On this page

Atomicorp WAF Rule 393655

Rule Summary

Rule ID: 393655
Status: Active
Alert message: Atomicorp.com WAF Rules: Possible Remote Command Execution: Unix Shell Expression Found
Observed CWEs: CWE-15 (1), CWE-19 (1), CWE-20 (16), CWE-22 (26), CWE-59 (2), CWE-73 (6), CWE-74 (55), CWE-77 (229), CWE-78 (480), CWE-79 (16), CWE-83 (1), CWE-88 (9), CWE-89 (20), CWE-93 (4), CWE-94 (168), CWE-95 (10), CWE-98 (1), CWE-116 (3), CWE-120 (1), CWE-121 (3), CWE-183 (1), CWE-184 (4), CWE-187 (1), CWE-200 (2), CWE-250 (3), CWE-253 (1), CWE-266 (1), CWE-269 (8), CWE-276 (2), CWE-284 (13), CWE-285 (2), CWE-287 (5), CWE-288 (2), CWE-305 (1), CWE-306 (23), CWE-350 (1), CWE-352 (6), CWE-362 (1), CWE-400 (1), CWE-434 (33), CWE-470 (8), CWE-479 (1), CWE-494 (2), CWE-502 (2), CWE-552 (1), CWE-639 (2), CWE-641 (1), CWE-644 (1), CWE-647 (1), CWE-669 (1), CWE-693 (4), CWE-732 (2), CWE-791 (2), CWE-829 (2), CWE-835 (1), CWE-836 (1), CWE-862 (12), CWE-863 (4), CWE-913 (1), CWE-915 (2), CWE-917 (4), CWE-918 (3), CWE-942 (2), CWE-1188 (1), CWE-1336 (13), CWE-1392 (1)
Revision: 17
Phase: 2 (request body)
Request surfaces: Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data, XML request data
Rule action: deny
HTTP status: 403
Public tags: attack-rce
Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Possible Remote Command Execution: Unix Shell Expression Found” in the request cookies, request argument names, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2004-1037	TWiki Search Function Arbitrary Command Execution	twiki	10.0 (v2.0)	High
CVE-2011-10017	Snortreport nmap.php/nbtscan.php Remote Command Execution	Snort Report	10.0 (v4.0)	Critical
CVE-2013-10070	PHP-Charts v1.0 PHP Code Execution Vulnerability	PHP-Charts	10.0 (v4.0)	Critical
CVE-2017-6326	Symantec Messaging Gateway Remote Code Execution	messaging gateway	10.0 (v3.0)	Critical
CVE-2021-44228	Apache Log4j2 lookup feature JNDI injection (CVE-2021-44228)	6bk1602-0aa12-0tp0 firmware	10.0 (v3.1)	Critical
CVE-2022-22947	Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947)	spring cloud gateway	10.0 (v3.1)	Critical
CVE-2024-13984	Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload	TianQing Management Center	10.0 (v4.0)	Critical
CVE-2025-34037	Linksys E-Series TheMoon Remote Command Injection	E4200	10.0 (v4.0)	Critical
CVE-2025-55182	React Server Components Flight Protocol Deserialization RCE (CVE-2025-55182)	react	10.0 (v3.1)	Critical
CVE-2026-100382	Unauthenticated remote code execution through wikitext in ExternalData	Mediawiki - ExternalData Extension	10.0 (v4.0)	Critical
CVE-2026-10134	Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows	langflow	10.0 (v3.1)	Critical
CVE-2026-105134	Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection	cloud backup suite	10.0 (v4.0)	Critical
CVE-2026-108576	TOZED X300 IPPingDiagnostics process_ping os command injection	X300	10.0 (v4.0)	Critical
CVE-2026-19188	Haiwell IoT Cloud HMI Gateway OS Command Injection	Haiwell IoT Cloud HMI Gateway	10.0 (v4.0)	Critical
CVE-2026-26015	Unauthenticated RCE in DocsGPT MCP STDIO Configuration	docsgpt	10.0 (v4.0)	Critical
CVE-2026-34234	CtrlPanel <= 1.1.1 - Remote Code Execution	ctrlpanel	10.0 (v3.1)	Critical
CVE-2026-41900	OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment	openlearnx	10.0 (v3.1)	Critical
CVE-2026-44181	Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution	enterprise gateway	10.0 (v4.0)	Critical
CVE-2026-45087	Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode	dalfox	10.0 (v3.1)	Critical
CVE-2026-49869	Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`	kestra	10.0 (v3.1)	Critical
CVE-2026-53753	Crawl4AI <= 0.8.6 - Remote Code Execution	crawl4ai	10.0 (v3.1)	Critical
CVE-2026-57572	Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args	crawl4ai	10.0 (v3.1)	Critical
CVE-2026-7411	Eclipse BaSyx Arbitrary Code Execution Vulnerability	Eclipse BaSyx	10.0 (v3.1)	Critical
CVE-2026-81735	UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Executi	UI-TARS-desktop	10.0 (v4.0)	Critical
CVE-2026-8984	Unauthenticated RCE	maxicharger single charger firmware	10.0 (v4.0)	Critical
CVE-2025-11539	Arbitrary Code Execution in Grafana Image Renderer Plugin	grafana-image-renderer	9.9 (v3.1)	Critical
CVE-2026-105691	Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color	penpot	9.9 (v3.1)	Critical
CVE-2026-105697	Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration	langflow	9.9 (v3.1)	Critical
CVE-2026-105740	Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server	langflow	9.9 (v3.1)	Critical
CVE-2026-113708	Argo CD: A Kustomize remote ref can run commands in the repo-server	argo-cd	9.9 (v3.1)	Critical
CVE-2026-34038	Coolify authenticated remote command injection leading to RCE and secret exfiltration	coolify	9.9 (v3.1)	Critical
CVE-2026-40933	Flowise: Authenticated RCE Via MCP Adapters	flowise	9.9 (v3.1)	Critical
CVE-2026-42454	Termix: OS Command Injection in Docker Container Management Endpoints	Termix	9.9 (v3.1)	Critical
CVE-2026-44450	Lumiverse: RCE via MCP stdio argument injection	Lumiverse	9.9 (v3.1)	Critical
CVE-2026-45629	Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint	dokploy	9.9 (v3.1)	Critical
CVE-2026-45632	Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution	dokploy	9.9 (v3.1)	Critical
CVE-2026-46512	Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping	frogman	9.9 (v3.1)	Critical
CVE-2026-48030	Pheditor 2.0.1-2.0.3 - OS Command Injection	pheditor	9.9 (v3.1)	Critical
CVE-2026-55565	Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)	yamcs	9.9 (v3.1)	Critical
CVE-2026-55634	Pimcore: Remote Code Execution via DataObject Class-Definition Field Name	pimcore	9.9 (v3.1)	Critical
CVE-2026-57155	OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer	core	9.9 (v3.1)	Critical
CVE-2026-63298	LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration	lxd	9.9 (v3.1)	Critical
CVE-2026-72738	Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter	dokploy	9.9 (v3.1)	Critical
CVE-2026-72740	Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`	dokploy	9.9 (v3.1)	Critical
CVE-2026-72865	Dokploy: OS Command Injection via compose `composePath`	dokploy	9.9 (v3.1)	Critical
CVE-2026-72868	Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection	dokploy	9.9 (v3.1)	Critical
CVE-2026-72869	Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE	dokploy	9.9 (v3.1)	Critical
CVE-2026-72872	Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`	dokploy	9.9 (v3.1)	Critical
CVE-2026-72876	Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*	dokploy	9.9 (v3.1)	Critical
CVE-2026-72882	Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers	dokploy	9.9 (v3.1)	Critical
CVE-2026-72902	Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById	dokploy	9.9 (v3.1)	Critical
CVE-2026-73263	Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path	prowler	9.9 (v3.1)	Critical
CVE-2026-73294	Semaphore U: OS Command Injection	semaphore	9.9 (v3.1)	Critical
CVE-2026-79920	Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task	ajenti	9.9 (v3.1)	Critical
CVE-2026-8481	Remote Code Execution via Code Validation Endpoint	langflow	9.9 (v3.1)	Critical
CVE-2013-2251	Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution	archiva	9.8 (v3.1)	Critical
CVE-2015-1187	D-Link/TRENDnet NCC Service Command Injection	dir-626l firmware	9.8 (v3.1)	Critical
CVE-2017-14706	DenyAll Web Application Firewall Remote Code Execution	i-suite	9.8 (v3.0)	Critical
CVE-2017-17105	Zivif Camera iptest.cgi Blind Remote Command Execution	pr115-204-p-rs firmware	9.8 (v3.0)	Critical
CVE-2018-12464	MicroFocus Secure Messaging Gateway Remote Code Execution	secure messaging gateway	9.8 (v3.0)	Critical
CVE-2018-7890	ManageEngine Applications Manager Remote Code Execution	manageengine applications manager	9.8 (v3.0)	Critical
CVE-2019-12780	Belkin Wemo UPnP Remote Code Execution	crock-pot smart slow cooker with wemo firmware	9.8 (v3.0)	Critical
CVE-2019-12988	Citrix SD-WAN Center - Remote Command Injection	netscaler sd-wan	9.8 (v3.0)	Critical
CVE-2019-2729	Oracle WebLogic Server Administration Console - Remote Code Execution	communications diameter signaling router	9.8 (v3.1)	Critical
CVE-2019-3396	Atlassian Confluence Widget Connector Macro Velocity Template Injection	confluence server	9.8 (v3.1)	Critical
CVE-2020-11546	SuperWebmailer 7.21.0.01526 - Remote Code Execution	superwebmailer	9.8 (v3.1)	Critical
CVE-2020-5722	Grandstream UCM62xx IP PBX sendPasswordEmail RCE	ucm6200 firmware	9.8 (v3.1)	Critical
CVE-2020-8644	PlaySMS index.php Unauthenticated Template Injection Code Execution	playsms	9.8 (v3.1)	Critical
CVE-2021-1497	Cisco HyperFlex HX Data Platform Command Execution	hyperflex hx data platform	9.8 (v3.1)	Critical
