	9.0 (v3.1)	Critical
CVE-2026-14602	Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter	Remote API	9.0 (v3.1)	Critical
CVE-2026-34612	Kestra: Remote Code Execution via SQL Injection	kestra	9.0 (v3.1)	Critical
CVE-2026-42238	Unauthenticated Remote Code Execution via Backup Restore in nginx-ui	nginx ui	9.0 (v4.0)	Critical
CVE-2026-45630	Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement	dokploy	9.0 (v3.1)	Critical
CVE-2026-45750	Termix Vulnerable to Arbitrary Command Execution in File Manager	termix	9.0 (v3.1)	Critical
CVE-2026-47252	Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)	anyquery	9.0 (v3.1)	Critical
CVE-2026-62674	Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE	omnigent	9.0 (v3.1)	Critical
CVE-2026-69251	Flowise RCE via TypeORM DataSource	flowise	9.0 (v4.0)	Critical
CVE-2026-73485	Flowise before 3.1.3 Remote Code Execution via Airtable Agent	flowise	9.0 (v4.0)	Critical
CVE-2026-73486	Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV	flowise	9.0 (v4.0)	Critical
CVE-2026-73487	Flowise before 3.1.3 Prompt Injection RCE via CSV Agent	flowise	9.0 (v4.0)	Critical
CVE-2026-91931	Flowise before 3.1.4 Remote Code Execution via Custom MCP npx	Flowise	9.0 (v4.0)	Critical
CVE-2026-33765	Pi-hole Web Interface has a Command Injection Vulnerability	web interface	8.9 (v4.0)	High
CVE-2026-41304	WWBN AVideo vulnerable to RCE caused by clonesite plugin	avideo	8.9 (v4.0)	High
CVE-2026-43945	FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection	FUXA	8.9 (v4.0)	High
CVE-2026-5850	Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5851	Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5852	Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5853	Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5854	Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5975	Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5976	Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5977	Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5978	Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5993	Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5994	Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5996	Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5997	Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6025	Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6026	Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6028	Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6029	Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6112	Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6113	Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6114	Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6115	Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6116	Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6131	Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6132	Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6138	Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6139	Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6140	Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6154	Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6155	Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6156	Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6195	Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-64638	WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)	WordPress	8.9 (v4.0)	High
CVE-2026-7121	Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7122	Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7123	Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7124	Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7125	Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7136	Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7137	Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7138	Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7139	Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7140	Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7152	Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7153	Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7154	Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7155	Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7156	Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7202	Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7203	Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7204	Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7240	Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7241	Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7242	Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7243	Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7244	Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-73570	zimbra collaboration suite Arbitrary Code Execution Vulnerability	zimbra collaboration suite	8.9 (v3.1)	High
CVE-2026-7538	Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-77956	EEx template evaluation of prompt content in AshAi enables remote code execution	ash ai	8.9 (v4.0)	High
CVE-2026-7823	Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9384	Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9385	Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9386	Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9387	Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9388	Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9404	Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9405	Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9406	Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9407	Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9408	Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9432	Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9433	Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9434	Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9435	Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9436	Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9454	Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9455	Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9456	Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9457	Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9458	Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9475	Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9476	Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9477	Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9478	Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2010-1871	JBoss Seam 2 File Upload and Execute	jboss enterprise application platform	8.8 (v3.1)	High
CVE-2013-4863	MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities	veralite firmware	8.8 (v3.1)	High
CVE-2015-4117	Vesta Control Panel 0.9.8 - OS Command Injection	control panel	8.8 (v3.0)	High
CVE-2016-4808	Web2py 2.14.5 - Multiple Vulnerabilities	web2py	8.8 (v3.0)	High
CVE-2016-8526	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	8.8 (v3.0)	High
CVE-2017-18370	TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection	5200w-t firmware	8.8 (v3.0)	High
CVE-2017-6884	Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection	emg2926 firmware	8.8 (v3.1)	High
CVE-2017-9822	DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution	dotnetnuke	8.8 (v3.1)	High
CVE-2018-10054	H2 Web Interface Create Alias RCE	datomic	8.8 (v3.1)	High
CVE-2018-11442	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-11445	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-15142	OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions	openemr	8.8 (v3.0)	High
CVE-2018-6224	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.8 (v3.0)	High
CVE-2018-7700	DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution	dedecms	8.8 (v3.0)	High
CVE-2018-8735	Nagios XI Chained Remote Code Execution	nagios xi	8.8 (v3.0)	High
CVE-2018-8736	Nagios XI Chained Remote Code Execution	nagios xi	8.8 (v3.0)	High
CVE-2020-15874	Command Injection	-	8.8 (v3.1)	High
CVE-2020-27386	FlexDotnetCMS Arbitrary ASP File Upload	flexdotnetcms	8.8 (v3.1)	High
CVE-2020-27387	HorizontCMS Arbitrary PHP File Upload	horizontcms	8.8 (v3.1)	High
CVE-2020-28328	SuiteCRM Log File Remote Code Execution	suitecrm	8.8 (v3.1)	High
CVE-2020-5776	MAGMI - Cross-Site Request Forgery	magmi	8.8 (v3.1)	High
CVE-2020-7246	qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE)	qdpm	8.8 (v3.1)	High
CVE-2020-8163	Ruby on Rails <5.0.1 - Remote Code Execution	rails	8.8 (v3.1)	High
CVE-2021-25646	Apache Druid Embedded Javascript Remote Code Execution (CVE-2021-25646)	druid	8.8 (v3.1)	High
CVE-2021-32819	Nodejs Squirrelly - Remote Code Execution	squirrelly	8.8 (v3.1)	High
CVE-2021-3577	Motorola Baby Monitors - Remote Command Execution	halo+ camera firmware	8.8 (v3.1)	High
CVE-2021-41282	pfSense Diag Routes Web Shell Upload	pfsense	8.8 (v3.1)	High
CVE-2021-42840	SuiteCRM Log File Remote Code Execution	suitecrm	8.8 (v3.1)	High
CVE-2022-34876	VICIdial Multiple Authenticated SQLi	vicidial	8.8 (v3.1)	High
CVE-2022-34877	VICIdial Multiple Authenticated SQLi	vicidial	8.8 (v3.1)	High
CVE-2022-34878	VICIdial Multiple Authenticated SQLi	vicidial	8.8 (v3.1)	High
CVE-2023-2288	Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization	otter	8.8 (v3.1)	High
CVE-2023-30253	Dolibarr ERP/CRM Authenticated Code Injection	dolibarr erp/crm	8.8 (v3.1)	High
CVE-2023-43661	Cachet vulnerable to Authenticated Remote Code Execution	cachet	8.8 (v3.1)	High
CVE-2023-46214	Splunk Authenticated XSLT Upload RCE	cloud	8.8 (v3.1)	High
CVE-2023-49084	Cacti RCE via SQLi in pollers.php	cacti	8.8 (v3.1)	High
CVE-2023-49085	Cacti RCE via SQLi in pollers.php	cacti	8.8 (v3.1)	High
CVE-2023-7137	Client Details System 1.0 - SQL Injection	client details system	8.8 (v3.1)	High
CVE-2024-1800	Telerik Report Server Auth Bypass and Deserialization RCE	telerik report server	8.8 (v3.1)	High
CVE-2024-39024	In Packetfence 13.2.0, the WebGui interface setting Arbitrary Code Execution Vulnerability	-	8.8 (v3.1)	High
CVE-2025-10706	Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	ClassifiedPro - reCommerce WordPress Theme	8.8 (v3.1)	High
CVE-2025-51457	D-Link DAP-2610 up to 2.06B08r099 Command Injection Vulnerability	D-Link DAP-2610 up to 2.06B08r099	8.8 (v3.1)	High
CVE-2025-59710	biztalk360 Arbitrary Code Execution Vulnerability	biztalk360	8.8 (v3.1)	High
CVE-2025-65471	easyimages2.0 Arbitrary Code Execution Vulnerability	easyimages2.0	8.8 (v3.1)	High
CVE-2025-66209	Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup	coolify	8.8 (v3.1)	High
CVE-2025-66438	erpnext Information Disclosure Vulnerability	erpnext	8.8 (v3.1)	High
CVE-2026-104851	fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution	filesystem spec	8.8 (v3.1)	High
CVE-2026-105106	Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task	Koha	8.8 (v3.1)	High
CVE-2026-105797	SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)	simplechat	8.8 (v3.1)	High
CVE-2026-108963	databasement Arbitrary Code Execution Vulnerability	databasement	8.8 (v3.1)	High
CVE-2026-110908	pfSense-pkg-frr Command Injection Vulnerability	pfSense-pkg-frr	8.8 (v3.1)	High
CVE-2026-113779	pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission	pfSense-pkg-RESTAPI	8.8 (v3.1)	High
CVE-2026-14357	DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Ex	DevKit Pro	8.8 (v3.1)	High
CVE-2026-14498	Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter	Query Wrangler	8.8 (v3.1)	High
CVE-2026-17196	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute	Super Forms – Drag & Drop Form Builder	8.8 (v3.1)	High
CVE-2026-24893	openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion	openitcockpit	8.8 (v3.1)	High
CVE-2026-26899	OS Command Injection	-	8.8 (v3.1)	High
CVE-2026-30971	ZoneMinder: Authenticated RCE via command injection in monitor Device Path	zoneminder	8.8 (v3.1)	High
CVE-2026-33704	Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint	chamilo lms	8.8 (v3.1)	High
CVE-2026-34057	Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name	coolify	8.8 (v3.1)	High
CVE-2026-34153	Coolify LocalFileVolume fs_path command injection enables RCE	coolify	8.8 (v3.1)	High
CVE-2026-34158	Coolify: Command injection via single-quote breakout in Docker Compose custom commands	coolify	8.8 (v3.1)	High