CVE-2021-1498	Cisco HyperFlex HX Data Platform Command Execution	hyperflex hx data platform	9.8 (v3.1)	Critical
CVE-2021-22986	F5 iControl REST Unauthenticated SSRF Token Generation RCE	big-ip access policy manager	9.8 (v3.1)	Critical
CVE-2021-32682	elFinder ZIP Arguments Injection Leads to Commands Injection (CVE-2021-32682)	elfinder	9.8 (v3.1)	Critical
CVE-2021-36260	Hikvision IP Camera Unauthenticated Command Injection	ds-2cd2026g2-iu/sl firmware	9.8 (v3.1)	Critical
CVE-2022-1388	F5 BIG-IP iControl RCE via REST Authentication Bypass	big-ip access policy manager	9.8 (v3.1)	Critical
CVE-2022-22954	VMware Workspace ONE Access CVE-2022-22954	identity manager	9.8 (v3.1)	Critical
CVE-2022-27927	Microfinance Management System 1.0 - 'customer_number' SQLi	microfinance management system	9.8 (v3.1)	Critical
CVE-2022-29303	SolarView Compact 6.0 - OS Command Injection	sv-cpt-mc310 firmware	9.8 (v3.1)	Critical
CVE-2022-36446	Webmin Package Updates RCE	webmin	9.8 (v3.1)	Critical
CVE-2022-40032	Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)	simple task managing system	9.8 (v3.1)	Critical
CVE-2022-40347	Intern Record System v1.0 - SQL Injection (Unauthenticated)	intern record system	9.8 (v3.1)	Critical
CVE-2022-40881	SolarView 6.00 - Remote Command Execution	solarview compact	9.8 (v3.1)	Critical
CVE-2022-42889	Apache Commons Text RCE	commons text	9.8 (v3.1)	Critical
CVE-2022-43939	Pentaho Business Server Auth Bypass and Server Side Template Injection RCE	vantara pentaho business analytics server	9.8 (v3.1)	Critical
CVE-2022-44276	responsive filemanager Unrestricted Upload of File with Dangerous Type Vulnerability	responsive filemanager	9.8 (v3.1)	Critical
CVE-2022-44877	Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)	webpanel	9.8 (v3.1)	Critical
CVE-2023-22527	Atlassian Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2023-22527)	confluence data center	9.8 (v3.1)	Critical
CVE-2023-25717	Ruckus Wireless Admin - Remote Code Execution	ruckus wireless admin	9.8 (v3.1)	Critical
CVE-2023-26068	Lexmark Device Embedded Web Server RCE	cxtpc firmware	9.8 (v3.1)	Critical
CVE-2023-31465	TimeKeeper by FSMLabs - Remote Code Execution	timekeeper	9.8 (v3.1)	Critical
CVE-2023-3368	Chamilo LMS <= v1.11.20 Unauthenticated Command Injection	chamilo	9.8 (v3.1)	Critical
CVE-2023-34124	Sonicwall	analytics	9.8 (v3.1)	Critical
CVE-2023-34132	Sonicwall	analytics	9.8 (v3.1)	Critical
CVE-2023-4450	JeecgBoot JimuReport FreeMarker Server Side Template Injection RCE (CVE-2023-4450)	jimureport	9.8 (v3.1)	Critical
CVE-2023-46359	cPH2 Charging Station v1.87.0 - OS Command Injection	cph2 echarge	9.8 (v3.1)	Critical
CVE-2023-50917	MajorDoMo Command Injection	majordomo	9.8 (v3.1)	Critical
CVE-2024-2389	Flowmon Unauthenticated Command Injection	flowmon	9.8 (v3.1)	Critical
CVE-2024-32641	Masa CMS Vulnerable to Pre-Auth RCE via JSON API	masacms	9.8 (v3.1)	Critical
CVE-2024-50603	Aviatrix Controller - Remote Code Execution	controller	9.8 (v3.1)	Critical
CVE-2025-29306	FoxCMS v.1.2.5 - Remote Code Execution	foxcms	9.8 (v3.1)	Critical
CVE-2025-65719	Open Source Kubectl MCP Server v1.1.1 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2025-66401	MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL	mcp watch	9.8 (v3.1)	Critical
CVE-2026-103889	3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter	3D Product configurator for WooCommerce	9.8 (v3.1)	Critical
CVE-2026-104586	AUTOM8N (WHM/cPanel plugin) through commit 82821f7 Command Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-104798	My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'a	My Calendar – Accessible Event Manager	9.8 (v3.1)	Critical
CVE-2026-110392	Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning	QA-Board	9.8 (v3.1)	Critical
CVE-2026-12940	Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoint	langflow	9.8 (v3.1)	Critical
CVE-2026-15733	WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read	WGDashboard	9.8 (v3.1)	Critical
CVE-2026-18482	neo-mjs Command Injection Vulnerability	neo-mjs	9.8 (v3.1)	Critical
CVE-2026-30993	Slah CMS v1.5.0 and below Arbitrary Code Execution Vulnerability	Slah CMS v1.5.0 and below	9.8 (v3.1)	Critical
CVE-2026-31040	stata-mcp Code Injection Vulnerability	stata-mcp	9.8 (v3.1)	Critical
CVE-2026-35847	the CheckUils.php file Arbitrary Code Execution Vulnerability	the CheckUils.php file	9.8 (v3.1)	Critical
CVE-2026-37281	the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 Command Injection Vulnerability	the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0	9.8 (v3.1)	Critical
CVE-2026-38428	kestra SQL Injection Vulnerability	kestra	9.8 (v3.1)	Critical
CVE-2026-38431	erpnext Code Injection Vulnerability	erpnext	9.8 (v3.1)	Critical
CVE-2026-3960	Remote Code Execution in h2oai/h2o-3	h2o	9.8 (v3.1)	Critical
CVE-2026-4257	Supsystic Contact Form Wordpress Plugin SSTI RCE	Contact Form by Supsystic	9.8 (v3.1)	Critical
CVE-2026-42846	ClipBucket: Remote Play URL Command Injection	clipbucket-v5	9.8 (v3.1)	Critical
CVE-2026-45018	Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution	chainlit	9.8 (v3.1)	Critical
CVE-2026-45695	Kopia Server 0.23.0 - Remote Code Execution	kopia	9.8 (v3.1)	Critical
CVE-2026-45748	Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection	termix	9.8 (v3.1)	Critical
CVE-2026-46562	Yamcs: Remote Code Execution via Mission Database algorithm override	yamcs	9.8 (v3.1)	Critical
CVE-2026-47391	PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-48687	fastnetmon Command Injection Vulnerability	fastnetmon	9.8 (v3.1)	Critical
CVE-2026-49819	UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd	UpSnap	9.8 (v3.1)	Critical
CVE-2026-51861	bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-51866	Code Injection	-	9.8 (v3.1)	Critical
CVE-2026-51886	Arbitrary Code Execution	-	9.8 (v3.1)	Critical
CVE-2026-51911	vanna v2.0.2 Code Injection Vulnerability	vanna v2.0.2	9.8 (v3.1)	Critical
CVE-2026-53545	Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection	Termix	9.8 (v3.1)	Critical
CVE-2026-55559	Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)	yamcs	9.8 (v3.1)	Critical
CVE-2026-57124	PraisonAI UI MCP connect endpoint allows unauthenticated local command execution	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-57131	praisonai: Jobs API exposes agent-execution endpoints with no authentication	PraisonAI	9.8 (v3.1)	Critical
CVE-2026-62379	OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback	OpenAM	9.8 (v3.1)	Critical
CVE-2026-67827	Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-67919	Halo 2.25.4 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-72592	dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload	phpfm	9.8 (v3.1)	Critical
CVE-2026-75031	Interchange Arbitrary Code Execution Vulnerability	Interchange	9.8 (v3.1)	Critical
CVE-2026-75411	JeecgBoot v3.9.2 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-75414	In AntFlow V2.0.0, ActivitiTest.java Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-79408	MetaGPT 0.8.1 Command Injection Vulnerability	MetaGPT 0.8.1	9.8 (v3.1)	Critical
CVE-2026-79538	metatool-ai MetaMCP up to and including 2.4.22 Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-8037	Progress ADC LoadMaster - Command Injection	connection manager for objectscale	9.8 (v3.1)	Critical
CVE-2026-83627	Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via	Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals \| Critical CSS \| Minify CSS \| Defer CSS Javascript \| CDN	9.8 (v3.1)	Critical
CVE-2026-84372	Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections	predis	9.8 (v3.1)	Critical
CVE-2026-86793	SGLang Unsafe Deserialization Vulnerability	SGLang	9.8 (v3.1)	Critical
CVE-2026-88393	WookTeam 1.6.6 and Earlier Code Injection Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-107188	Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution	Archibus	9.6 (v3.1)	Critical
CVE-2026-34449	SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection	siyuan	9.6 (v3.1)	Critical
CVE-2026-35906	An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 OS Command Injection Vulnerability	-	9.6 (v3.1)	Critical
CVE-2026-48519	Langflow: Unauthenticated RCE in Shareable Playgrounds	langflow	9.6 (v3.1)	Critical
CVE-2026-53649	Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE	joro	9.6 (v3.1)	Critical
CVE-2026-72878	Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments	dokploy	9.6 (v3.1)	Critical
CVE-2026-70477	Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability	flowise	9.5 (v4.0)	Critical
CVE-2026-88062	OmniRoute < 3.8.49 - Unauthenticated RCE	OmniRoute	9.5 (v4.0)	Critical
CVE-2014-125118	eScan Web Management Console Command Injection	eScan Web Management Console	9.4 (v4.0)	Critical
CVE-2020-36856	Nagios XI < 5.6.14 Authenticated RCE command_test.php via address	nagios xi	9.4 (v4.0)	Critical
CVE-2025-34152	Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter	M300 Wi-Fi Repeater	9.4 (v4.0)	Critical
CVE-2025-62593	Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack	ray	9.4 (v4.0)	Critical
CVE-2025-66210	Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import	coolify	9.4 (v4.0)	Critical
CVE-2026-100714	Froxlor before 2.3.12 Command Injection via letsencryptchallengepath	froxlor	9.4 (v4.0)	Critical
CVE-2026-103056	AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR	AiSOC	9.4 (v4.0)	Critical
CVE-2026-33324	SQLBot prompt injection allows arbitrary SQL execution and remote code execution	sqlbot	9.4 (v4.0)	Critical
CVE-2026-39932	OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection	openemr	9.4 (v4.0)	Critical
CVE-2026-45272	MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File	talebook	9.4 (v4.0)	Critical
CVE-2026-47670	DbGate - Remote Code Execution via Dynamic Import Bypass	dbgate	9.4 (v4.0)	Critical
CVE-2026-55413	ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution	ToolJet	9.4 (v4.0)	Critical
CVE-2026-58146	Unauthorized remote code execution in T-Mobile 5G Box IDU routers	T-Mobile 5G Box IDU	9.4 (v4.0)	Critical
CVE-2026-63732	9router before 0.4.60 Remote Code Execution via default password	9router	9.4 (v4.0)	Critical
CVE-2026-66398	phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API	phpMyFAQ	9.4 (v4.0)	Critical
CVE-2026-6644	A command injection vulnerability was found in the PPTP VPN Clients on the ADM	data master	9.4 (v4.0)	Critical
CVE-2026-69256	Flowise: Remote Code Execution Vulnerability in CSVAgent	flowise	9.4 (v4.0)	Critical
CVE-2026-72879	Dokploy: Command Injection via Registry Credentials in Swarm Upload	dokploy	9.4 (v4.0)	Critical
CVE-2026-73041	SiYuan before v3.7.4 Remote Code Execution via PDF Annotations	siyuan	9.4 (v4.0)	Critical
CVE-2026-73042	SiYuan before v3.7.4 Remote Code Execution via Menu Metadata	siyuan	9.4 (v4.0)	Critical
CVE-2026-73483	Flowise before 3.1.3 Sandbox Escape via Puppeteer	flowise	9.4 (v4.0)	Critical
CVE-2026-82244	Budibase before 3.41.3 Remote Code Execution via Plugin eval()	server	9.4 (v4.0)	Critical
CVE-2026-93985	OpenPanel js-runtime JavaScript Template Sandbox Escape RCE	openpanel	9.4 (v4.0)	Critical
CVE-2009-20006	osCommerce 2.2 Arbitrary PHP Code Execution	osCommerce	9.3 (v4.0)	Critical
CVE-2009-20010	Dogfood CRM spell.php RCE	Dogfood CRM	9.3 (v4.0)	Critical
CVE-2019-25687	Pegasus CMS 1.0 Remote Code Execution via extra_fields.php	pegasus cms	9.3 (v4.0)	Critical
CVE-2024-58348	WordPress Background Image Cropper 1.2 Remote Code Execution	Background Image Cropper	9.3 (v4.0)	Critical
CVE-2025-10364	Unauthenticated Arbitrary Command Injection in Evertz SDVN	3080ipx-10G	9.3 (v4.0)	Critical
CVE-2025-2611	ICTBroadcast - Command Injection	ICTBroadcast	9.3 (v4.0)	Critical
CVE-2025-31114	Fooocus webui vulnerable to Remote Code Execution	Fooocus	9.3 (v4.0)	Critical
CVE-2025-32778	Web-Check < 2.0.1 Screenshot API - OS Command Injection	web-check	9.3 (v4.0)	Critical
CVE-2025-34102	Crypttech CryptoLog Remote Code Execution	CryptoLog	9.3 (v4.0)	Critical
CVE-2025-59735	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59736	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59737	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59738	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59739	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59740	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-59741	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	9.3 (v4.0)	Critical
CVE-2025-71284	Synway SMG Gateway Management Software OS Command Injection via radius_address	smg gateway management software	9.3 (v4.0)	Critical
CVE-2025-71336	Flowise - Unsandboxed Remote Code Execution via Custom MCP	flowise	9.3 (v4.0)	Critical
CVE-2025-71429	GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py	GPT-SoVITS	9.3 (v4.0)	Critical
CVE-2026-101001	Netcore NBR200V2 Web Management network_tools eval os command injection	NBR200V2	9.3 (v4.0)	Critical
CVE-2026-101072	Netcore NR289-GE CGI ap_ip.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-101075	Netcore NR289-GE Location Time location_time.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-101076	Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection	NR289-GE	9.3 (v4.0)	Critical
CVE-2026-102240	Netcore NAP930 Network Tools CGI network_tools eval os command injection	NAP930	9.3 (v4.0)	Critical
CVE-2026-105110	Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter	Innbox	9.3 (v4.0)	Critical
CVE-2026-107780	Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter	skyeye	9.3 (v4.0)	Critical
CVE-2026-108598	Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates	floci	9.3 (v4.0)	Critical
CVE-2026-108804	TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection	TEW-751DR	9.3 (v4.0)	Critical
CVE-2026-113802	Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler	WL-WN530BE1-A	9.3 (v4.0)	Critical
CVE-2026-12257	Remote code execution in Mura Software’s CMS	CMS	9.3 (v4.0)	Critical
CVE-2026-19586	Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways	er7212pc firmware	9.3 (v4.0)	Critical
CVE-2026-29014	MetInfo CMS <= 8.1 - Remote Code Execution	metinfo	9.3 (v4.0)	Critical
CVE-2026-34106	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34108	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34109	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34110	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34111	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34112	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php	language-system	9.3 (v4.0)	Critical
CVE-2026-34115	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php	language-system	9.3 (v4.0)	Critical
CVE-2026-35047	Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint	bravecms	9.3 (v4.0)	Critical
CVE-2026-41315	mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command I	mdserver-web	9.3 (v4.0)	Critical
CVE-2026-41923	WDR201A WiFi Extender OS Command Injection via internet.cgi	WDR201A WiFi Extender	9.3 (v4.0)	Critical
CVE-2026-41925	WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)	WDR201A WiFi Extender	9.3 (v4.0)	Critical
CVE-2026-41939	Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly	Care Everywhere Gateway	9.3 (v4.0)	Critical
CVE-2026-44402	Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi	SNMP Web Pro	9.3 (v4.0)	Critical
CVE-2026-48768	TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName	typebot.io	9.3 (v3.1)	Critical
CVE-2026-53975	OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec	OpenChamber	9.3 (v4.0)	Critical
CVE-2026-58138	Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution	conductor	9.3 (v4.0)	Critical
CVE-2026-58147	Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers	T-Mobile 5G Box IDU	9.3 (v4.0)	Critical
CVE-2026-58457	Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp	M300 Wi-Fi Repeater	9.3 (v4.0)	Critical
CVE-2026-59111	Command Injection vulnerability in eObčanka-Identifikace	eObčanka-Identifikace	9.3 (v3.1)	Critical
CVE-2026-60121	Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php	flamingo	9.3 (v4.0)	Critical
CVE-2026-61498	Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php	flamingo	9.3 (v4.0)	Critical
CVE-2026-61511	vBulletin 6.x - Remote Code Execution	vBulletin	9.3 (v4.0)	Critical
CVE-2026-63766	GPT-SoVITS 20250606v2pro OS Command Injection via webui.py	GPT-SoVITS	9.3 (v4.0)	Critical
CVE-2026-64625	AVideo before 29.0 OS Command Injection via execAsync	AVideo	9.3 (v4.0)	Critical
CVE-2026-64824	Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore	Home Assistant Core	9.3 (v4.0)	Critical
CVE-2026-65008	Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData	grav	9.3 (v4.0)	Critical
CVE-2026-67308	Wazuh GitHub Actions Shell Injection via Fork Pull Request	wazuh	9.3 (v4.0)	Critical
CVE-2026-70553	MaxSite CMS Unauthenticated RCE via Install Endpoint	MaxSite CMS	9.3 (v4.0)	Critical
CVE-2026-71921	DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi	VigorSwitch G2540xs	9.3 (v4.0)	Critical