CVE-2026-34197	Apache ActiveMQ Jolokia Remote Code Execution (CVE-2026-34197)	activemq	8.8 (v3.1)	High
CVE-2026-34594	Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management	coolify	8.8 (v3.1)	High
CVE-2026-34599	Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component	coolify	8.8 (v3.1)	High
CVE-2026-35031	Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain	jellyfin	8.8 (v3.1)	High
CVE-2026-35196	Chamilo LMS has OS Command Injection via export_all_certificates action	chamilo lms	8.8 (v3.1)	High
CVE-2026-35519	Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection	ftldns	8.8 (v3.1)	High
CVE-2026-35520	Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection	ftldns	8.8 (v3.1)	High
CVE-2026-41208	Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution	paperclipai	8.8 (v3.1)	High
CVE-2026-4327	The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_lo	The Welcomizer	8.8 (v3.1)	High
CVE-2026-45505	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass	activemq	8.8 (v3.1)	High
CVE-2026-45578	WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL	avideo	8.8 (v3.1)	High
CVE-2026-45662	Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)	dokploy	8.8 (v3.1)	High
CVE-2026-48017	DbGate: Remote Code Execution via functionName injection in loadReader endpoint	dbgate	8.8 (v3.1)	High
CVE-2026-52356	D-Link DAP1160L A1_FW101WWb04 Command Injection Vulnerability	D-Link DAP1160L A1 FW101WWb04	8.8 (v3.1)	High
CVE-2026-52483	OS Command Injection	-	8.8 (v3.1)	High
CVE-2026-52484	MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 Arbitrary Code Execution Vulnerability	-	8.8 (v3.1)	High
CVE-2026-54149	MaxKB MCP tool import validation bypass allows post-authentication remote code execution	MaxKB	8.8 (v3.1)	High
CVE-2026-55585	QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`	qwed-verification	8.8 (v3.1)	High
CVE-2026-57296	Jenkins External Workspace Manager Plugin Arbitrary Code Execution Vulnerability	Jenkins External Workspace Manager Plugin	8.8 (v3.1)	High
CVE-2026-58195	Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into ex	agentic-flow	8.8 (v3.1)	High
CVE-2026-59734	Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution	coolify	8.8 (v3.1)	High
CVE-2026-62675	Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools	omnigent	8.8 (v3.1)	High
CVE-2026-6543	Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint	langflow desktop	8.8 (v3.1)	High
CVE-2026-65660	Microsoft SharePoint Server Remote Code Execution Vulnerability	sharepoint server	8.8 (v3.1)	High
CVE-2026-72875	Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile	dokploy	8.8 (v3.1)	High
CVE-2026-73222	Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio)	claude-code-templates	8.8 (v3.1)	High
CVE-2026-76801	FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation	FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment	8.8 (v3.1)	High
CVE-2026-77601	OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting	cosmos	8.8 (v3.1)	High
CVE-2026-78834	Code Injection	-	8.8 (v3.1)	High
CVE-2026-79423	seacms v13.6 Arbitrary Code Execution Vulnerability	seacms v13.6	8.8 (v3.1)	High
CVE-2026-8071	Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass	Anti-Spam by CleanTalk. Spam protection	8.8 (v3.1)	High
CVE-2026-81578	PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)	papercut mf	8.8 (v4.0)	High
CVE-2026-82217	Eclipse Theia Path Traversal Vulnerability	Eclipse Theia	8.8 (v3.1)	High
CVE-2026-82804	Apache DolphinScheduler: Command Injection in the Alert Script Plugin	Apache DolphinScheduler	8.8 (v3.1)	High
CVE-2026-8365	Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy	Blocksy	8.8 (v3.1)	High
CVE-2026-84317	Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the o	nginx-ui	8.8 (v3.1)	High
CVE-2026-84318	Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE	nginx-ui	8.8 (v3.1)	High
CVE-2026-85731	oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)	oras-go	8.8 (v3.1)	High
CVE-2026-88622	NUUO Network Video Recorder 2.0.0 Command Injection Vulnerability	-	8.8 (v3.1)	High
CVE-2026-96795	Horilla: Authenticated RCE in Horilla List-View Export	horilla-hr	8.8 (v3.1)	High
CVE-2005-10004	Cacti graph_view.php Remote Command Execution	cacti	8.7 (v4.0)	High
CVE-2015-10145	Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh	gargoyle	8.7 (v4.0)	High
CVE-2019-25671	VA MAX 8.3.4 Remote Code Execution via changeip.php	VA MAX	8.7 (v4.0)	High
CVE-2021-47938	ImpressCMS 1.4.2 Remote Code Execution via Autotasks	ImpressCMS	8.7 (v4.0)	High
CVE-2021-47939	Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation	Evolution CMS	8.7 (v4.0)	High
CVE-2021-47943	TextPattern CMS 4.8.7 Remote Code Execution via File Upload	TextPattern CMS	8.7 (v4.0)	High
CVE-2022-50944	Aero CMS 0.0.1 PHP Code Injection via posts.php	Aero CMS	8.7 (v4.0)	High
CVE-2023-54350	WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated	Augmented Reality	8.7 (v4.0)	High
CVE-2024-58294	FreePBX 16 Authenticated Remote Code Execution via API Module	freepbx	8.7 (v4.0)	High
CVE-2025-24367	Cacti Graph Template authenticated RCE versions prior to 1.2.29	cacti	8.7 (v4.0)	High
CVE-2025-30007	HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management	control panel	8.7 (v4.0)	High
CVE-2025-34115	OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php	OP5 Monitor	8.7 (v4.0)	High
CVE-2025-34311	IPFire < v2.29 Command Injection via Proxy Report Creation	ipfire	8.7 (v4.0)	High
CVE-2025-34312	IPFire < v2.29 Command Injection via URL Filter Blacklist	ipfire	8.7 (v4.0)	High
CVE-2025-34334	AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE	fax server	8.7 (v4.0)	High
CVE-2025-66474	XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection	xwiki-rendering	8.7 (v4.0)	High
CVE-2025-71260	BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE	footprints	8.7 (v4.0)	High
CVE-2026-100852	AzuraCast through 0.23.x Command Injection via Streamer Username	AzuraCast	8.7 (v4.0)	High
CVE-2026-100856	AzuraCast before 0.23.6 Code Injection via Remote Relay Password	AzuraCast	8.7 (v4.0)	High
CVE-2026-100864	heym before 0.0.91 Remote Code Execution via Expression Engine	heym	8.7 (v4.0)	High
CVE-2026-105123	W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API	wcms	8.7 (v4.0)	High
CVE-2026-105985	Authenticated RCE via render-components Entry Type overrides	cms	8.7 (v4.0)	High
CVE-2026-107639	ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename	ILIAS	8.7 (v4.0)	High
CVE-2026-109308	Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection	cms	8.7 (v4.0)	High
CVE-2026-112351	Sunhillo SureLine OS Command Injection via networkDiag.cgi	SureLine	8.7 (v4.0)	High
CVE-2026-116009	Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action	camaleon-cms	8.7 (v4.0)	High
CVE-2026-116811	OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template	openpanel	8.7 (v4.0)	High
CVE-2026-28797	RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Compone	ragflow	8.7 (v4.0)	High
CVE-2026-34228	Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write	emlog	8.7 (v4.0)	High
CVE-2026-34367	InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field	invoiceshelf	8.7 (v3.1)	High
CVE-2026-34735	Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`	wiki	8.7 (v4.0)	High
CVE-2026-34791	Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34792	Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34793	Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34794	Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34795	Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34796	Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34797	Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34965	Cockpit CMS Authenticated Remote Code Execution via Collections	Cockpit CMS	8.7 (v4.0)	High
CVE-2026-39352	Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal	frappe	8.7 (v4.0)	High
CVE-2026-40488	OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution	magento	8.7 (v4.0)	High
CVE-2026-40521	FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload	FrontAccounting	8.7 (v4.0)	High
CVE-2026-41934	Vvveb < 1.0.8.2 Authenticated RCE via Code Editor	Vvveb	8.7 (v4.0)	High
CVE-2026-46746	sinec ins OS Command Injection Vulnerability	sinec ins	8.7 (v4.0)	High
CVE-2026-47722	nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml	nebula-mesh	8.7 (v4.0)	High
CVE-2026-49143	BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler	browserstack-runner	8.7 (v4.0)	High
CVE-2026-55094	Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)	taskcluster	8.7 (v4.0)	High
CVE-2026-58000	luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey	luci-proto-openvpn	8.7 (v4.0)	High
CVE-2026-58452	JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint	C492A-W6 Wi-Fi IP Camera	8.7 (v4.0)	High
CVE-2026-63722	ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php	ICEcoder	8.7 (v4.0)	High
CVE-2026-64837	ICEcoder through 8.1 OS Command Injection via lib/properties.php	ICEcoder	8.7 (v4.0)	High
CVE-2026-64850	Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()	grav	8.7 (v4.0)	High
CVE-2026-67206	Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload	wolfcms	8.7 (v4.0)	High
CVE-2026-69096	OpenWrt luci-app-dockerman Read ACL Remote Code Execution	luci	8.7 (v4.0)	High
CVE-2026-69100	LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution	lamp-cloud	8.7 (v4.0)	High
CVE-2026-71966	CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer	cyberpanel	8.7 (v4.0)	High
CVE-2026-71981	Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter	cypht	8.7 (v4.0)	High
CVE-2026-72819	Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload	grav	8.7 (v4.0)	High
CVE-2026-72827	Grav CMS before 2.0.13 Remote Code Execution via Twig	grav	8.7 (v4.0)	High
CVE-2026-72830	Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass	grav	8.7 (v4.0)	High
CVE-2026-72870	Dokploy: Command Injection via Docker Credentials in buildRemoteDocker	dokploy	8.7 (v4.0)	High
CVE-2026-72874	Dokploy: Command Injection via Unescaped Git URL in Clone Commands	dokploy	8.7 (v4.0)	High
CVE-2026-73680	Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename	Cockpit CMS	8.7 (v4.0)	High
CVE-2026-7551	HKUDS OpenHarness Remote Command Execution via /bridge Slash Command	openharness	8.7 (v4.0)	High
CVE-2026-75574	Grav before 4.2.2 Remote Code Execution via Email Twig	grav	8.7 (v4.0)	High
CVE-2026-76060	OS Command Injection in PayRange API	Zoneminder	8.7 (v4.0)	High
CVE-2026-76836	AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass	AzuraCast	8.7 (v4.0)	High
CVE-2026-78416	Authenticated RCE via `condition.config` JSON cleanse bypass	cms	8.7 (v4.0)	High
CVE-2026-79756	Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform	nuclio	8.7 (v4.0)	High
CVE-2026-79987	Low-privilege RCE through element-search eager loading	cms	8.7 (v4.0)	High
CVE-2026-82278	BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once	bisheng	8.7 (v4.0)	High
CVE-2026-85604	Grav before 2.0.19 Remote Code Execution via sort filter	grav	8.7 (v4.0)	High
CVE-2026-85610	OpenPanel before 2.3.0 Remote Code Execution via chart formulas	openpanel	8.7 (v4.0)	High
CVE-2026-86732	Craft CMS before 5.10.12 Remote Code Execution via element-index	cms	8.7 (v4.0)	High
CVE-2026-90770	Spug through 3.4.0 Remote Code Execution via ping_check	spug	8.7 (v4.0)	High
CVE-2026-92580	AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF	AVideo	8.7 (v4.0)	High
CVE-2013-10061	Netgear DGN1000B setup.cgi Remote Command Execution	dgn1000b firmware	8.6 (v4.0)	High
CVE-2013-20007	Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi	WAG200G	8.6 (v4.0)	High
CVE-2023-26360	Adobe ColdFusion Local File Inclusion Leads to RCE (CVE-2023-26360)	coldfusion	8.6 (v3.1)	High
CVE-2024-20353	adaptive security appliance software Denial of Service Vulnerability	adaptive security appliance software	8.6 (v3.1)	High
CVE-2025-12061	Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution	TAX SERVICE Electronic HDM	8.6 (v3.1)	High
CVE-2025-68455	Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior	craft cms	8.6 (v4.0)	High
CVE-2025-68700	RAGFlow Remote Code Execution Vulnerability	ragflow	8.6 (v4.0)	High
CVE-2026-100896	TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection	N150RT	8.6 (v4.0)	High
CVE-2026-102911	zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection	pi-llm-wiki	8.6 (v4.0)	High