CVE-2026-71944	D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71945	D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71946	D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71947	D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71948	D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71949	D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71950	D-Link DWR-M961 Command Injection via /boafrm/formSmsManage	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71951	D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71952	D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71953	D-Link DWR-M961 Command Injection via /boafrm/formNtp	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71954	D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71955	D-Link DWR-M961 Command Injection via /boafrm/formWsc	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71956	D-Link DWR-M961 Command Injection via app.cgi	DWR-M961	9.3 (v4.0)	Critical
CVE-2026-71984	MSI Radix AXE6600 v781521 Command Injection via urlfilter	Radix AXE6600	9.3 (v4.0)	Critical
CVE-2026-71992	MSI Radix AXE6600 v781521 Command Injection via macfilter	Radix AXE6600	9.3 (v4.0)	Critical
CVE-2026-72710	SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection	SPIP	9.3 (v4.0)	Critical
CVE-2026-76070	Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter	NC63	9.3 (v4.0)	Critical
CVE-2026-76071	Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter	NC63	9.3 (v4.0)	Critical
CVE-2026-85520	Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module	Google Merchant Center Feed	9.3 (v4.0)	Critical
CVE-2026-89308	Arbitrary command execution in TrxTimeATTENDANCE	TrxTimeATTENDANCE	9.3 (v4.0)	Critical
CVE-2026-9209	mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx	mJobTime	9.3 (v4.0)	Critical
CVE-2026-96754	orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path	orval	9.3 (v4.0)	Critical
CVE-2023-7305	SmartBI RMIServlet Unrestricted File Upload RCE	SmartBI	9.2 (v4.0)	Critical
CVE-2026-114053	vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision	vllm	9.2 (v4.0)	Critical
CVE-2026-27175	MajorDoMo Remote Command Injection via cycle_execs Race Condition	majordomo	9.2 (v4.0)	Critical
CVE-2026-59800	9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint	9router	9.2 (v4.0)	Critical
CVE-2026-63304	AVideo through 29.0 OS Command Injection via listFFmpegProcesses	AVideo	9.2 (v4.0)	Critical
CVE-2026-63305	AVideo through 29.0 OS Command Injection via ffmpeg.json.php	AVideo	9.2 (v4.0)	Critical
CVE-2026-80138	ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter	clipbucket-v5	9.2 (v4.0)	Critical
CVE-2026-82531	Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache	smarty	9.2 (v4.0)	Critical
CVE-2025-65473	easyimages2.0 Arbitrary Code Execution Vulnerability	easyimages2.0	9.1 (v3.1)	Critical
CVE-2025-66203	StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection	streamvault	9.1 (v3.1)	Critical
CVE-2026-10131	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-10135	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-12486	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12849	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12850	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-12851	GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability	GV-I/O Box 4E	9.1 (v3.1)	Critical
CVE-2026-33568	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-35499	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-37637	Alexantr filemanager v.1.0 Arbitrary Code Execution Vulnerability	-	9.1 (v3.1)	Critical
CVE-2026-39353	InvoicePlane: Remote Code Execution via Writable Templates Directory	InvoicePlane	9.1 (v3.1)	Critical
CVE-2026-40281	Gotenberg <= 8.30.1 - Remote Code Execution	gotenberg	9.1 (v3.1)	Critical
CVE-2026-40484	ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function	CRM	9.1 (v3.1)	Critical
CVE-2026-40627	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2026-46621	Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection	yamcs	9.1 (v3.1)	Critical
CVE-2026-50006	Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in	anyquery	9.1 (v3.1)	Critical
CVE-2026-55511	Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`	yamcs	9.1 (v3.1)	Critical
CVE-2026-57499	Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)	core	9.1 (v3.1)	Critical
CVE-2026-58400	GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter	core-geonetwork	9.1 (v3.1)	Critical
CVE-2026-58409	ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload	CRM	9.1 (v3.1)	Critical
CVE-2026-79766	Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email	Termix	9.1 (v3.1)	Critical
CVE-2026-79916	MaxKB AWS Bedrock model credential injection leads to remote code execution	MaxKB	9.1 (v3.1)	Critical
CVE-2026-9814	Totolink Arbitrary Code Execution Vulnerability	Totolink	9.1 (v3.1)	Critical
CVE-2021-45046	Apache Log4j2 - Remote Code Injection	log4j	9.0 (v3.1)	Critical
CVE-2026-102608	ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)	zoneminder	9.0 (v3.1)	Critical
CVE-2026-34612	Kestra: Remote Code Execution via SQL Injection	kestra	9.0 (v3.1)	Critical
CVE-2026-42238	Unauthenticated Remote Code Execution via Backup Restore in nginx-ui	nginx ui	9.0 (v4.0)	Critical
CVE-2026-45630	Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement	dokploy	9.0 (v3.1)	Critical
CVE-2026-45750	Termix Vulnerable to Arbitrary Command Execution in File Manager	termix	9.0 (v3.1)	Critical
CVE-2026-47252	Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)	anyquery	9.0 (v3.1)	Critical
CVE-2026-62674	Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE	omnigent	9.0 (v3.1)	Critical
CVE-2026-69251	Flowise RCE via TypeORM DataSource	flowise	9.0 (v4.0)	Critical
CVE-2026-73485	Flowise before 3.1.3 Remote Code Execution via Airtable Agent	flowise	9.0 (v4.0)	Critical
CVE-2026-73486	Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV	flowise	9.0 (v4.0)	Critical
CVE-2026-73487	Flowise before 3.1.3 Prompt Injection RCE via CSV Agent	flowise	9.0 (v4.0)	Critical
CVE-2026-91931	Flowise before 3.1.4 Remote Code Execution via Custom MCP npx	Flowise	9.0 (v4.0)	Critical
CVE-2026-33765	Pi-hole Web Interface has a Command Injection Vulnerability	web interface	8.9 (v4.0)	High
CVE-2026-41304	WWBN AVideo vulnerable to RCE caused by clonesite plugin	avideo	8.9 (v4.0)	High
CVE-2026-43945	FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection	FUXA	8.9 (v4.0)	High
CVE-2026-5850	Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5851	Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5852	Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5853	Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5854	Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5975	Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5976	Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5977	Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5978	Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5993	Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5994	Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5996	Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-5997	Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6025	Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6026	Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6028	Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6029	Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6112	Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6113	Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6114	Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6115	Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6116	Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6131	Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6132	Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6138	Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6139	Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6140	Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6154	Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6155	Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6156	Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-6195	Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection	A7100RU	8.9 (v4.0)	High
CVE-2026-7121	Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7122	Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7123	Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7124	Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7125	Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7136	Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7137	Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7138	Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7139	Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7140	Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7152	Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7153	Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7154	Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7155	Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7156	Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7202	Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7203	Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7204	Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7240	Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7241	Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7242	Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7243	Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7244	Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-73570	zimbra collaboration suite Arbitrary Code Execution Vulnerability	zimbra collaboration suite	8.9 (v3.1)	High