CVE-2026-108540	OpenSpug File Transfer transfer os command injection	Spug	8.6 (v4.0)	High
CVE-2026-108894	Linksys E1700 Static Route addStaticRoute os command injection	E1700	8.6 (v4.0)	High
CVE-2026-109108	Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection	WL-WN530BE1-A	8.6 (v4.0)	High
CVE-2026-109397	Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space	Thelia	8.6 (v4.0)	High
CVE-2026-111214	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php	pfsense	8.6 (v4.0)	High
CVE-2026-111217	Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID	pfsense	8.6 (v4.0)	High
CVE-2026-111218	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters	pfsense	8.6 (v4.0)	High
CVE-2026-113390	DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection	Vigor2960	8.6 (v4.0)	High
CVE-2026-113506	aaPanel File Manager common.py ExecShell os command injection	aaPanel	8.6 (v4.0)	High
CVE-2026-22100	Comnand injection in OCPP ReserveLogin message	DC-80	8.6 (v4.0)	High
CVE-2026-23698	Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload	Vtiger CRM	8.6 (v4.0)	High
CVE-2026-29001	TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization	TastyIgniter	8.6 (v4.0)	High
CVE-2026-40187	Authenticated RCE via Malicious eTemplate Upload in EGroupware	egroupware	8.6 (v4.0)	High
CVE-2026-41587	CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution	ci4ms	8.6 (v4.0)	High
CVE-2026-41936	Vvveb < 1.0.8.2 XML External Entity Injection via Import	Vvveb	8.6 (v4.0)	High
CVE-2026-42785	OpenKM 6.3.12 Remote Code Execution via Administrative Scripting	OpenKM Community Edition	8.6 (v4.0)	High
CVE-2026-44011	Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior	cms	8.6 (v4.0)	High
CVE-2026-53804	OTRS Community Edition OS Command Injection via PGP Configuration	OTRS Community Edition	8.6 (v4.0)	High
CVE-2026-54710	FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)	freepbx	8.6 (v4.0)	High
CVE-2026-55182	LibreNMS: Remote Code Execution by Signal Alert Transportation Module	librenms	8.6 (v4.0)	High
CVE-2026-56382	Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController	cms	8.6 (v4.0)	High
CVE-2026-56703	Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO	adminer	8.6 (v4.0)	High
CVE-2026-61517	Netis NX10 OS Command Injection via Ping Diagnostic Handler	NX10	8.6 (v4.0)	High
CVE-2026-61523	WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor	WebsiteBaker CMS	8.6 (v4.0)	High
CVE-2026-63725	sysPass FileBackupService Authenticated OS Command Injection via Backup Path	sysPass	8.6 (v4.0)	High
CVE-2026-65693	Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates	microweber	8.6 (v4.0)	High
CVE-2026-65711	sysPass 3.2.11 Authenticated OS Command Injection via Backup Path	sysPass	8.6 (v4.0)	High
CVE-2026-67599	ClearOS 7.9 OS Command Injection via Log Viewer filter parameter	ClearOS	8.6 (v4.0)	High
CVE-2026-67608	Telenia TVox 26.5.3 OS Command Injection via action_audio.php	TVox	8.6 (v4.0)	High
CVE-2026-69088	Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint	grav	8.6 (v4.0)	High
CVE-2026-71906	DrayTek VigorAP Multiple Models OS Command Injection via setLan	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71907	DrayTek VigorAP Multiple Models OS Command Injection via setcamset	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71908	DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71913	DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71915	DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71918	DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71919	DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71923	DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71924	DrayTek VigorSwitch Multiple Models OS Command Injection via getVid	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71925	DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71926	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71927	DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71928	DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71929	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71930	DrayTek VigorSwitch Multiple Models OS Command Injection via setTime	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71931	DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71943	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-73664	FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module	backup	8.6 (v4.0)	High
CVE-2026-75121	PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-75122	PLANET GS-4210-16P2S Command Injection via httpuploadcert.cgi	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-75123	PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_post	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-80214	LibreNMS Virtualisation Discovery Module RCE	librenms	8.6 (v4.0)	High
CVE-2026-82692	D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection	DNS-340L	8.6 (v4.0)	High
CVE-2026-84194	LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname	librenms	8.6 (v4.0)	High
CVE-2026-85223	D-Link DNS-340L CGI dropbox.cgi os command injection	DNS-340L	8.6 (v4.0)	High
CVE-2026-86299	Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection	RE7000	8.6 (v4.0)	High
CVE-2026-86437	Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload	laradashboard	8.6 (v4.0)	High
CVE-2026-86438	Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action	laradashboard	8.6 (v4.0)	High
CVE-2026-86733	Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore	snipe-it	8.6 (v4.0)	High
CVE-2026-90699	D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection	DWR-M920	8.6 (v4.0)	High
CVE-2025-34332	AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE	fax server	8.5 (v4.0)	High
CVE-2025-34333	AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE	fax server	8.5 (v4.0)	High
CVE-2026-101009	aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection	BaoTa	8.5 (v4.0)	High
CVE-2026-22244	OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE	openmetadata	8.5 (v4.0)	High
CVE-2026-56739	Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint	logto	8.5 (v4.0)	High
CVE-2026-82690	D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection	DNS-327L	8.5 (v4.0)	High
CVE-2026-82691	D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection	DNS-320L	8.5 (v4.0)	High
CVE-2026-85222	D-Link DNS-340L Add-On Center addon_center.cgi os command injection	DNS-340L	8.5 (v4.0)	High
CVE-2026-85224	D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection	DNS-320 ShareCenter	8.5 (v4.0)	High
CVE-2026-90702	D-Link DWR-M921 formDiskFormat system os command injection	DWR-M921	8.5 (v4.0)	High
CVE-2026-90703	D-Link DWR-M921 formDiskCreateShare system os command injection	DWR-M921	8.5 (v4.0)	High
CVE-2026-92397	Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection	RG-EW3000GX	8.5 (v4.0)	High
CVE-2026-92398	Ruijie RG-EW3000GX user_list_note admin os command injection	RG-EW3000GX	8.5 (v4.0)	High
CVE-2026-104078	Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass	Obsidian Desktop	8.4 (v4.0)	High
CVE-2026-55786	Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`	flyto-core	8.4 (v3.1)	High
CVE-2024-58274	CSMP iSecure Center OS Command Injection Vulnerability	CSMP iSecure Center	8.3 (v3.1)	High
CVE-2025-59711	biztalk360 Path Traversal Vulnerability	biztalk360	8.3 (v3.1)	High
CVE-2026-49471	Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE	serena	8.3 (v3.1)	High
CVE-2026-69101	Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint	tis	8.3 (v4.0)	High
CVE-2026-75842	ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV	arcadedb	8.3 (v4.0)	High
CVE-2025-69755	Neterbit NW-431F Router vNW-431F-20241014-IR03 Arbitrary Code Execution Vulnerability	-	8.2 (v3.1)	High
CVE-2013-4862	MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities	veralite firmware	8.1 (v3.1)	High
CVE-2014-3120	ElasticSearch Remote Code Execution (CVE-2014-3120)	elasticsearch	8.1 (v3.1)	High
CVE-2016-3081	Apache Struts Dynamic Method Invocation Remote Code Execution	agile controller-campus firmware	8.1 (v3.1)	High
CVE-2018-6221	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.1 (v3.0)	High
CVE-2025-48828	vBulletin replaceAdTemplate Remote Code Execution	vbulletin	8.1 (v3.1)	High
CVE-2025-68493	Apache Struts XWork - XML External Entity Injection	struts	8.1 (v3.1)	High
CVE-2026-15983	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter	Super Forms – Drag & Drop Form Builder	8.1 (v3.1)	High
CVE-2026-19942	Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta	Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback	8.1 (v3.1)	High
CVE-2026-42588	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector	activemq	8.1 (v3.1)	High
CVE-2026-45344	LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances	LinkAce	8.1 (v3.1)	High
CVE-2026-47398	PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-20	PraisonAI	8.1 (v3.1)	High
CVE-2026-48695	fastnetmon Command Injection Vulnerability	fastnetmon	8.1 (v3.1)	High
CVE-2026-55173	AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving	AVideo	8.1 (v3.1)	High
CVE-2026-71320	Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props	nuxt	8.1 (v3.1)	High
CVE-2026-97875	DNS rebinding vulnerability in rojo serve HTTP API	rojo	8.1 (v3.1)	High
CVE-2014-100005	D-Link DIR-645 / DIR-815 diagnostic.php Command Execution	dir-600 firmware	8.0 (v3.1)	High
CVE-2026-52831	Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE	nuclio	8.0 (v3.1)	High
CVE-2026-79755	Nuclio: Unauthenticated OS command injection via function namespace in docker ps –filter label (local Docker platform)	nuclio	8.0 (v3.1)	High
CVE-2013-2097	Zpanel Remote Unauthenticated RCE	zpanel	7.8 (v3.1)	High
CVE-2015-4669	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	7.8 (v3.0)	High
CVE-2018-15710	Nagios XI Magpie_debug.php Root Remote Code Execution	nagios xi	7.8 (v3.0)	High
CVE-2018-6222	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	7.8 (v3.0)	High
CVE-2020-1147	SharePoint DataSet / DataTable Deserialization	.net core	7.8 (v3.1)	High
CVE-2021-21315	Node.JS System Information Library <5.3.1 - Remote Command Injection	systeminformation	7.8 (v3.1)	High
CVE-2026-67179	Genkit improper host header validation	genkit	7.8 (v3.1)	High
CVE-2016-3473	Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection	business intelligence publisher	7.7 (v3.0)	High
CVE-2025-27621	UpTrain has a Constant Default API Key	uptrain	7.7 (v4.0)	High
CVE-2026-105764	Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE	immich	7.7 (v4.0)	High
CVE-2026-108161	FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download	fusionpbx	7.7 (v4.0)	High
CVE-2026-32271	Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget	commerce	7.7 (v4.0)	High
CVE-2026-40519	Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()	nginx-proxy-manager	7.7 (v4.0)	High
CVE-2026-42099	Race Condition in Sparx Pro Cloud Server	pro cloud server	7.7 (v4.0)	High
CVE-2026-57999	luci-app-tailscale-community - Command Injection via tailscale.do_login RPC	luci-app-tailscale-community	7.7 (v4.0)	High
CVE-2026-66738	SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite	SPIP	7.7 (v4.0)	High
CVE-2026-93872	Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter	Cotonti	7.7 (v4.0)	High
CVE-2025-47783	Label Studio < 1.18.0 - Reflected XSS	label studio	7.6 (v4.0)	High
CVE-2026-54640	OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory	openremote	7.6 (v3.1)	High
CVE-2005-1921	PHP XML-RPC Arbitrary Code Execution	xml rpc	7.5 (v2.0)	High
CVE-2005-2799	Linksys WRT54GL apply.cgi Command Execution	wrt54g	7.5 (v2.0)	High
CVE-2005-2847	Barracuda IMG.PL Remote Command Execution	barracuda spam firewall	7.5 (v2.0)	High
CVE-2006-0887	PHPLib < 7.4 - SQL Injection	phplib	7.5 (v2.0)	High
CVE-2006-2826	PHPLib < 7.4 - SQL Injection	phplib	7.5 (v2.0)	High
CVE-2009-3548	Apache Tomcat Manager Authenticated Upload Code Execution	tomcat	7.5 (v2.0)	High
CVE-2010-0557	Apache Tomcat Manager Authenticated Upload Code Execution	cognos express	7.5 (v2.0)	High
CVE-2010-3600	Oracle Database Client System Analyzer Arbitrary File Upload	database server	7.5 (v2.0)	High
CVE-2011-4448	WikkaWiki 1.3.2 - Multiple Vulnerabilities	wikkawiki	7.5 (v2.0)	High
CVE-2011-4899	WordPress Core 3.3.1 - Multiple Vulnerabilities	WordPress	7.5 (v2.0)	High
CVE-2013-0156	Ruby on Rails XML Processor YAML Deserialization Scanner	rails	7.5 (v2.0)	High
CVE-2013-1081	Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability	zenworks mobile management	7.5 (v2.0)	High
CVE-2013-1349	OpenSIS 'modname' PHP Code Execution	opensis	7.5 (v2.0)	High
CVE-2013-1412	DataLife Engine preview.php PHP Code Injection	datalife engine	7.5 (v2.0)	High
CVE-2013-5014	Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution	endpoint protection manager	7.5 (v2.0)	High
CVE-2013-5694	Opsview pre 4.4.1 - Blind SQL Injection	opsview	7.5 (v2.0)	High
CVE-2013-6041	Webuzo 2.1.3 - Multiple Vulnerabilities	webuzo	7.5 (v2.0)	High
CVE-2014-8675	SO Planning 1.32 - Multiple Vulnerabilities	soplanning	7.5 (v3.0)	High
CVE-2014-9215	PBBoard CMS 3.0.1 - SQL Injection	pbboard	7.5 (v2.0)	High
CVE-2014-9566	Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation	orion ip address manager	7.5 (v2.0)	High
CVE-2015-1518	RedaxScript CMS 2.2.0 - SQL Injection	redaxscript	7.5 (v2.0)	High
CVE-2015-1592	SixApart MovableType Storable Perl Code Execution	debian linux	7.5 (v2.0)	High
CVE-2015-2824	WordPress Plugin Simple Ads Manager - Multiple SQL Injections	simple ads manager	7.5 (v2.0)	High
CVE-2015-7387	ManageEngine EventLog Analyzer Remote Code Execution	manageengine eventlog analyzer	7.5 (v2.0)	High
CVE-2016-4806	Web2py 2.14.5 - Multiple Vulnerabilities	web2py	7.5 (v3.0)	High
CVE-2018-15535	Responsive FileManager < 9.13.4 - Directory Traversal	responsive filemanager	7.5 (v3.0)	High
CVE-2018-15811	DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization	dotnetnuke	7.5 (v3.1)	High
CVE-2018-18325	DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization	dotnetnuke	7.5 (v3.1)	High
CVE-2018-8033	Apache OFBiz - XML External Entity Injection	ofbiz	7.5 (v3.0)	High
CVE-2019-17558	Apache Solr Remote Code Execution via Velocity Template	solr	7.5 (v3.1)	High
CVE-2019-9621	Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF	zimbra collaboration suite	7.5 (v3.1)	High
CVE-2022-24265	Cuppa CMS v1.0 - SQL injection	cuppacms	7.5 (v3.1)	High
CVE-2022-38840	Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)	man-eam-0003	7.5 (v3.1)	High
CVE-2023-0905	Employee Task Management System v1.0 - Broken Authentication	employee task management system	7.5 (v3.1)	High
CVE-2024-6893	Journyx - XML External Entities Injection (XXE)	journyx-jtime	7.5 (v3.1)	High
CVE-2025-63950	twittodon Unsafe Deserialization Vulnerability	twittodon	7.5 (v3.1)	High
CVE-2025-63951	phoniebox Unsafe Deserialization Vulnerability	phoniebox	7.5 (v3.1)	High
CVE-2026-107812	Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or M	nginx ui	7.5 (v3.1)	High
CVE-2026-111221	Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection	pfsense	7.5 (v4.0)	High
CVE-2026-12720	Kirki < 6.0.13 - Unauthenticated PHP Object Injection	Kirki	7.5 (v3.1)	High
CVE-2026-19913	Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability	Kaltura HTML5 Video Player, html5lib library	7.5 (v3.1)	High
CVE-2026-34239	Chamilo Authenticated Remote Code Execution	chamilo-lms	7.5 (v4.0)	High
CVE-2026-36783	Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to Denial of Service Vulnerability	-	7.5 (v3.1)	High
CVE-2026-36796	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to Denial of Service Vulnerability	-	7.5 (v3.1)	High
CVE-2026-46581	mojarra Path Traversal Vulnerability	mojarra	7.5 (v3.1)	High
CVE-2026-51078	Dede CMS v.5.7.118 Information Disclosure Vulnerability	-	7.5 (v3.1)	High
CVE-2026-53534	JabRef CAYW Sublime Text integration permits operating-system command injection	jabref	7.5 (v4.0)	High
CVE-2026-53599	Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mo	core	7.5 (v3.1)	High
CVE-2026-61686	SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop	SolidInvoice	7.5 (v3.1)	High
CVE-2026-101860	RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management	raspap-webgui	7.4 (v4.0)	High
CVE-2022-20707	Cisco RV Series Authentication Bypass and Command Injection	rv340 firmware	7.3 (v3.1)	High
CVE-2024-11740	Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution	download manager	7.3 (v3.1)	High
CVE-2024-2961	CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)	glibc	7.3 (v3.1)	High
CVE-2025-34078	NSClient++ 0.5.2.35 - Privilege escalation	nsclient++	7.3 (v4.0)	High
CVE-2025-68619	Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package	signal k server	7.3 (v4.0)	High
CVE-2026-108593	9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint	9router	7.3 (v4.0)	High
CVE-2026-10870	Shibby Tomato Web UI rc start_dhcpc os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-10871	Shibby Tomato Web UI rc start_6rd_tunnel os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-10873	Shibby Tomato Web UI rstats rstats_path os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-18900	H3C NX15 Backend RPC esps file.exec os command injection	NX15	7.3 (v4.0)	High
CVE-2026-19771	Baicells EG3661M LuCI Web luci os command injection	EG3661M	7.3 (v4.0)	High
CVE-2026-36540	Netis AC1200 Router NC21 V4.0.1.4296 Arbitrary Code Execution Vulnerability	-	7.3 (v3.1)	High
CVE-2026-53554	SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing	SQLBot	7.3 (v4.0)	High
CVE-2018-1002000	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	7.2 (v3.0)	High
CVE-2019-0193	Apache Solr Remote Command Execution (CVE-2019-0193)	solr	7.2 (v3.1)	High
CVE-2019-11539	Pulse Secure VPN Arbitrary Command Execution	connect secure	7.2 (v3.1)	High
CVE-2019-1936	Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	integrated management controller supervisor	7.2 (v3.1)	High
CVE-2019-2767	Oracle Business Intelligence Publisher - XML External Entity Injection	bi publisher	7.2 (v3.0)	High
CVE-2020-14295	Cacti color filter authenticated SQLi to RCE	cacti	7.2 (v3.1)	High
CVE-2020-14883	Oracle WebLogic Server Administration Console Handle RCE	weblogic server	7.2 (v3.1)	High
CVE-2020-5792	Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection	nagios xi	7.2 (v3.1)	High
CVE-2021-33544	Geutebruck - Remote Command Injection	g-cam ebc-2110	7.2 (v3.1)	High
CVE-2023-0669	Fortra GoAnywhere MFT - Remote Code Execution	goanywhere managed file transfer	7.2 (v3.1)	High
CVE-2023-1211	phpIPAM 1.5.1 - SQL Injection	phpipam	7.2 (v3.1)	High
CVE-2023-24955	Sharepoint Dynamic Proxy Generator Unauth RCE	sharepoint enterprise server	7.2 (v3.1)	High
CVE-2024-38288	TurboMeeting - Post-Authentication Command Injection	turbomeeting	7.2 (v3.1)	High
CVE-2025-48868	Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive	horilla	7.2 (v3.1)	High
CVE-2025-58034	Fortinet FortiWeb unauthenticated RCE	fortiweb	7.2 (v3.1)	High
CVE-2025-58762	Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent	tautulli	7.2 (v3.1)	High
CVE-2025-58763	Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection	tautulli	7.2 (v3.1)	High
CVE-2025-62429	ClipBucket v5 executes arbitrary PHP code	clipbucket	7.2 (v3.1)	High
CVE-2026-13392	ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)	ElementsKit Elementor Addons	7.2 (v3.1)	High
CVE-2026-15686	Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability	Adminer	7.2 (v3.0)	High
CVE-2026-27891	Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism	facturascripts	7.2 (v3.1)	High
CVE-2026-29782	OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2	openstamanager	7.2 (v3.1)	High
CVE-2026-6020	ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API	ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin	7.2 (v3.1)	High
CVE-2026-71284	Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename	fledge	7.2 (v3.1)	High
CVE-2026-7693	Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter	Backup Migration	7.2 (v3.1)	High
CVE-2026-81669	IBM Guardium Data Protection is affected by multiple vulnerabilities.	guardium data protection	7.2 (v3.1)	High
CVE-2026-92263	SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/resto	SparkyFitness	7.2 (v3.1)	High
CVE-2026-96896	Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request	Malcure Malware Shield — Removal, Repair, Monitor	7.2 (v3.1)	High
CVE-2026-9777	ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability	unizon	7.2 (v3.0)	High
CVE-2014-2928	F5 iControl Remote Root Command Execution	big-ip webaccelerator	7.1 (v2.0)	High
CVE-2025-14701	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller	crafty controller	7.1 (v3.1)	High
CVE-2025-34098	Riverbed SteelHead VCX File Read	SteelHead VCX	7.1 (v4.0)	High
CVE-2026-48997	e107: Command Injection via shell expansion in ImageMagick resize destination path	e107	7.1 (v3.1)	High
CVE-2026-58502	githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow	githubtoplanguages	7.1 (v4.0)	High
CVE-2026-71964	CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload	cyberpanel	7.1 (v4.0)	High
CVE-2026-77939	Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint	flextype	7.1 (v4.0)	High
CVE-2024-55890	D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection	dtale	6.9 (v4.0)	Medium
CVE-2024-9474	Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution	pan-os	6.9 (v4.0)	Medium
CVE-2025-71257	BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass	footprints itsm	6.9 (v4.0)	Medium
CVE-2026-11450	GL.iNet GL-MT3000 Path Normalization dlopen command injection	GL-MT3000	6.9 (v4.0)	Medium
CVE-2026-116253	DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection	DedeCMS	6.9 (v4.0)	Medium
CVE-2026-19983	GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection	A1300	6.9 (v4.0)	Medium
CVE-2026-5739	PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection	PowerJob	6.9 (v4.0)	Medium
CVE-2026-97865	Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization	Open-Web-Analytics	6.9 (v4.0)	Medium
CVE-2008-6825	Trixbox langChoice PHP Local File Inclusion	trixbox	6.8 (v2.0)	Medium
CVE-2011-4449	WikkaWiki 1.3.2 - Multiple Vulnerabilities	wikkawiki	6.8 (v2.0)	Medium
CVE-2011-4452	WikkaWiki 1.3.2 - Multiple Vulnerabilities	wikkawiki	6.8 (v2.0)	Medium
CVE-2012-0392	Apache Struts2 S2-008 RCE	struts	6.8 (v2.0)	Medium
CVE-2013-5696	GLPI install.php Remote Command Execution	glpi	6.8 (v2.0)	Medium
CVE-2015-2995	SysAid Help Desk 'rdslogs' Arbitrary File Upload	sysaid	6.8 (v2.0)	Medium
CVE-2018-6230	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.8 (v3.0)	Medium
CVE-2025-59709	biztalk360 Path Traversal Vulnerability	biztalk360	6.8 (v3.1)	Medium
CVE-2026-10821	Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE	Yoast SEO Premium	6.6 (v3.1)	Medium
CVE-2026-34216	CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php	panel	6.6 (v3.1)	Medium
CVE-2026-79761	Termix: Command injection in SSH key deployment verification	Termix	6.6 (v3.1)	Medium
CVE-2012-2962	Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection	scrutinizer	6.5 (v2.0)	Medium
CVE-2013-4861	MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities	veralite firmware	6.5 (v3.1)	Medium
CVE-2013-4865	MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities	veralite firmware	6.5 (v3.1)	Medium
CVE-2013-5015	Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution	endpoint protection manager	6.5 (v2.0)	Medium
CVE-2014-4977	Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection	scrutinizer	6.5 (v2.0)	Medium
CVE-2015-5453	Watchguard XCS Remote Command Execution	xcs	6.5 (v2.0)	Medium
CVE-2015-5603	Atlassian HipChat for Jira Plugin Velocity Template Injection	hipchat	6.5 (v2.0)	Medium
CVE-2018-15140	OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions	openemr	6.5 (v3.0)	Medium
CVE-2018-15141	OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions	openemr	6.5 (v3.0)	Medium
CVE-2018-6219	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.5 (v3.0)	Medium
CVE-2020-13945	Apache APISIX Hardcoded API Token Leads to RCE (CVE-2020-13945)	apisix	6.5 (v3.1)	Medium
CVE-2024-24565	CrateDB Database - Arbitrary File Read	cratedb	6.5 (v3.1)	Medium
CVE-2025-11372	LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	6.5 (v3.1)	Medium
CVE-2025-14545	YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation	YML for Yandex Market	6.5 (v3.1)	Medium
CVE-2025-55911	ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)	clipbucket	6.5 (v3.1)	Medium
CVE-2025-61224	DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting	dokuwiki	6.5 (v3.1)	Medium