CVE-2026-7538	Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-7823	Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9384	Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9385	Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9386	Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9387	Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9388	Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9404	Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9405	Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9406	Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9407	Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9408	Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9432	Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9433	Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9434	Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9435	Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9436	Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9454	Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9455	Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9456	Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9457	Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9458	Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9476	Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9477	Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection	A8000RU	8.9 (v4.0)	High
CVE-2026-9478	Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection	A8000RU	8.9 (v4.0)	High
CVE-2016-4977	Spring Security OAuth2 Remote Command Execution	spring security oauth	8.8 (v3.0)	High
CVE-2017-11391	Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution	interscan messaging security virtual appliance	8.8 (v3.0)	High
CVE-2017-11392	Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution	interscan messaging security virtual appliance	8.8 (v3.0)	High
CVE-2017-17405	Ruby Net::FTP Module Command Injection (CVE-2017-17405)	ruby	8.8 (v3.0)	High
CVE-2017-6884	Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection	emg2926 firmware	8.8 (v3.1)	High
CVE-2018-16660	Imperva SecureSphere PWS Command Injection	securesphere	8.8 (v3.0)	High
CVE-2018-20323	Mailcleaner Remote Code Execution	mailcleaner	8.8 (v3.0)	High
CVE-2020-12109	TP-Link Cloud Cameras NCXXX Bonjour Command Injection	nc200 firmware	8.8 (v3.1)	High
CVE-2020-15874	Command Injection	-	8.8 (v3.1)	High
CVE-2020-24949	PHP-Fusion 9.03.50 - Remote Code Execution	php-fusion	8.8 (v3.1)	High
CVE-2020-7351	TrixBox CE endpoint_devicemap.php Authenticated Command Execution	trixbox	8.8 (v3.1)	High
CVE-2021-3577	Motorola Baby Monitors - Remote Command Execution	halo+ camera firmware	8.8 (v3.1)	High
CVE-2022-4223	pgAdmin < 6.17 - Unauthenticated Remote Code Execution	pgadmin 4	8.8 (v3.1)	High
CVE-2023-1389	TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection	archer-ax21	8.8 (v3.1)	High
CVE-2023-34127	Sonicwall	analytics	8.8 (v3.1)	High
CVE-2023-43661	Cachet vulnerable to Authenticated Remote Code Execution	cachet	8.8 (v3.1)	High
CVE-2024-39024	In Packetfence 13.2.0, the WebGui interface setting Arbitrary Code Execution Vulnerability	-	8.8 (v3.1)	High
CVE-2024-41667	OpenAM<=15.0.3 FreeMarker - Template Injection	OpenAM	8.8 (v3.1)	High
CVE-2025-30004	Xorcom CompletePBX Authenticated Command Injection via Task Scheduler	completepbx	8.8 (v3.1)	High
CVE-2025-4428	Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution	endpoint manager mobile	8.8 (v3.1)	High
CVE-2025-51457	D-Link DAP-2610 up to 2.06B08r099 Command Injection Vulnerability	D-Link DAP-2610 up to 2.06B08r099	8.8 (v3.1)	High
CVE-2025-56798	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier	8.8 (v3.1)	High
CVE-2025-59710	biztalk360 Arbitrary Code Execution Vulnerability	biztalk360	8.8 (v3.1)	High
CVE-2025-65471	easyimages2.0 Arbitrary Code Execution Vulnerability	easyimages2.0	8.8 (v3.1)	High
CVE-2025-66209	Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup	coolify	8.8 (v3.1)	High
CVE-2025-66438	erpnext Information Disclosure Vulnerability	erpnext	8.8 (v3.1)	High
CVE-2026-104851	fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution	filesystem spec	8.8 (v3.1)	High
CVE-2026-105106	Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task	Koha	8.8 (v3.1)	High
CVE-2026-105797	SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)	simplechat	8.8 (v3.1)	High
CVE-2026-108963	databasement Arbitrary Code Execution Vulnerability	databasement	8.8 (v3.1)	High
CVE-2026-110908	pfSense-pkg-frr Command Injection Vulnerability	pfSense-pkg-frr	8.8 (v3.1)	High
CVE-2026-24893	openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion	openitcockpit	8.8 (v3.1)	High
CVE-2026-26899	OS Command Injection	-	8.8 (v3.1)	High
CVE-2026-30971	ZoneMinder: Authenticated RCE via command injection in monitor Device Path	zoneminder	8.8 (v3.1)	High
CVE-2026-33704	Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint	chamilo lms	8.8 (v3.1)	High
CVE-2026-34057	Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name	coolify	8.8 (v3.1)	High
CVE-2026-34153	Coolify LocalFileVolume fs_path command injection enables RCE	coolify	8.8 (v3.1)	High
CVE-2026-34158	Coolify: Command injection via single-quote breakout in Docker Compose custom commands	coolify	8.8 (v3.1)	High
CVE-2026-34197	Apache ActiveMQ Jolokia Remote Code Execution (CVE-2026-34197)	activemq	8.8 (v3.1)	High
CVE-2026-34594	Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management	coolify	8.8 (v3.1)	High
CVE-2026-34599	Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component	coolify	8.8 (v3.1)	High
CVE-2026-35031	Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain	jellyfin	8.8 (v3.1)	High
CVE-2026-35196	Chamilo LMS has OS Command Injection via export_all_certificates action	chamilo lms	8.8 (v3.1)	High
CVE-2026-35519	Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection	ftldns	8.8 (v3.1)	High
CVE-2026-35520	Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection	ftldns	8.8 (v3.1)	High
CVE-2026-41208	Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution	paperclipai	8.8 (v3.1)	High
CVE-2026-4327	The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_lo	The Welcomizer	8.8 (v3.1)	High
CVE-2026-45505	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass	activemq	8.8 (v3.1)	High
CVE-2026-45578	WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL	avideo	8.8 (v3.1)	High
CVE-2026-45662	Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)	dokploy	8.8 (v3.1)	High
CVE-2026-48017	DbGate: Remote Code Execution via functionName injection in loadReader endpoint	dbgate	8.8 (v3.1)	High
CVE-2026-52356	D-Link DAP1160L A1_FW101WWb04 Command Injection Vulnerability	D-Link DAP1160L A1 FW101WWb04	8.8 (v3.1)	High
CVE-2026-52483	OS Command Injection	-	8.8 (v3.1)	High
CVE-2026-52484	MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 Arbitrary Code Execution Vulnerability	-	8.8 (v3.1)	High
CVE-2026-54149	MaxKB MCP tool import validation bypass allows post-authentication remote code execution	MaxKB	8.8 (v3.1)	High
CVE-2026-55585	QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`	qwed-verification	8.8 (v3.1)	High
CVE-2026-57296	Jenkins External Workspace Manager Plugin Arbitrary Code Execution Vulnerability	Jenkins External Workspace Manager Plugin	8.8 (v3.1)	High
CVE-2026-58195	Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into ex	agentic-flow	8.8 (v3.1)	High
CVE-2026-59734	Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution	coolify	8.8 (v3.1)	High
CVE-2026-62312	9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments	9router	8.8 (v3.1)	High
CVE-2026-62675	Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools	omnigent	8.8 (v3.1)	High
CVE-2026-6543	Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint	langflow desktop	8.8 (v3.1)	High
CVE-2026-65660	Microsoft SharePoint Server Remote Code Execution Vulnerability	sharepoint server	8.8 (v3.1)	High
CVE-2026-72875	Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile	dokploy	8.8 (v3.1)	High
CVE-2026-73222	Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio)	claude-code-templates	8.8 (v3.1)	High