CVE-2026-40909	WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Dir	avideo	6.5 (v3.1)	Medium
CVE-2026-4502	Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API	langflow desktop	6.5 (v3.1)	Medium
CVE-2026-55679	WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection	WeGIA	6.5 (v3.1)	Medium
CVE-2026-63432	Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password	horilla-hr	6.5 (v3.1)	Medium
CVE-2026-72739	Dokploy: Command Injection via Compose Shell Execution	dokploy	6.5 (v3.1)	Medium
CVE-2011-4450	WikkaWiki 1.3.2 - Multiple Vulnerabilities	wikkawiki	6.4 (v2.0)	Medium
CVE-2025-7825	Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation	Schema Plugin For Divi, Gutenberg & Shortcodes	6.3 (v3.1)	Medium
CVE-2026-44287	FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*(/ is bypassable	FastGPT	6.3 (v3.1)	Medium
CVE-2026-45626	Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter	arcane	6.3 (v3.1)	Medium
CVE-2014-4558	WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting	swipehq-payment-gateway-woocommerce	6.1 (v3.1)	Medium
CVE-2015-4668	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	6.1 (v3.0)	Medium
CVE-2016-8527	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	6.1 (v3.0)	Medium
CVE-2017-3132	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2017-3133	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2019-11398	UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting	ulicms	6.1 (v3.0)	Medium
CVE-2019-14950	WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting	live chat	6.1 (v3.0)	Medium
CVE-2019-17504	Kirona-DRS 5.5.3.5 - Information Disclosure	dynamic resource scheduling	6.1 (v3.1)	Medium
CVE-2019-7438	JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting	jiofi 4g m2s firmware	6.1 (v3.0)	Medium
CVE-2020-13483	Bitrix24 <=20.0.0 - Cross-Site Scripting	bitrix24	6.1 (v3.1)	Medium
CVE-2021-24235	WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting	goto	6.1 (v3.1)	Medium
CVE-2021-24495	Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting	marmoset viewer	6.1 (v3.1)	Medium
CVE-2021-25161	Aruba Instant Access Point (IAP) - Cross-Site Scripting	aruba-instant-access-point	6.1 (v3.1)	Medium
CVE-2021-42551	NetBiblio WebOPAC - Cross-Site Scripting	netbiblio	6.1 (v3.1)	Medium
CVE-2022-0346	WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution	xml sitemap generator	6.1 (v3.1)	Medium
CVE-2022-29296	Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)	genialcloud proj	6.1 (v3.1)	Medium
CVE-2023-41425	WonderCMS Remote Code Execution	wondercms	6.1 (v3.1)	Medium
CVE-2023-44012	mojoPortal v.2.7.0.0 - Cross-Site Scripting	mojoportal	6.1 (v3.1)	Medium
CVE-2024-24494	Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)	daily habit tracker	6.1 (v3.1)	Medium
CVE-2024-29931	WP Go Maps <= 9.0.29 - Cross-Site Scripting	wp go maps	6.1 (v3.1)	Medium
CVE-2025-25296	Label Studio < 1.16.0 - Cross-Site Scripting	label studio	6.1 (v3.1)	Medium
CVE-2026-47250	mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration	mcp-server-kubernetes	6.1 (v3.1)	Medium
CVE-2025-13439	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserializatio	Fancy Product Designer	5.9 (v3.1)	Medium
CVE-2026-60137	WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query	WordPress	5.9 (v3.1)	Medium
CVE-2026-61852	Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool	chartbrew	5.8 (v4.0)	Medium
CVE-2018-15536	Responsive FileManager < 9.13.4 - Directory Traversal	responsive filemanager	5.5 (v3.0)	Medium
CVE-2025-10091	Jinher OA XML Type xml external entity reference	jinher oa	5.5 (v4.0)	Medium
CVE-2025-10816	Jinher OA XML text xml external entity reference	jinher oa	5.5 (v4.0)	Medium
CVE-2025-13262	lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal	lsfusion platform	5.5 (v4.0)	Medium
CVE-2025-13786	taosir WTCMS index.php fetch code injection	wtcms	5.5 (v4.0)	Medium
CVE-2025-13792	Qualitor getResumo.php eval code injection	the file /html/st/stdeslocamento/request/getResumo.php	5.5 (v4.0)	Medium
CVE-2025-6095	Jasmin Ransomware Web Server Unauthenticated SQL Injection	jasmin-ransomware	5.5 (v4.0)	Medium
CVE-2026-10214	zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection	chatgpt-on-wechat	5.5 (v4.0)	Medium
CVE-2026-102874	HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection	AnyTool	5.5 (v4.0)	Medium
CVE-2026-112252	Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql	Wubang Five-in-One Safety Production Management Information System	5.5 (v4.0)	Medium
CVE-2026-11344	code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload	Vehicle Management System	5.5 (v4.0)	Medium
CVE-2026-14700	code-projects Internship Management System Employer Login Endpoint login.php sql injection	Internship Management System	5.5 (v4.0)	Medium
CVE-2026-18641	Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginC	Operation and Maintenance Security Management System	5.5 (v4.0)	Medium
CVE-2026-19379	EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection	ipTIME AX8004M	5.5 (v4.0)	Medium
CVE-2026-3395	MaxSite CMS <=109.1 - Remote Code Execution	maxsite cms	5.5 (v4.0)	Medium
CVE-2026-5333	DefaultFuction Content-Management-System tools.php command injection	content management system	5.5 (v4.0)	Medium
CVE-2026-54611	InstantCMS has Remote Code Execution in package installer	icms2	5.5 (v3.1)	Medium
CVE-2026-5631	assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection	gpt-researcher	5.5 (v4.0)	Medium
CVE-2026-5677	Totolink A7100RU cstecgi.cgi CsteSystem os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5678	Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5688	Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5689	Totolink A7100RU cstecgi.cgi setNtpCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5690	Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5691	Totolink A7100RU cstecgi.cgi setFirewallType os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5692	Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5736	PowerJob detailPlus Endpoint InstanceController.java sql injection	PowerJob	5.5 (v4.0)	Medium
CVE-2026-5741	suvarchal docker-mcp-server HTTP index.ts pull_image os command injection	docker-mcp-server	5.5 (v4.0)	Medium
CVE-2026-5802	idachev mcp-javadc HTTP os command injection	mcp-javadc	5.5 (v4.0)	Medium
CVE-2026-7061	Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection	chatgpt-mcp-server	5.5 (v4.0)	Medium
CVE-2026-7062	Intina47 context-sync Git Integration git-integration.ts os command injection	context-sync	5.5 (v4.0)	Medium
CVE-2026-7064	AgentDeskAI browser-tools-mcp browser-connector.ts os command injection	browser-tools-mcp	5.5 (v4.0)	Medium
CVE-2026-7066	choieastsea simple-openstack-mcp server.py exec_openstack os command injection	simple-openstack-mcp	5.5 (v4.0)	Medium
CVE-2026-7220	jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection	FastlyMCP	5.5 (v4.0)	Medium
CVE-2026-7416	PolarVista xcode-mcp-server MCP index.ts run_tests os command injection	xcode-mcp-server	5.5 (v4.0)	Medium
CVE-2026-7443	BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection	mcp-dnstwist	5.5 (v4.0)	Medium
CVE-2026-7590	eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection	p 69 branch monkey mcp	5.5 (v4.0)	Medium
CVE-2026-7630	innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication	InnoShop	5.5 (v4.0)	Medium
CVE-2026-76760	chenhg5 cc-connect webhook.go authenticate code injection	cc-connect	5.5 (v4.0)	Medium
CVE-2026-76761	chenhg5 cc-connect Management API engine.go shellExecCommand os command injection	cc-connect	5.5 (v4.0)	Medium
CVE-2026-7698	Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection	Easy7 Integrated Management Platform	5.5 (v4.0)	Medium
CVE-2026-82598	SeaCMS Template search.php parseIf code injection	SeaCMS	5.5 (v4.0)	Medium
CVE-2026-85137	SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection	SeaCMS	5.5 (v4.0)	Medium
CVE-2026-90617	GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection	PentestAgent	5.5 (v4.0)	Medium
CVE-2026-90619	0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection	HexStrike AI	5.5 (v4.0)	Medium
CVE-2026-90690	0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection	HexStrike AI	5.5 (v4.0)	Medium
CVE-2026-90843	SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection	WebMap	5.5 (v4.0)	Medium
CVE-2026-9474	yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection	StudentManagementSystem	5.5 (v4.0)	Medium
CVE-2014-8674	SO Planning 1.32 - Multiple Vulnerabilities	soplanning	5.4 (v3.1)	Medium
CVE-2017-3131	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	5.4 (v3.0)	Medium
CVE-2018-6226	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2018-6227	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2020-24963	Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)	best support system	5.4 (v3.1)	Medium
CVE-2025-52367	PivotX Remote Code Execution	pivotx	5.4 (v3.1)	Medium
CVE-2026-54543	Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields	froxlor	5.4 (v3.1)	Medium
CVE-2026-58391	OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout	core	5.4 (v3.1)	Medium
CVE-2014-8676	SO Planning 1.32 - Multiple Vulnerabilities	soplanning	5.3 (v3.0)	Medium
CVE-2014-8677	SO Planning 1.32 - Multiple Vulnerabilities	soplanning	5.3 (v3.0)	Medium
CVE-2015-2826	WordPress Plugin Simple Ads Manager - Information Disclosure	simple ads manager	5.3 (v3.0)	Medium
CVE-2019-17503	Kirona-DRS 5.5.3.5 - Information Disclosure	dynamic resource scheduling	5.3 (v3.1)	Medium
CVE-2021-22017	vCenter Server - Improper Access Control	vcenter server	5.3 (v3.1)	Medium
CVE-2023-7299	DataGear resolveSql sql injection	datagear	5.3 (v4.0)	Medium
CVE-2024-7120	Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection	msg2300 firmware	5.3 (v4.0)	Medium
CVE-2025-10097	SimStudioAI sim route.ts code injection	sim	5.3 (v4.0)	Medium
CVE-2025-11344	ILIAS Certificate Import code injection	ilias	5.3 (v4.0)	Medium
CVE-2026-15485	TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection	TEW-821DAP	5.3 (v4.0)	Medium
CVE-2026-19785	francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection	RosarioSIS	5.3 (v4.0)	Medium
CVE-2026-29202	cPanel Code Injection Vulnerability	cPanel	5.3 (v4.0)	Medium
CVE-2026-5547	Tenda AC10 httpd formAddMacfilterRule os command injection	ac10 firmware	5.3 (v4.0)	Medium
CVE-2026-89247	WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php	AVideo	5.3 (v4.0)	Medium
CVE-2025-59751	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59752	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59753	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59754	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59759	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59773	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59774	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2010-4094	Apache Tomcat Manager Authenticated Upload Code Execution	rational quality manager	5.0 (v2.0)	Medium
CVE-2011-4898	WordPress Core 3.3.1 - Multiple Vulnerabilities	WordPress	5.0 (v2.0)	Medium
CVE-2012-4915	WordPress Plugin Google Document Embedder Arbitrary File Disclosure	google doc embedder	5.0 (v2.0)	Medium
CVE-2013-6043	Webuzo 2.1.3 - Multiple Vulnerabilities	webuzo	5.0 (v2.0)	Medium
CVE-2014-2268	Vtiger Install Unauthenticated Remote Command Execution	vtiger crm	5.0 (v2.0)	Medium
CVE-2015-0922	McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure	epolicy orchestrator	5.0 (v2.0)	Medium
CVE-2015-4666	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	5.0 (v2.0)	Medium
CVE-2016-4807	Web2py 2.14.5 - Multiple Vulnerabilities	web2py	4.8 (v3.0)	Medium
CVE-2018-1002001	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002002	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002003	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002004	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002005	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002006	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002007	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002008	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2018-1002009	WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting	arigato autoresponder and newsletter	4.8 (v3.0)	Medium
CVE-2019-19742	D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting	dir-615 firmware	4.8 (v3.1)	Medium
CVE-2020-35241	Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting	flatpress	4.8 (v3.1)	Medium
CVE-2026-112949	Vitest: Code injection via unauthenticated manual mock registration	vitest	4.7 (v3.1)	Medium
CVE-2011-4451	WikkaWiki 1.3.2 - Multiple Vulnerabilities	wikkawiki	4.3 (v2.0)	Medium
CVE-2012-0782	WordPress Core 3.3.1 - Multiple Vulnerabilities	WordPress	4.3 (v2.0)	Medium
CVE-2013-6042	Webuzo 2.1.3 - Multiple Vulnerabilities	webuzo	4.3 (v2.0)	Medium
CVE-2014-1944	Ilch CMS 2.0 - Persistent Cross-Site Scripting	ilch cms	4.3 (v2.0)	Medium
CVE-2015-2275	WoltLab Community Gallery - Persistent Cross-Site Scripting	community gallery	4.3 (v2.0)	Medium
CVE-2015-4665	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	4.3 (v2.0)	Medium
CVE-2018-6225	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	4.3 (v3.0)	Medium
CVE-2025-63739	rockoa Improper Access Control Vulnerability	rockoa	4.3 (v3.1)	Medium
CVE-2026-36239	PbootCMS v.3.2.11 Cross-site Scripting Vulnerability	PbootCMS v.3.2.11	4.3 (v3.1)	Medium
CVE-2026-16297	Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import	Clearfy Cache	4.1 (v3.1)	Medium
CVE-2015-0921	McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure	epolicy orchestrator	4.0 (v2.0)	Medium
CVE-2015-4040	F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal	enterprise manager	4.0 (v2.0)	Medium
CVE-2025-67737	AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE	azuracast	3.7 (v3.1)	Low
CVE-2023-3360	Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection	Weaver Show Posts	3.3 (v3.1)	Low
CVE-2026-42201	Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands	coolify	3.3 (v3.1)	Low
CVE-2025-14276	Ilevia EVE X1 Server leaf_search.php command injection	EVE X1 Server	2.9 (v4.0)	Low
CVE-2026-38924	Serena Incorrect Resource Transfer Between Spheres Vulnerability	Serena	2.9 (v3.1)	Low
CVE-2026-90575	PHPGurukul Small CRM Login Success login.php unserialize deserialization	Small CRM	2.9 (v4.0)	Low
CVE-2025-11035	Jinher OA text xml external entity reference	jinher oa	2.1 (v4.0)	Low
CVE-2025-11138	mirweiye wenkucms common.php createPathOne os command injection	wenkucms	2.1 (v4.0)	Low
CVE-2025-11490	wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection	desktopcommandermcp	2.1 (v4.0)	Low
CVE-2025-11902	yanyutao0402 ChanCMS findField sql injection	chancms	2.1 (v4.0)	Low
CVE-2025-11903	yanyutao0402 ChanCMS update sql injection	chancms	2.1 (v4.0)	Low
CVE-2025-11905	yanyutao0402 ChanCMS gather.js getArticle code injection	chancms	2.1 (v4.0)	Low
CVE-2025-12266	Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection	Central Authentication Service	2.1 (v4.0)	Low
CVE-2025-13209	bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference	oa git free	2.1 (v4.0)	Low
CVE-2025-14204	TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command inje	cherry-studio-TykoFork	2.1 (v4.0)	Low
CVE-2025-14731	CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine	ctcms	2.1 (v4.0)	Low
CVE-2026-10172	Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload	Multi-Store Inventory Management System	2.1 (v4.0)	Low
CVE-2026-101859	RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection	raspap-webgui	2.1 (v4.0)	Low
CVE-2026-101861	Langflow Code Execution via eval() in Component Input Schema	langflow	2.1 (v4.0)	Low
CVE-2026-10279	hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection	wezterm-mcp	2.1 (v4.0)	Low
CVE-2026-102906	0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection	github-mcp-server	2.1 (v4.0)	Low
CVE-2026-103540	formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine	Form Tools	2.1 (v4.0)	Low
CVE-2026-105329	TallCMS PluginManager ThemeManager.php code injection	TallCMS	2.1 (v4.0)	Low
CVE-2026-111986	AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection	stable-diffusion-webui	2.1 (v4.0)	Low
CVE-2026-112078	RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection	Retrieval-based-Voice-Conversion-WebUI	2.1 (v4.0)	Low
CVE-2026-11408	vertex-app vertex Log Viewer Endpoint LogMod.js os command injection	vertex	2.1 (v4.0)	Low
CVE-2026-12814	Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection	CF-WR631AX V3	2.1 (v4.0)	Low
CVE-2026-13560	Edimax EW-7478APC POST Request formAccept os command injection	EW-7478APC	2.1 (v4.0)	Low
CVE-2026-13561	Edimax EW-7478APC POST Request formiNICbasic os command injection	EW-7478APC	2.1 (v4.0)	Low
CVE-2026-13581	Edimax EW-7478APC POST Request formStaDrvSetup os command injection	EW-7478APC	2.1 (v4.0)	Low
CVE-2026-14691	SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code inject	Multi-Vendor Online Grocery Management System	2.1 (v4.0)	Low
CVE-2026-14698	SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload	Syllabus-Aligned Learning Management and Examination System	2.1 (v4.0)	Low
CVE-2026-15496	SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection	sonic-agent	2.1 (v4.0)	Low
CVE-2026-15512	pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection	Pig	2.1 (v4.0)	Low
CVE-2026-19932	DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection	Notice-System-Managent	2.1 (v4.0)	Low
CVE-2026-19958	iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection	pptr-mcp	2.1 (v4.0)	Low
CVE-2026-5351	Trendnet TEW-657BRM setup.cgi add_wps_client os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5352	Trendnet TEW-657BRM setup.cgi edit os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5353	Trendnet TEW-657BRM setup.cgi ping_test os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5354	Trendnet TEW-657BRM setup.cgi vpn_connect os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5355	Trendnet TEW-657BRM setup.cgi vpn_drop os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-6125	Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection	warm-flow	2.1 (v4.0)	Low
CVE-2026-6489	QueryMine sms Background Management addteacher.php unrestricted upload	sms	2.1 (v4.0)	Low
CVE-2026-7508	Bootstrap CMS Page Creation show.blade.php code injection	CMS	2.1 (v4.0)	Low
CVE-2026-7600	ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection	yii2-mcp-server	2.1 (v4.0)	Low
CVE-2026-7642	pskill9 website-downloader MCP index.ts download_website os command injection	website-downloader	2.1 (v4.0)	Low
CVE-2026-7653	r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection	mcp-server-rijksmuseum	2.1 (v4.0)	Low
CVE-2026-7683	Edimax BR-6428nC Web setWAN command injection	BR-6428nC	2.1 (v4.0)	Low
CVE-2026-78166	provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection	kafka-ui	2.1 (v4.0)	Low
CVE-2026-8188	Wavlink NU516U1 adm.cgi change_wifi_password os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8189	Wavlink NU516U1 adm.cgi wzdrepeater os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8190	Wavlink NU516U1 adm.cgi wan os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8191	Wavlink NU516U1 adm.cgi wifi_region os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8192	Wavlink NU516U1 adm.cgi wzdap os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8227	Wavlink NU516U1 adm.cgi wzdapMesh os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8228	Wavlink NU516U1 wireless.cgi advance os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8229	Wavlink NU516U1 wireless.cgi WifiBasic os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8230	Wavlink NU516U1 login.cgi sys_login1 os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8264	Tenda AC6 httpd WifiApScan formWifiApScan os command injection	ac6 firmware	2.1 (v4.0)	Low
CVE-2026-90488	Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection	xxl-job	2.1 (v4.0)	Low
CVE-2026-90581	cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection	nginxWebUI	2.1 (v4.0)	Low
CVE-2026-91853	TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection	X5000R	2.1 (v4.0)	Low
CVE-2026-92993	Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection	mayfly-go	2.1 (v4.0)	Low
CVE-2026-9302	546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection	vps-inventory-monitoring	2.1 (v4.0)	Low
CVE-2026-9343	Edimax EW-7438RPn webs formWpsStart os command injection	EW-7438RPn	2.1 (v4.0)	Low
CVE-2026-9347	Edimax EW-7438RPn webs formWizSurvey os command injection	EW-7438RPn	2.1 (v4.0)	Low
CVE-2026-9424	Edimax EW-7438RPn Content-Type formWlanMP os command injection	EW-7438RPn	2.1 (v4.0)	Low
CVE-2026-9511	Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9512	Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9514	Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9515	Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9531	Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9532	Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9533	Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9534	Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2025-11073	Keyfactor RG-EW5100BE HTTP POST Request cmd command injection	RG-EW5100BE	2.0 (v4.0)	Low
CVE-2025-11141	Ruijie NBR2100G-E branch_passw.php listAction os command injection	NBR2100G-E	2.0 (v4.0)	Low
CVE-2025-13198	DouPHP file.class.php unrestricted upload	DouPHP	2.0 (v4.0)	Low
CVE-2025-14729	CTCMS Content Management System Backend App Configuration Ct_App.php save code injection	ctcms	2.0 (v4.0)	Low
CVE-2025-14730	CTCMS Content Management System Backend System Configuration Ct_Config.php code injection	ctcms	2.0 (v4.0)	Low
CVE-2025-14837	ZZCMS Backend Website Settings siteconfig.php stripfxg code injection	zzcms	2.0 (v4.0)	Low
CVE-2025-15130	shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection	SyCms	2.0 (v4.0)	Low
CVE-2025-15148	CmsEasy Backend Template Management template_admin.php savetemp_action code injection	cmseasy	2.0 (v4.0)	Low
CVE-2025-15394	iCMS POST Parameter ConfigAdmincp.php save code injection	icms	2.0 (v4.0)	Low
CVE-2025-15438	PluXml Media Management medias.php __destruct deserialization	pluxml	2.0 (v4.0)	Low
CVE-2026-105226	osCommerce osCommerce2 Newsletter Management newsletters.php include code injection	osCommerce2	2.0 (v4.0)	Low
CVE-2026-112195	FusionPBX Dialplan Editor dialplan.php os command injection	FusionPBX	2.0 (v4.0)	Low
CVE-2026-19964	Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection	Jij-MCP-Server	2.0 (v4.0)	Low
CVE-2026-5848	jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection	JimuReport	2.0 (v4.0)	Low
CVE-2026-78140	Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine	UJCMS	2.0 (v4.0)	Low
CVE-2026-8259	Tenda AC6 httpd telnet os command injection	ac6 firmware	2.0 (v4.0)	Low
CVE-2026-8265	Tenda AC6 httpd getLogFile get_log_file os command injection	ac6 firmware	2.0 (v4.0)	Low
CVE-2026-82678	diem-project diem Administrative Console actions.class.php executeCommand os command injection	diem	2.0 (v4.0)	Low
CVE-2026-82702	Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection	BR-6214K	2.0 (v4.0)	Low
CVE-2026-82703	Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection	BR-6214K	2.0 (v4.0)	Low
CVE-2026-85040	ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection	CRMEB	2.0 (v4.0)	Low
CVE-2026-90705	D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection	DWR-M921	2.0 (v4.0)	Low
CVE-2026-90706	D-Link DWR-M921 formWsc os command injection	DWR-M921	2.0 (v4.0)	Low
CVE-2026-90709	Yot CMS Admin Console admin.php eval code injection	CMS	2.0 (v4.0)	Low
CVE-2026-90788	magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection	MacCMS10	2.0 (v4.0)	Low
CVE-2026-94103	RooCMS Frontend Rendering site_pagePHP.php eval code injection	RooCMS	2.0 (v4.0)	Low
CVE-2026-10529	westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting	CicadasCMS	1.9 (v4.0)	Low
CVE-2026-113388	opensource-socialnetwork Cache Settings dynamic.php input code injection	opensource-socialnetwork	1.9 (v4.0)	Low
CVE-2026-16129	princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist	SafestClaw	1.9 (v4.0)	Low
CVE-2026-5621	ChrisChinchilla Vale-MCP HTTP index.ts os command injection	Vale-MCP	1.9 (v4.0)	Low
CVE-2026-19353	DedeCMS Installation Wizard index.php _4_Setup file inclusion	DedeCMS	1.3 (v4.0)	Low
CVE-2026-108827	Zen Cart Administrative Module Management general.php zen_call_function code injection	Zen Cart	1.2 (v4.0)	Low

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-15	CVE-2026-45087
CWE-19	CVE-2012-5357