CVE-2026-76801	FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation	FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment	8.8 (v3.1)	High
CVE-2026-77601	OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting	cosmos	8.8 (v3.1)	High
CVE-2026-78834	Code Injection	-	8.8 (v3.1)	High
CVE-2026-79423	seacms v13.6 Arbitrary Code Execution Vulnerability	seacms v13.6	8.8 (v3.1)	High
CVE-2026-82217	Eclipse Theia Path Traversal Vulnerability	Eclipse Theia	8.8 (v3.1)	High
CVE-2026-82804	Apache DolphinScheduler: Command Injection in the Alert Script Plugin	Apache DolphinScheduler	8.8 (v3.1)	High
CVE-2026-84317	Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the o	nginx-ui	8.8 (v3.1)	High
CVE-2026-84318	Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE	nginx-ui	8.8 (v3.1)	High
CVE-2026-85731	oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)	oras-go	8.8 (v3.1)	High
CVE-2026-88622	NUUO Network Video Recorder 2.0.0 Command Injection Vulnerability	-	8.8 (v3.1)	High
CVE-2026-96795	Horilla: Authenticated RCE in Horilla List-View Export	horilla-hr	8.8 (v3.1)	High
CVE-2005-10004	Cacti graph_view.php Remote Command Execution	cacti	8.7 (v4.0)	High
CVE-2013-10039	GestioIP Remote Command Execution	IPAM	8.7 (v4.0)	High
CVE-2015-10145	Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh	gargoyle	8.7 (v4.0)	High
CVE-2019-25671	VA MAX 8.3.4 Remote Code Execution via changeip.php	VA MAX	8.7 (v4.0)	High
CVE-2021-47943	TextPattern CMS 4.8.7 Remote Code Execution via File Upload	TextPattern CMS	8.7 (v4.0)	High
CVE-2022-50944	Aero CMS 0.0.1 PHP Code Injection via posts.php	Aero CMS	8.7 (v4.0)	High
CVE-2023-54350	WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated	Augmented Reality	8.7 (v4.0)	High
CVE-2025-30007	HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management	control panel	8.7 (v4.0)	High
CVE-2025-34115	OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php	OP5 Monitor	8.7 (v4.0)	High
CVE-2025-34311	IPFire < v2.29 Command Injection via Proxy Report Creation	ipfire	8.7 (v4.0)	High
CVE-2025-34312	IPFire < v2.29 Command Injection via URL Filter Blacklist	ipfire	8.7 (v4.0)	High
CVE-2025-34334	AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE	fax server	8.7 (v4.0)	High
CVE-2025-4008	MeteoBridge <= 6.1 - Remote Code Execution	meteobridge vm	8.7 (v4.0)	High
CVE-2025-66294	Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE	grav	8.7 (v4.0)	High
CVE-2026-100852	AzuraCast through 0.23.x Command Injection via Streamer Username	AzuraCast	8.7 (v4.0)	High
CVE-2026-100856	AzuraCast before 0.23.6 Code Injection via Remote Relay Password	AzuraCast	8.7 (v4.0)	High
CVE-2026-100864	heym before 0.0.91 Remote Code Execution via Expression Engine	heym	8.7 (v4.0)	High
CVE-2026-105123	W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API	wcms	8.7 (v4.0)	High
CVE-2026-105985	Authenticated RCE via render-components Entry Type overrides	cms	8.7 (v4.0)	High
CVE-2026-107639	ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename	ILIAS	8.7 (v4.0)	High
CVE-2026-109308	Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection	cms	8.7 (v4.0)	High
CVE-2026-116009	Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action	camaleon-cms	8.7 (v4.0)	High
CVE-2026-116811	OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template	openpanel	8.7 (v4.0)	High
CVE-2026-28797	RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Compone	ragflow	8.7 (v4.0)	High
CVE-2026-34228	Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write	emlog	8.7 (v4.0)	High
CVE-2026-34735	Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`	wiki	8.7 (v4.0)	High
CVE-2026-34791	Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34792	Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34793	Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34794	Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34795	Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34796	Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34797	Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection	firewall community	8.7 (v4.0)	High
CVE-2026-34965	Cockpit CMS Authenticated Remote Code Execution via Collections	Cockpit CMS	8.7 (v4.0)	High
CVE-2026-40488	OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution	magento	8.7 (v4.0)	High
CVE-2026-40521	FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload	FrontAccounting	8.7 (v4.0)	High
CVE-2026-41934	Vvveb < 1.0.8.2 Authenticated RCE via Code Editor	Vvveb	8.7 (v4.0)	High
CVE-2026-46746	sinec ins OS Command Injection Vulnerability	sinec ins	8.7 (v4.0)	High
CVE-2026-49143	BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler	browserstack-runner	8.7 (v4.0)	High
CVE-2026-55094	Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)	taskcluster	8.7 (v4.0)	High
CVE-2026-58000	luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey	luci-proto-openvpn	8.7 (v4.0)	High
CVE-2026-58452	JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint	C492A-W6 Wi-Fi IP Camera	8.7 (v4.0)	High
CVE-2026-63722	ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php	ICEcoder	8.7 (v4.0)	High
CVE-2026-64850	Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()	grav	8.7 (v4.0)	High
CVE-2026-67206	Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload	wolfcms	8.7 (v4.0)	High
CVE-2026-69096	OpenWrt luci-app-dockerman Read ACL Remote Code Execution	luci	8.7 (v4.0)	High
CVE-2026-69100	LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution	lamp-cloud	8.7 (v4.0)	High
CVE-2026-71966	CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer	cyberpanel	8.7 (v4.0)	High
CVE-2026-72819	Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload	grav	8.7 (v4.0)	High
CVE-2026-72827	Grav CMS before 2.0.13 Remote Code Execution via Twig	grav	8.7 (v4.0)	High
CVE-2026-72830	Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass	grav	8.7 (v4.0)	High
CVE-2026-72870	Dokploy: Command Injection via Docker Credentials in buildRemoteDocker	dokploy	8.7 (v4.0)	High
CVE-2026-72874	Dokploy: Command Injection via Unescaped Git URL in Clone Commands	dokploy	8.7 (v4.0)	High
CVE-2026-73680	Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename	Cockpit CMS	8.7 (v4.0)	High
CVE-2026-76060	OS Command Injection in PayRange API	Zoneminder	8.7 (v4.0)	High
CVE-2026-76836	AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass	AzuraCast	8.7 (v4.0)	High
CVE-2026-78416	Authenticated RCE via `condition.config` JSON cleanse bypass	cms	8.7 (v4.0)	High
CVE-2026-79756	Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform	nuclio	8.7 (v4.0)	High
CVE-2026-79987	Low-privilege RCE through element-search eager loading	cms	8.7 (v4.0)	High
CVE-2026-82278	BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once	bisheng	8.7 (v4.0)	High
CVE-2026-85604	Grav before 2.0.19 Remote Code Execution via sort filter	grav	8.7 (v4.0)	High
CVE-2026-85610	OpenPanel before 2.3.0 Remote Code Execution via chart formulas	openpanel	8.7 (v4.0)	High
CVE-2026-86732	Craft CMS before 5.10.12 Remote Code Execution via element-index	cms	8.7 (v4.0)	High
CVE-2026-90770	Spug through 3.4.0 Remote Code Execution via ping_check	spug	8.7 (v4.0)	High
CVE-2026-92580	AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF	AVideo	8.7 (v4.0)	High
CVE-2023-47105	Chaosblade < 1.7.4 - Remote Code Execution	chaosblade	8.6 (v3.1)	High
CVE-2024-20353	adaptive security appliance software Denial of Service Vulnerability	adaptive security appliance software	8.6 (v3.1)	High
CVE-2025-66301	Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE	grav	8.6 (v4.0)	High
CVE-2025-68455	Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior	craft cms	8.6 (v4.0)	High
CVE-2025-68700	RAGFlow Remote Code Execution Vulnerability	ragflow	8.6 (v4.0)	High
CVE-2026-100896	TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection	N150RT	8.6 (v4.0)	High
CVE-2026-102911	zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection	pi-llm-wiki	8.6 (v4.0)	High
CVE-2026-108540	OpenSpug File Transfer transfer os command injection	Spug	8.6 (v4.0)	High
CVE-2026-108894	Linksys E1700 Static Route addStaticRoute os command injection	E1700	8.6 (v4.0)	High
CVE-2026-109108	Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection	WL-WN530BE1-A	8.6 (v4.0)	High
CVE-2026-109397	Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space	Thelia	8.6 (v4.0)	High
CVE-2026-111214	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php	pfsense	8.6 (v4.0)	High
CVE-2026-111217	Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID	pfsense	8.6 (v4.0)	High
CVE-2026-111218	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters	pfsense	8.6 (v4.0)	High