CWE-20	CVE-2009-0545 , CVE-2026-47668 , CVE-2015-4664 , CVE-2016-3087 , CVE-2017-12611 , CVE-2020-13942 , CVE-2020-3243 , CVE-2020-3250 , CVE-2022-24086 , CVE-2022-47966 , CVE-2026-19912 , CVE-2026-35048 , CVE-2026-41042 , CVE-2026-57499 , CVE-2018-10054 , CVE-2026-24893 , CVE-2026-34197 , CVE-2026-35031 , CVE-2026-45505 , CVE-2026-84317 , CVE-2025-34115 , CVE-2026-28797 , CVE-2026-55094 , CVE-2026-54710 , CVE-2026-42588 , CVE-2013-0156 , CVE-2026-19913 , CVE-2019-1936 , CVE-2026-27891 , CVE-2026-97865 , CVE-2026-90575 , CVE-2025-15438
CWE-22	CVE-2010-5324 , CVE-2024-13984 , CVE-2026-7411 , CVE-2026-57155 , CVE-2016-7552 , CVE-2019-19781 , CVE-2021-32682 , CVE-2022-29806 , CVE-2023-26469 , CVE-2026-19912 , CVE-2019-25687 , CVE-2026-48768 , CVE-2026-64824 , CVE-2021-25282 , CVE-2026-50006 , CVE-2018-15142 , CVE-2020-7246 , CVE-2026-35031 , CVE-2026-57296 , CVE-2026-82217 , CVE-2026-85731 , CVE-2019-25671 , CVE-2026-116009 , CVE-2026-39352 , CVE-2026-40521 , CVE-2025-59711 , CVE-2026-75842 , CVE-2026-19942 , CVE-2013-1081 , CVE-2018-15535 , CVE-2026-46581 , CVE-2026-53554 , CVE-2026-9777 , CVE-2008-6825 , CVE-2015-2995 , CVE-2025-59709 , CVE-2013-4861 , CVE-2018-15140 , CVE-2018-15141 , CVE-2024-24565 , CVE-2026-40909 , CVE-2026-4502 , CVE-2011-4450 , CVE-2018-15536 , CVE-2025-13262 , CVE-2014-8676 , CVE-2012-4915 , CVE-2015-4666 , CVE-2015-4040
CWE-23	CVE-2025-64446
CWE-59	CVE-2024-28185 , CVE-2024-28189 , CVE-2026-85731 , CVE-2026-71964
CWE-61	CVE-2024-28185 , CVE-2024-28189
CWE-73	CVE-2024-13984 , CVE-2026-57155 , CVE-2026-85520 , CVE-2025-65473 , CVE-2026-50006 , CVE-2026-15983 , CVE-2026-19913 , CVE-2025-58762 , CVE-2026-19353
CWE-74	CVE-2013-2251 , CVE-2016-4010 , CVE-2017-0372 , CVE-2018-16763 , CVE-2018-6220 , CVE-2020-13942 , CVE-2020-17496 , CVE-2022-46169 , CVE-2023-29827 , CVE-2023-4450 , CVE-2014-7236 , CVE-2021-41282 , CVE-2023-43661 , CVE-2026-45344 , CVE-2026-71320 , CVE-2015-1592 , CVE-2019-17558 , CVE-2026-11450 , CVE-2026-116253 , CVE-2026-5739 , CVE-2026-10821 , CVE-2025-13786 , CVE-2025-13792 , CVE-2025-6095 , CVE-2026-112252 , CVE-2026-14700 , CVE-2026-3395 , CVE-2026-5333 , CVE-2026-5631 , CVE-2026-5736 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2026-9474 , CVE-2026-54543 , CVE-2023-7299 , CVE-2025-10097 , CVE-2025-11344 , CVE-2026-19785 , CVE-2025-14276 , CVE-2025-11902 , CVE-2025-11903 , CVE-2025-11905 , CVE-2025-12266 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-15512 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-6125 , CVE-2026-7508 , CVE-2026-7683 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-11073 , CVE-2025-14729 , CVE-2025-14730 , CVE-2025-14837 , CVE-2025-15130 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-90709 , CVE-2026-94103 , CVE-2026-113388 , CVE-2026-108827
CWE-77	CVE-2026-105134 , CVE-2026-108576 , CVE-2026-26015 , CVE-2026-72869 , CVE-2014-1203 , CVE-2020-13117 , CVE-2021-1498 , CVE-2022-40022 , CVE-2022-40881 , CVE-2023-33831 , CVE-2023-34960 , CVE-2026-34243 , CVE-2026-35847 , CVE-2026-8037 , CVE-2024-9264 , CVE-2026-47670 , CVE-2025-10364 , CVE-2025-59735 , CVE-2025-59736 , CVE-2025-59737 , CVE-2025-59738 , CVE-2025-59739 , CVE-2025-59740 , CVE-2025-59741 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-102240 , CVE-2026-108804 , CVE-2026-41304 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9408 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9475 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2020-15874 , CVE-2025-51457 , CVE-2026-88622 , CVE-2026-100896 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-108894 , CVE-2026-109108 , CVE-2026-113390 , CVE-2026-113506 , CVE-2026-55182 , CVE-2026-82692 , CVE-2026-85223 , CVE-2026-86299 , CVE-2026-90699 , CVE-2026-101009 , CVE-2026-82690 , CVE-2026-82691 , CVE-2026-85222 , CVE-2026-85224 , CVE-2026-90702 , CVE-2026-90703 , CVE-2026-92397 , CVE-2026-92398 , CVE-2016-3081 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2026-36540 , CVE-2024-38288 , CVE-2026-7693 , CVE-2026-11450 , CVE-2026-19983 , CVE-2015-5453 , CVE-2025-55911 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5333 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7062 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90619 , CVE-2026-90690 , CVE-2026-90843 , CVE-2026-15485 , CVE-2026-5547 , CVE-2025-14276 , CVE-2025-11138 , CVE-2025-11490 , CVE-2025-14204 , CVE-2026-101859 , CVE-2026-10279 , CVE-2026-102906 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-13560 , CVE-2026-13561 , CVE-2026-13581 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7600 , CVE-2026-7642 , CVE-2026-7653 , CVE-2026-7683 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-8264 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9343 , CVE-2026-9347 , CVE-2026-9424 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11073 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-8259 , CVE-2026-8265 , CVE-2026-82678 , CVE-2026-82702 , CVE-2026-82703 , CVE-2026-85040 , CVE-2026-90705 , CVE-2026-90706 , CVE-2026-90788 , CVE-2026-5621
CWE-78	CVE-2025-34037 , CVE-2025-34073 , CVE-2026-100382 , CVE-2026-105134 , CVE-2026-108576 , CVE-2026-19188 , CVE-2026-34234 , CVE-2026-41900 , CVE-2026-45087 , CVE-2026-49869 , CVE-2026-8985 , CVE-2021-21881 , CVE-2026-105691 , CVE-2026-105697 , CVE-2026-105740 , CVE-2026-34038 , CVE-2026-40933 , CVE-2026-42454 , CVE-2026-45629 , CVE-2026-45632 , CVE-2026-48030 , CVE-2026-57155 , CVE-2026-63298 , CVE-2026-72738 , CVE-2026-72740 , CVE-2026-72865 , CVE-2026-72868 , CVE-2026-72869 , CVE-2026-72872 , CVE-2026-72876 , CVE-2026-72882 , CVE-2026-72902 , CVE-2026-73263 , CVE-2026-73294 , CVE-2019-12725 , CVE-2019-12985 , CVE-2019-12986 , CVE-2019-7256 , CVE-2020-10987 , CVE-2020-17456 , CVE-2020-28188 , CVE-2020-29390 , CVE-2020-35476 , CVE-2020-9054 , CVE-2021-1498 , CVE-2021-32305 , CVE-2021-32682 , CVE-2021-33357 , CVE-2022-2486 , CVE-2022-46169 , CVE-2023-3368 , CVE-2023-46359 , CVE-2024-50603 , CVE-2025-66401 , CVE-2026-110392 , CVE-2026-12940 , CVE-2026-18482 , CVE-2026-34243 , CVE-2026-37281 , CVE-2026-42846 , CVE-2026-45018 , CVE-2026-45748 , CVE-2026-48687 , CVE-2026-49819 , CVE-2026-53545 , CVE-2026-57124 , CVE-2026-79408 , CVE-2026-35906 , CVE-2026-72878 , CVE-2026-8986 , CVE-2020-36856 , CVE-2025-66210 , CVE-2026-103056 , CVE-2026-47670 , CVE-2026-58146 , CVE-2026-63732 , CVE-2026-6644 , CVE-2026-72879 , CVE-2026-73483 , CVE-2009-20010 , CVE-2013-10049 , CVE-2025-34125 , CVE-2025-59735 , CVE-2025-59736 , CVE-2025-59737 , CVE-2025-59738 , CVE-2025-59739 , CVE-2025-59740 , CVE-2025-59741 , CVE-2025-71284 , CVE-2025-71336 , CVE-2025-71429 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-102240 , CVE-2026-105110 , CVE-2026-107780 , CVE-2026-108804 , CVE-2026-113802 , CVE-2026-19586 , CVE-2026-34106 , CVE-2026-34108 , CVE-2026-34109 , CVE-2026-34110 , CVE-2026-34111 , CVE-2026-34112 , CVE-2026-34115 , CVE-2026-41315 , CVE-2026-41923 , CVE-2026-41925 , CVE-2026-53975 , CVE-2026-58147 , CVE-2026-58457 , CVE-2026-60121 , CVE-2026-61498 , CVE-2026-63766 , CVE-2026-64625 , CVE-2026-67308 , CVE-2026-71921 , CVE-2026-71944 , CVE-2026-71945 , CVE-2026-71946 , CVE-2026-71947 , CVE-2026-71948 , CVE-2026-71949 , CVE-2026-71950 , CVE-2026-71951 , CVE-2026-71952 , CVE-2026-71953 , CVE-2026-71954 , CVE-2026-71955 , CVE-2026-71956 , CVE-2026-71984 , CVE-2026-71992 , CVE-2026-89308 , CVE-2026-41179 , CVE-2026-59800 , CVE-2026-63304 , CVE-2026-63305 , CVE-2026-80138 , CVE-2024-51092 , CVE-2025-66203 , CVE-2026-10131 , CVE-2026-10135 , CVE-2026-12486 , CVE-2026-12849 , CVE-2026-12850 , CVE-2026-12851 , CVE-2026-33568 , CVE-2026-35499 , CVE-2026-40627 , CVE-2026-57499 , CVE-2026-79766 , CVE-2026-79916 , CVE-2026-9814 , CVE-2013-5758 , CVE-2026-102608 , CVE-2026-45630 , CVE-2026-45750 , CVE-2026-91931 , CVE-2026-33765 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-73570 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9408 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9475 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2015-4117 , CVE-2017-18370 , CVE-2017-6884 , CVE-2018-8735 , CVE-2021-3577 , CVE-2023-30253 , CVE-2025-66209 , CVE-2026-105106 , CVE-2026-105797 , CVE-2026-110908 , CVE-2026-24893 , CVE-2026-26899 , CVE-2026-30971 , CVE-2026-34057 , CVE-2026-34153 , CVE-2026-34158 , CVE-2026-34197 , CVE-2026-34594 , CVE-2026-34599 , CVE-2026-35196 , CVE-2026-35519 , CVE-2026-35520 , CVE-2026-41208 , CVE-2026-45578 , CVE-2026-45662 , CVE-2026-52483 , CVE-2026-52484 , CVE-2026-54149 , CVE-2026-58195 , CVE-2026-59734 , CVE-2026-72875 , CVE-2026-73222 , CVE-2026-77601 , CVE-2026-79423 , CVE-2026-82804 , CVE-2005-10004 , CVE-2015-10145 , CVE-2024-58294 , CVE-2025-30007 , CVE-2025-34115 , CVE-2025-34311 , CVE-2025-34312 , CVE-2025-34334 , CVE-2026-100852 , CVE-2026-112351 , CVE-2026-28797 , CVE-2026-34791 , CVE-2026-34792 , CVE-2026-34793 , CVE-2026-34794 , CVE-2026-34795 , CVE-2026-34796 , CVE-2026-34797 , CVE-2026-46746 , CVE-2026-58000 , CVE-2026-58452 , CVE-2026-64837 , CVE-2026-69096 , CVE-2026-71966 , CVE-2026-72870 , CVE-2026-72874 , CVE-2026-73680 , CVE-2026-7551 , CVE-2026-76060 , CVE-2026-79756 , CVE-2026-90770 , CVE-2026-92580 , CVE-2013-10061 , CVE-2013-20007 , CVE-2025-68700 , CVE-2026-100896 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-108894 , CVE-2026-109108 , CVE-2026-111214 , CVE-2026-111217 , CVE-2026-111218 , CVE-2026-113390 , CVE-2026-113506 , CVE-2026-22100 , CVE-2026-40187 , CVE-2026-53804 , CVE-2026-61517 , CVE-2026-63725 , CVE-2026-65711 , CVE-2026-67599 , CVE-2026-67608 , CVE-2026-71906 , CVE-2026-71907 , CVE-2026-71908 , CVE-2026-71913 , CVE-2026-71915 , CVE-2026-71918 , CVE-2026-71919 , CVE-2026-71923 , CVE-2026-71924 , CVE-2026-71925 , CVE-2026-71926 , CVE-2026-71927 , CVE-2026-71928 , CVE-2026-71929 , CVE-2026-71930 , CVE-2026-71931 , CVE-2026-71943 , CVE-2026-75121 , CVE-2026-75122 , CVE-2026-75123 , CVE-2026-80214 , CVE-2026-82692 , CVE-2026-84194 , CVE-2026-85223 , CVE-2026-86299 , CVE-2026-86733 , CVE-2026-90699 , CVE-2026-101009 , CVE-2026-82690 , CVE-2026-82691 , CVE-2026-85222 , CVE-2026-85224 , CVE-2026-90702 , CVE-2026-90703 , CVE-2026-92397 , CVE-2026-92398 , CVE-2026-55786 , CVE-2024-58274 , CVE-2025-69755 , CVE-2026-48695 , CVE-2026-55173 , CVE-2026-52831 , CVE-2026-79755 , CVE-2018-15710 , CVE-2018-6222 , CVE-2021-21315 , CVE-2026-108161 , CVE-2026-40519 , CVE-2026-57999 , CVE-2013-6041 , CVE-2026-53534 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2019-11539 , CVE-2021-33544 , CVE-2025-58034 , CVE-2025-58763 , CVE-2026-71284 , CVE-2026-81669 , CVE-2026-92263 , CVE-2026-48997 , CVE-2026-58502 , CVE-2024-9474 , CVE-2026-19983 , CVE-2026-79761 , CVE-2026-55679 , CVE-2026-72739 , CVE-2026-45626 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7062 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90619 , CVE-2026-90690 , CVE-2026-90843 , CVE-2024-7120 , CVE-2026-15485 , CVE-2026-5547 , CVE-2026-42201 , CVE-2025-11138 , CVE-2025-11490 , CVE-2025-14204 , CVE-2026-101859 , CVE-2026-10279 , CVE-2026-102906 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-13560 , CVE-2026-13561 , CVE-2026-13581 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7600 , CVE-2026-7642 , CVE-2026-7653 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-8264 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9343 , CVE-2026-9347 , CVE-2026-9424 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-8259 , CVE-2026-8265 , CVE-2026-82678 , CVE-2026-82702 , CVE-2026-82703 , CVE-2026-85040 , CVE-2026-90705 , CVE-2026-90706 , CVE-2026-90788 , CVE-2026-5621
CWE-79	CVE-2026-73041 , CVE-2026-73042 , CVE-2026-48768 , CVE-2026-64638 , CVE-2024-39024 , CVE-2026-8071 , CVE-2026-104078 , CVE-2025-47783 , CVE-2025-14701 , CVE-2024-55890 , CVE-2025-61224 , CVE-2014-4558 , CVE-2016-8527 , CVE-2017-3132 , CVE-2017-3133 , CVE-2019-11398 , CVE-2019-14950 , CVE-2019-17504 , CVE-2019-7438 , CVE-2020-13483 , CVE-2021-24235 , CVE-2021-24495 , CVE-2021-25161 , CVE-2021-42551 , CVE-2022-0346 , CVE-2022-29296 , CVE-2023-41425 , CVE-2023-44012 , CVE-2024-24494 , CVE-2024-29931 , CVE-2025-25296 , CVE-2014-8674 , CVE-2017-3131 , CVE-2018-6226 , CVE-2018-6227 , CVE-2020-24963 , CVE-2025-52367 , CVE-2026-58391 , CVE-2025-59751 , CVE-2025-59752 , CVE-2025-59753 , CVE-2025-59754 , CVE-2025-59759 , CVE-2025-59773 , CVE-2025-59774 , CVE-2016-4807 , CVE-2018-1002001 , CVE-2018-1002002 , CVE-2018-1002003 , CVE-2018-1002004 , CVE-2018-1002005 , CVE-2018-1002006 , CVE-2018-1002007 , CVE-2018-1002008 , CVE-2018-1002009 , CVE-2019-19742 , CVE-2020-35241 , CVE-2012-0782 , CVE-2013-6042 , CVE-2014-1944 , CVE-2015-2275 , CVE-2015-4665 , CVE-2026-36239 , CVE-2026-10529
CWE-83	CVE-2026-58391
CWE-88	CVE-2026-57572 , CVE-2026-113708 , CVE-2026-44450 , CVE-2026-73294 , CVE-2020-21224 , CVE-2026-100714 , CVE-2026-108963 , CVE-2026-107639 , CVE-2020-5792 , CVE-2026-47250
CWE-89	CVE-2011-1653 , CVE-2014-3828 , CVE-2025-57819 , CVE-2026-55634 , CVE-2012-2576 , CVE-2014-8673 , CVE-2016-2555 , CVE-2017-17731 , CVE-2017-8917 , CVE-2018-11535 , CVE-2018-6228 , CVE-2018-6229 , CVE-2018-7282 , CVE-2018-7538 , CVE-2018-8733 , CVE-2018-8734 , CVE-2020-7356 , CVE-2021-42325 , CVE-2022-45297 , CVE-2024-39907 , CVE-2024-43917 , CVE-2024-5827 , CVE-2025-24799 , CVE-2026-38428 , CVE-2026-33324 , CVE-2013-10033 , CVE-2026-34612 , CVE-2022-34876 , CVE-2022-34877 , CVE-2022-34878 , CVE-2023-49085 , CVE-2023-7137 , CVE-2015-4669 , CVE-2026-32271 , CVE-2011-4448 , CVE-2013-5694 , CVE-2014-9215 , CVE-2014-9566 , CVE-2015-1518 , CVE-2015-2824 , CVE-2015-7387 , CVE-2022-24265 , CVE-2018-1002000 , CVE-2020-14295 , CVE-2023-1211 , CVE-2018-6230 , CVE-2012-2962 , CVE-2013-5015 , CVE-2014-4977 , CVE-2026-55679 , CVE-2026-60137 , CVE-2026-61852 , CVE-2025-6095 , CVE-2026-112252 , CVE-2026-14700 , CVE-2026-5736 , CVE-2026-9474 , CVE-2023-7299 , CVE-2026-19785 , CVE-2025-11902 , CVE-2025-11903
CWE-91	CVE-2020-0646 , CVE-2023-46214 , CVE-2026-89247
CWE-93	CVE-2026-84372 , CVE-2026-35519 , CVE-2026-35520 , CVE-2026-111221
CWE-94	CVE-2014-3829 , CVE-2022-22947 , CVE-2022-24816 , CVE-2025-49132 , CVE-2026-10134 , CVE-2026-26216 , CVE-2026-41900 , CVE-2026-45829 , CVE-2026-47668 , CVE-2026-57572 , CVE-2026-8984 , CVE-2025-11539 , CVE-2026-46512 , CVE-2026-55565 , CVE-2026-55634 , CVE-2026-8481 , CVE-2012-0391 , CVE-2016-5734 , CVE-2018-1273 , CVE-2018-17173 , CVE-2019-13372 , CVE-2020-8518 , CVE-2022-22954 , CVE-2022-29078 , CVE-2022-42889 , CVE-2023-30145 , CVE-2023-41892 , CVE-2024-32641 , CVE-2024-36401 , CVE-2024-37014 , CVE-2024-45507 , CVE-2025-29306 , CVE-2025-3248 , CVE-2025-62521 , CVE-2025-65719 , CVE-2025-67489 , CVE-2026-104586 , CVE-2026-116692 , CVE-2026-30993 , CVE-2026-31040 , CVE-2026-38431 , CVE-2026-3960 , CVE-2026-46562 , CVE-2026-51861 , CVE-2026-51866 , CVE-2026-51881 , CVE-2026-51886 , CVE-2026-51911 , CVE-2026-55559 , CVE-2026-57131 , CVE-2026-62379 , CVE-2026-67827 , CVE-2026-67919 , CVE-2026-75031 , CVE-2026-75411 , CVE-2026-75414 , CVE-2026-79538 , CVE-2026-83627 , CVE-2026-86793 , CVE-2026-88393 , CVE-2026-93674 , CVE-2026-48519 , CVE-2026-70477 , CVE-2026-88062 , CVE-2024-9264 , CVE-2025-34074 , CVE-2025-62593 , CVE-2026-45272 , CVE-2026-55413 , CVE-2026-69256 , CVE-2026-82244 , CVE-2026-93985 , CVE-2017-20251 , CVE-2018-25114 , CVE-2018-25357 , CVE-2025-71243 , CVE-2026-108598 , CVE-2026-12257 , CVE-2026-27174 , CVE-2026-65008 , CVE-2026-70553 , CVE-2026-96754 , CVE-2026-114053 , CVE-2026-27760 , CVE-2026-41179 , CVE-2026-82531 , CVE-2026-37637 , CVE-2026-42555 , CVE-2026-46621 , CVE-2026-55511 , CVE-2026-58256 , CVE-2026-58400 , CVE-2026-14602 , CVE-2026-42238 , CVE-2026-47252 , CVE-2026-62674 , CVE-2026-69251 , CVE-2026-73485 , CVE-2026-73486 , CVE-2026-73487 , CVE-2026-43945 , CVE-2026-77956 , CVE-2017-9822 , CVE-2020-8163 , CVE-2023-43661 , CVE-2025-66438 , CVE-2026-104851 , CVE-2026-34197 , CVE-2026-4327 , CVE-2026-45505 , CVE-2026-48017 , CVE-2026-55585 , CVE-2026-62675 , CVE-2026-6543 , CVE-2026-65660 , CVE-2026-78834 , CVE-2026-96795 , CVE-2021-47938 , CVE-2021-47939 , CVE-2022-50944 , CVE-2025-66474 , CVE-2026-100856 , CVE-2026-100864 , CVE-2026-109308 , CVE-2026-116811 , CVE-2026-28797 , CVE-2026-34965 , CVE-2026-47722 , CVE-2026-49143 , CVE-2026-55094 , CVE-2026-64850 , CVE-2026-69100 , CVE-2026-72819 , CVE-2026-76836 , CVE-2026-82278 , CVE-2026-85604 , CVE-2026-85610 , CVE-2026-86732 , CVE-2026-42785 , CVE-2026-54710 , CVE-2026-56382 , CVE-2026-56703 , CVE-2026-61523 , CVE-2026-65693 , CVE-2026-69088 , CVE-2026-22244 , CVE-2026-42588 , CVE-2026-47398 , CVE-2026-71320 , CVE-2026-105764 , CVE-2026-66738 , CVE-2005-1921 , CVE-2006-0887 , CVE-2013-1349 , CVE-2013-1412 , CVE-2026-46581 , CVE-2024-11740 , CVE-2025-68619 , CVE-2026-108593 , CVE-2019-0193 , CVE-2023-24955 , CVE-2025-62429 , CVE-2026-13392 , CVE-2026-77939 , CVE-2026-116253 , CVE-2026-5739 , CVE-2015-5603 , CVE-2026-55679 , CVE-2026-63432 , CVE-2026-44287 , CVE-2025-13786 , CVE-2025-13792 , CVE-2026-3395 , CVE-2026-54611 , CVE-2026-5631 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2014-8677 , CVE-2025-10097 , CVE-2025-11344 , CVE-2026-29202 , CVE-2026-112949 , CVE-2025-11905 , CVE-2025-12266 , CVE-2026-101861 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-15512 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-6125 , CVE-2026-7508 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-14729 , CVE-2025-14730 , CVE-2025-14837 , CVE-2025-15130 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-90709 , CVE-2026-94103 , CVE-2026-10529 , CVE-2026-113388 , CVE-2026-108827
CWE-95	CVE-2024-36401 , CVE-2024-7954 , CVE-2026-46562 , CVE-2026-47391 , CVE-2026-39932 , CVE-2025-31114 , CVE-2026-61511 , CVE-2025-66474 , CVE-2026-55094 , CVE-2026-40187 , CVE-2025-48868 , CVE-2026-101861
CWE-96	CVE-2025-7825
CWE-98	CVE-2024-9193 , CVE-2026-39353 , CVE-2023-49084
CWE-112	CVE-2025-68493
CWE-116	CVE-2026-112949
CWE-119	CVE-2021-1472
CWE-120	CVE-2026-36796
CWE-121	CVE-2022-20705 , CVE-2026-76070 , CVE-2026-76071 , CVE-2026-36783 , CVE-2022-20707
CWE-144	CVE-2025-24367
CWE-183	CVE-2026-16129
CWE-184	CVE-2026-49869 , CVE-2024-5217 , CVE-2026-41934 , CVE-2026-44287 , CVE-2026-16129
CWE-187	CVE-2026-35031
CWE-200	CVE-2025-11749 , CVE-2021-32819 , CVE-2025-69755 , CVE-2016-3473 , CVE-2014-8675 , CVE-2016-4806 , CVE-2018-8033 , CVE-2026-51078 , CVE-2025-34098 , CVE-2026-63432 , CVE-2025-13439 , CVE-2015-2826 , CVE-2011-4898 , CVE-2013-6043 , CVE-2015-0922
CWE-250	CVE-2026-41900 , CVE-2026-9209 , CVE-2026-55094
CWE-253	CVE-2026-15686
CWE-255	CVE-2009-4188 , CVE-2009-4189 , CVE-2013-5755 , CVE-2009-3548 , CVE-2010-0557 , CVE-2010-4094
CWE-264	CVE-2009-3843 , CVE-2015-7766 , CVE-2014-2268
CWE-266	CVE-2026-101860
CWE-269	CVE-2026-45632 , CVE-2020-3243 , CVE-2020-3250 , CVE-2026-104798 , CVE-2026-49819 , CVE-2026-40484 , CVE-2026-76801 , CVE-2026-72830 , CVE-2026-73664 , CVE-2026-101860
CWE-276	CVE-2025-34332 , CVE-2025-34333
CWE-284	CVE-2026-34234 , CVE-2026-41900 , CVE-2019-2729 , CVE-2023-27350 , CVE-2026-50006 , CVE-2026-43945 , CVE-2023-26360 , CVE-2026-73664 , CVE-2014-3120 , CVE-2026-11344 , CVE-2014-8677 , CVE-2025-63739 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-285	CVE-2026-34239
CWE-287	CVE-2026-49869 , CVE-2013-1359 , CVE-2019-13372 , CVE-2019-1937 , CVE-2021-1472 , CVE-2021-25281 , CVE-2025-61882 , CVE-2013-4863 , CVE-2025-27621 , CVE-2023-0905 , CVE-2026-7630
CWE-288	CVE-2025-57819 , CVE-2026-20079 , CVE-2026-43945
CWE-290	CVE-2022-24112 , CVE-2024-4358
CWE-295	CVE-2018-6221 , CVE-2018-6219
CWE-303	CVE-2023-29357
CWE-305	CVE-2026-81578
CWE-306	CVE-2024-46506 , CVE-2025-34073 , CVE-2026-45087 , CVE-2026-81735 , CVE-2018-6223 , CVE-2025-3248 , CVE-2026-47391 , CVE-2026-49819 , CVE-2026-57124 , CVE-2026-57131 , CVE-2026-53649 , CVE-2026-88062 , CVE-2014-125113 , CVE-2014-125116 , CVE-2024-0012 , CVE-2026-105110 , CVE-2026-9209 , CVE-2026-41179 , CVE-2026-73222 , CVE-2023-54350 , CVE-2025-34115 , CVE-2026-55094 , CVE-2026-63722 , CVE-2026-55786 , CVE-2026-49471 , CVE-2025-71257 , CVE-2026-112949
CWE-310	CVE-2014-8684 , CVE-2014-8686
CWE-321	CVE-2026-89026
CWE-326	CVE-2018-15811 , CVE-2018-18325
CWE-327	CVE-2014-8687
CWE-350	CVE-2026-97875
CWE-352	CVE-2026-53649 , CVE-2025-62593 , CVE-2016-4808 , CVE-2018-11442 , CVE-2018-11445 , CVE-2018-6224 , CVE-2018-7700 , CVE-2020-5776 , CVE-2026-73222 , CVE-2026-34228 , CVE-2025-12061 , CVE-2026-49471 , CVE-2014-100005 , CVE-2011-4452 , CVE-2013-5696 , CVE-2013-4865
CWE-361	CVE-2016-7547
CWE-362	CVE-2026-42099
CWE-424	CVE-2025-48827 , CVE-2025-48828
CWE-425	CVE-2019-17503
CWE-434	CVE-2015-8249 , CVE-2016-15043 , CVE-2020-25213 , CVE-2022-44276 , CVE-2024-23759 , CVE-2025-7441 , CVE-2026-103889 , CVE-2026-72592 , CVE-2026-107188 , CVE-2026-53649 , CVE-2009-20006 , CVE-2014-125113 , CVE-2014-125116 , CVE-2018-25114 , CVE-2024-58348 , CVE-2026-35047 , CVE-2026-44402 , CVE-2023-7305 , CVE-2026-40484 , CVE-2026-50006 , CVE-2026-58409 , CVE-2020-27386 , CVE-2020-27387 , CVE-2020-28328 , CVE-2020-7246 , CVE-2021-42840 , CVE-2025-59710 , CVE-2025-65471 , CVE-2026-14498 , CVE-2026-17196 , CVE-2026-33704 , CVE-2021-47943 , CVE-2026-105123 , CVE-2026-34735 , CVE-2026-40488 , CVE-2026-67206 , CVE-2026-109397 , CVE-2026-23698 , CVE-2026-41587 , CVE-2026-53599 , CVE-2026-27891 , CVE-2026-11344 , CVE-2026-54611 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-436	CVE-2026-63030
CWE-470	CVE-2026-116692 , CVE-2026-46562 , CVE-2026-55559 , CVE-2026-62379 , CVE-2026-82078 , CVE-2026-58400 , CVE-2026-79987 , CVE-2025-68455 , CVE-2026-6020 , CVE-2026-34216
CWE-479	CVE-2026-44011
CWE-494	CVE-2026-66398 , CVE-2026-107812
CWE-502	CVE-2025-55182 , CVE-2026-45829 , CVE-2026-34838 , CVE-2015-8103 , CVE-2017-17672 , CVE-2018-1000861 , CVE-2018-19276 , CVE-2019-10068 , CVE-2019-17564 , CVE-2019-5434 , CVE-2022-47986 , CVE-2023-29300 , CVE-2023-38203 , CVE-2023-44353 , CVE-2024-2054 , CVE-2024-23759 , CVE-2024-8353 , CVE-2025-40551 , CVE-2025-66455 , CVE-2026-115806 , CVE-2026-3296 , CVE-2026-55573 , CVE-2025-34292 , CVE-2023-54398 , CVE-2025-25034 , CVE-2025-66571 , CVE-2026-10042 , CVE-2026-87930 , CVE-2026-47168 , CVE-2023-2288 , CVE-2024-1800 , CVE-2026-113779 , CVE-2026-8365 , CVE-2025-71260 , CVE-2026-71981 , CVE-2026-29001 , CVE-2026-93872 , CVE-2025-63950 , CVE-2025-63951 , CVE-2026-12720 , CVE-2026-61686 , CVE-2023-0669 , CVE-2026-29782 , CVE-2026-97865 , CVE-2026-16297 , CVE-2023-3360 , CVE-2026-90575 , CVE-2025-15438
CWE-522	CVE-2025-34078
CWE-552	CVE-2026-40484
CWE-601	CVE-2015-4668
CWE-610	CVE-2025-10091 , CVE-2025-10816 , CVE-2025-11035 , CVE-2025-13209
CWE-611	CVE-2017-12629 , CVE-2019-9670 , CVE-2022-28219 , CVE-2024-34102 , CVE-2020-24589 , CVE-2016-8526 , CVE-2026-41936 , CVE-2026-69101 , CVE-2025-68493 , CVE-2026-54640 , CVE-2022-38840 , CVE-2024-6893 , CVE-2025-10091 , CVE-2025-10816 , CVE-2018-6225 , CVE-2025-11035 , CVE-2025-13209
CWE-639	CVE-2026-72876 , CVE-2026-45750
CWE-641	CVE-2026-46581
CWE-644	CVE-2026-67179
CWE-669	CVE-2026-38924
CWE-693	CVE-2026-41900 , CVE-2025-40536 , CVE-2026-39353 , CVE-2026-84317 , CVE-2026-84318
CWE-697	CVE-2024-5217
CWE-732	CVE-2017-20198 , CVE-2026-39353 , CVE-2026-73664
CWE-787	CVE-2022-20705 , CVE-2022-20707 , CVE-2024-2961
CWE-791	CVE-2025-14731 , CVE-2026-103540 , CVE-2026-78140
CWE-798	CVE-2015-4667 , CVE-2017-18371 , CVE-2019-16399 , CVE-2019-1935
CWE-829	CVE-2020-16152 , CVE-2026-0770 , CVE-2025-34074 , CVE-2026-45272 , CVE-2026-47398
CWE-835	CVE-2024-20353
CWE-862	CVE-2019-15954 , CVE-2026-45632 , CVE-2026-72868 , CVE-2026-72876 , CVE-2026-79920 , CVE-2026-49819 , CVE-2026-57131 , CVE-2026-41315 , CVE-2026-50006 , CVE-2025-10706 , CVE-2026-14357 , CVE-2025-12061 , CVE-2026-86438 , CVE-2026-96896 , CVE-2025-11372 , CVE-2025-67737
CWE-863	CVE-2022-46169 , CVE-2023-22518 , CVE-2024-6782 , CVE-2026-43945 , CVE-2021-3577 , CVE-2026-105797 , CVE-2026-76836 , CVE-2026-86437 , CVE-2013-4862
CWE-913	CVE-2026-34156
CWE-915	CVE-2026-72710 , CVE-2026-78416
CWE-917	CVE-2022-22947 , CVE-2010-1871
CWE-918	CVE-2026-49869 , CVE-2013-4864 , CVE-2021-22175 , CVE-2021-22986 , CVE-2021-32682 , CVE-2024-45507 , CVE-2026-34367 , CVE-2026-56739 , CVE-2019-9621
CWE-942	CVE-2026-34449 , CVE-2026-53649
CWE-1188	CVE-2026-47668 , CVE-2026-104078
CWE-1286	CVE-2024-7954
CWE-1287	CVE-2024-4879
CWE-1336	CVE-2026-44181 , CVE-2026-55559 , CVE-2025-66438 , CVE-2026-104851 , CVE-2026-105985 , CVE-2026-28797 , CVE-2026-72827 , CVE-2026-75574 , CVE-2026-22244 , CVE-2026-77939 , CVE-2025-14731 , CVE-2026-103540 , CVE-2026-78140
CWE-1392	CVE-2026-41939

Atomicorp WAF Rule 344370

Rule Summary

Description

Selected Related CVEs

Observed CWEs