CVE-2026-113390	DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection	Vigor2960	8.6 (v4.0)	High
CVE-2026-113506	aaPanel File Manager common.py ExecShell os command injection	aaPanel	8.6 (v4.0)	High
CVE-2026-22100	Comnand injection in OCPP ReserveLogin message	DC-80	8.6 (v4.0)	High
CVE-2026-23698	Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload	Vtiger CRM	8.6 (v4.0)	High
CVE-2026-40187	Authenticated RCE via Malicious eTemplate Upload in EGroupware	egroupware	8.6 (v4.0)	High
CVE-2026-41587	CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution	ci4ms	8.6 (v4.0)	High
CVE-2026-42785	OpenKM 6.3.12 Remote Code Execution via Administrative Scripting	OpenKM Community Edition	8.6 (v4.0)	High
CVE-2026-44011	Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior	cms	8.6 (v4.0)	High
CVE-2026-53804	OTRS Community Edition OS Command Injection via PGP Configuration	OTRS Community Edition	8.6 (v4.0)	High
CVE-2026-54710	FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)	freepbx	8.6 (v4.0)	High
CVE-2026-55182	LibreNMS: Remote Code Execution by Signal Alert Transportation Module	librenms	8.6 (v4.0)	High
CVE-2026-56382	Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController	cms	8.6 (v4.0)	High
CVE-2026-56703	Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO	adminer	8.6 (v4.0)	High
CVE-2026-5917	libgit2 Shell Command Injection via ssh_libssh2 Backend	libgit2	8.6 (v4.0)	High
CVE-2026-61517	Netis NX10 OS Command Injection via Ping Diagnostic Handler	NX10	8.6 (v4.0)	High
CVE-2026-61523	WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor	WebsiteBaker CMS	8.6 (v4.0)	High
CVE-2026-63725	sysPass FileBackupService Authenticated OS Command Injection via Backup Path	sysPass	8.6 (v4.0)	High
CVE-2026-65693	Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates	microweber	8.6 (v4.0)	High
CVE-2026-65711	sysPass 3.2.11 Authenticated OS Command Injection via Backup Path	sysPass	8.6 (v4.0)	High
CVE-2026-67599	ClearOS 7.9 OS Command Injection via Log Viewer filter parameter	ClearOS	8.6 (v4.0)	High
CVE-2026-69088	Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint	grav	8.6 (v4.0)	High
CVE-2026-71906	DrayTek VigorAP Multiple Models OS Command Injection via setLan	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71907	DrayTek VigorAP Multiple Models OS Command Injection via setcamset	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71908	DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71913	DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi	VigorAP 918R	8.6 (v4.0)	High
CVE-2026-71915	DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71918	DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71919	DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71923	DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71924	DrayTek VigorSwitch Multiple Models OS Command Injection via getVid	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71925	DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71926	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71927	DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71928	DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71929	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71930	DrayTek VigorSwitch Multiple Models OS Command Injection via setTime	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71931	DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-71943	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet	VigorSwitch G2540xs	8.6 (v4.0)	High
CVE-2026-73664	FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module	backup	8.6 (v4.0)	High
CVE-2026-75121	PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-75122	PLANET GS-4210-16P2S Command Injection via httpuploadcert.cgi	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-75123	PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_post	PLANET GS-4210-16P2S V3	8.6 (v4.0)	High
CVE-2026-80214	LibreNMS Virtualisation Discovery Module RCE	librenms	8.6 (v4.0)	High
CVE-2026-82692	D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection	DNS-340L	8.6 (v4.0)	High
CVE-2026-84194	LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname	librenms	8.6 (v4.0)	High
CVE-2026-85223	D-Link DNS-340L CGI dropbox.cgi os command injection	DNS-340L	8.6 (v4.0)	High
CVE-2026-86299	Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection	RE7000	8.6 (v4.0)	High
CVE-2026-86438	Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action	laradashboard	8.6 (v4.0)	High
CVE-2026-86733	Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore	snipe-it	8.6 (v4.0)	High
CVE-2026-90699	D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection	DWR-M920	8.6 (v4.0)	High
CVE-2025-34332	AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE	fax server	8.5 (v4.0)	High
CVE-2025-34333	AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE	fax server	8.5 (v4.0)	High
CVE-2025-49619	Skyvern SSTI Remote Code Execution	Skyvern	8.5 (v3.1)	High
CVE-2026-101009	aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection	BaoTa	8.5 (v4.0)	High
CVE-2026-22244	OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE	openmetadata	8.5 (v4.0)	High
CVE-2026-82690	D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection	DNS-327L	8.5 (v4.0)	High
CVE-2026-82691	D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection	DNS-320L	8.5 (v4.0)	High
CVE-2026-85222	D-Link DNS-340L Add-On Center addon_center.cgi os command injection	DNS-340L	8.5 (v4.0)	High
CVE-2026-85224	D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection	DNS-320 ShareCenter	8.5 (v4.0)	High
CVE-2026-90702	D-Link DWR-M921 formDiskFormat system os command injection	DWR-M921	8.5 (v4.0)	High
CVE-2026-90703	D-Link DWR-M921 formDiskCreateShare system os command injection	DWR-M921	8.5 (v4.0)	High
CVE-2026-92397	Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection	RG-EW3000GX	8.5 (v4.0)	High
CVE-2026-92398	Ruijie RG-EW3000GX user_list_note admin os command injection	RG-EW3000GX	8.5 (v4.0)	High
CVE-2026-104078	Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass	Obsidian Desktop	8.4 (v4.0)	High
CVE-2026-55786	Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`	flyto-core	8.4 (v3.1)	High
CVE-2024-58274	CSMP iSecure Center OS Command Injection Vulnerability	CSMP iSecure Center	8.3 (v3.1)	High
CVE-2025-59711	biztalk360 Path Traversal Vulnerability	biztalk360	8.3 (v3.1)	High
CVE-2026-49471	Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE	serena	8.3 (v3.1)	High
CVE-2025-69755	Neterbit NW-431F Router vNW-431F-20241014-IR03 Arbitrary Code Execution Vulnerability	-	8.2 (v3.1)	High
CVE-2018-6961	VMware NSX SD-WAN Edge - Command Injection	nsx sd-wan edge	8.1 (v3.1)	High
CVE-2026-19942	Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta	Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback	8.1 (v3.1)	High
CVE-2026-42588	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector	activemq	8.1 (v3.1)	High
CVE-2026-45344	LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances	LinkAce	8.1 (v3.1)	High
CVE-2026-47398	PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-20	PraisonAI	8.1 (v3.1)	High
CVE-2026-48695	fastnetmon Command Injection Vulnerability	fastnetmon	8.1 (v3.1)	High
CVE-2026-55173	AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving	AVideo	8.1 (v3.1)	High
CVE-2026-71320	Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props	nuxt	8.1 (v3.1)	High
CVE-2026-97875	DNS rebinding vulnerability in rojo serve HTTP API	rojo	8.1 (v3.1)	High
CVE-2026-79755	Nuclio: Unauthenticated OS command injection via function namespace in docker ps –filter label (local Docker platform)	nuclio	8.0 (v3.1)	High
CVE-2021-21315	Node.JS System Information Library <5.3.1 - Remote Command Injection	systeminformation	7.8 (v3.1)	High
CVE-2026-67179	Genkit improper host header validation	genkit	7.8 (v3.1)	High
CVE-2025-27621	UpTrain has a Constant Default API Key	uptrain	7.7 (v4.0)	High
CVE-2026-105764	Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE	immich	7.7 (v4.0)	High
CVE-2026-108161	FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download	fusionpbx	7.7 (v4.0)	High
CVE-2026-32271	Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget	commerce	7.7 (v4.0)	High
CVE-2026-42099	Race Condition in Sparx Pro Cloud Server	pro cloud server	7.7 (v4.0)	High
CVE-2026-57999	luci-app-tailscale-community - Command Injection via tailscale.do_login RPC	luci-app-tailscale-community	7.7 (v4.0)	High
CVE-2005-0511	vBulletin misc.php Template Name Arbitrary Code Execution	vbulletin	7.5 (v2.0)	High
CVE-2012-5223	vBSEO proc_deutf() Remote PHP Code Injection	vbseo	7.5 (v2.0)	High
CVE-2019-16469	Adobe Experience Manager - Expression Language Injection	experience manager	7.5 (v3.1)	High
CVE-2023-34133	Sonicwall	analytics	7.5 (v3.1)	High
CVE-2025-4427	Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution	endpoint manager mobile	7.5 (v3.1)	High
CVE-2026-107812	Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or M	nginx ui	7.5 (v3.1)	High
CVE-2026-111221	Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection	pfsense	7.5 (v4.0)	High
CVE-2026-34239	Chamilo Authenticated Remote Code Execution	chamilo-lms	7.5 (v4.0)	High
CVE-2026-36783	Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to Denial of Service Vulnerability	-	7.5 (v3.1)	High
CVE-2026-36796	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to Denial of Service Vulnerability	-	7.5 (v3.1)	High
CVE-2026-46581	mojarra Path Traversal Vulnerability	mojarra	7.5 (v3.1)	High
CVE-2026-51078	Dede CMS v.5.7.118 Information Disclosure Vulnerability	-	7.5 (v3.1)	High
CVE-2026-53534	JabRef CAYW Sublime Text integration permits operating-system command injection	jabref	7.5 (v4.0)	High
CVE-2026-53599	Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mo	core	7.5 (v3.1)	High
CVE-2026-101860	RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management	raspap-webgui	7.4 (v4.0)	High
CVE-2025-67888	Control Web Panel /admin/index.php Unauthenticated RCE	-	7.3 (v3.1)	High
CVE-2026-108593	9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint	9router	7.3 (v4.0)	High
CVE-2026-10870	Shibby Tomato Web UI rc start_dhcpc os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-10871	Shibby Tomato Web UI rc start_6rd_tunnel os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-10873	Shibby Tomato Web UI rstats rstats_path os command injection	Tomato	7.3 (v4.0)	High
CVE-2026-18900	H3C NX15 Backend RPC esps file.exec os command injection	NX15	7.3 (v4.0)	High
CVE-2026-19771	Baicells EG3661M LuCI Web luci os command injection	EG3661M	7.3 (v4.0)	High
CVE-2026-36540	Netis AC1200 Router NC21 V4.0.1.4296 Arbitrary Code Execution Vulnerability	-	7.3 (v3.1)	High
CVE-2026-53554	SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing	SQLBot	7.3 (v4.0)	High
CVE-2018-12465	MicroFocus Secure Messaging Gateway Remote Code Execution	secure messaging gateway	7.2 (v3.0)	High
CVE-2020-8816	Pi-Hole DHCP MAC OS Command Execution	pi-hole	7.2 (v3.1)	High
CVE-2021-33544	Geutebruck - Remote Command Injection	g-cam ebc-2110	7.2 (v3.1)	High
CVE-2022-43769	Pentaho Business Server Auth Bypass and Server Side Template Injection RCE	vantara pentaho business analytics server	7.2 (v3.1)	High
CVE-2025-32813	Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request	netmri	7.2 (v3.1)	High
CVE-2025-48868	Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive	horilla	7.2 (v3.1)	High
CVE-2025-58762	Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent	tautulli	7.2 (v3.1)	High
CVE-2025-58763	Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection	tautulli	7.2 (v3.1)	High
CVE-2025-60787	Remote Code Execution Vulnerability in MotionEye Frontend (CVE-2025-60787)	motioneye	7.2 (v3.1)	High
CVE-2025-62429	ClipBucket v5 executes arbitrary PHP code	clipbucket	7.2 (v3.1)	High
CVE-2026-13392	ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)	ElementsKit Elementor Addons	7.2 (v3.1)	High
CVE-2026-15686	Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability	Adminer	7.2 (v3.0)	High
CVE-2026-27891	Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism	facturascripts	7.2 (v3.1)	High
CVE-2026-28409	WeGIA <= 3.6.4 - Remote Code Execution	wegia	7.2 (v3.1)	High
CVE-2026-6020	ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API	ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin	7.2 (v3.1)	High
CVE-2026-71284	Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename	fledge	7.2 (v3.1)	High
CVE-2026-81669	IBM Guardium Data Protection is affected by multiple vulnerabilities.	guardium data protection	7.2 (v3.1)	High
CVE-2026-92263	SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/resto	SparkyFitness	7.2 (v3.1)	High
CVE-2026-9777	ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability	unizon	7.2 (v3.0)	High
CVE-2026-48997	e107: Command Injection via shell expansion in ImageMagick resize destination path	e107	7.1 (v3.1)	High
CVE-2026-58502	githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow	githubtoplanguages	7.1 (v4.0)	High
CVE-2026-71964	CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload	cyberpanel	7.1 (v4.0)	High
CVE-2026-77939	Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint	flextype	7.1 (v4.0)	High
CVE-2024-12987	DrayTek Vigor - Command Injection	Vigor300B	6.9 (v4.0)	Medium
CVE-2026-11450	GL.iNet GL-MT3000 Path Normalization dlopen command injection	GL-MT3000	6.9 (v4.0)	Medium
CVE-2026-116253	DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection	DedeCMS	6.9 (v4.0)	Medium
CVE-2026-19983	GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection	A1300	6.9 (v4.0)	Medium
CVE-2026-5739	PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection	PowerJob	6.9 (v4.0)	Medium
CVE-2013-4212	Apache Roller OGNL Injection	roller	6.8 (v2.0)	Medium
CVE-2025-59709	biztalk360 Path Traversal Vulnerability	biztalk360	6.8 (v3.1)	Medium
CVE-2026-34216	CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php	panel	6.6 (v3.1)	Medium
CVE-2026-79761	Termix: Command injection in SSH key deployment verification	Termix	6.6 (v3.1)	Medium
CVE-2025-11372	LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	6.5 (v3.1)	Medium
CVE-2025-14545	YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation	YML for Yandex Market	6.5 (v3.1)	Medium
CVE-2026-40909	WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Dir	avideo	6.5 (v3.1)	Medium
CVE-2026-4502	Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API	langflow desktop	6.5 (v3.1)	Medium
CVE-2026-55679	WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection	WeGIA	6.5 (v3.1)	Medium
CVE-2026-72739	Dokploy: Command Injection via Compose Shell Execution	dokploy	6.5 (v3.1)	Medium
CVE-2026-44287	FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*(/ is bypassable	FastGPT	6.3 (v3.1)	Medium
CVE-2026-45626	Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter	arcane	6.3 (v3.1)	Medium
CVE-2017-7896	Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution	interscan messaging security virtual appliance	6.1 (v3.0)	Medium
CVE-2023-5244	Microweber < V.2.0 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2026-47250	mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration	mcp-server-kubernetes	6.1 (v3.1)	Medium
CVE-2025-13262	lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal	lsfusion platform	5.5 (v4.0)	Medium
CVE-2025-13786	taosir WTCMS index.php fetch code injection	wtcms	5.5 (v4.0)	Medium
CVE-2025-13792	Qualitor getResumo.php eval code injection	the file /html/st/stdeslocamento/request/getResumo.php	5.5 (v4.0)	Medium
CVE-2026-10214	zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection	chatgpt-on-wechat	5.5 (v4.0)	Medium
CVE-2026-102874	HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection	AnyTool	5.5 (v4.0)	Medium
CVE-2026-112252	Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql	Wubang Five-in-One Safety Production Management Information System	5.5 (v4.0)	Medium
CVE-2026-11344	code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload	Vehicle Management System	5.5 (v4.0)	Medium
CVE-2026-11474	Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload	student-management-system	5.5 (v4.0)	Medium
CVE-2026-18641	Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginC	Operation and Maintenance Security Management System	5.5 (v4.0)	Medium
CVE-2026-19379	EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection	ipTIME AX8004M	5.5 (v4.0)	Medium
CVE-2026-5333	DefaultFuction Content-Management-System tools.php command injection	content management system	5.5 (v4.0)	Medium
CVE-2026-54611	InstantCMS has Remote Code Execution in package installer	icms2	5.5 (v3.1)	Medium
CVE-2026-5631	assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection	gpt-researcher	5.5 (v4.0)	Medium
CVE-2026-5677	Totolink A7100RU cstecgi.cgi CsteSystem os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5678	Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5688	Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5689	Totolink A7100RU cstecgi.cgi setNtpCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5690	Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5691	Totolink A7100RU cstecgi.cgi setFirewallType os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5692	Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection	A7100RU	5.5 (v4.0)	Medium
CVE-2026-5736	PowerJob detailPlus Endpoint InstanceController.java sql injection	PowerJob	5.5 (v4.0)	Medium
CVE-2026-5741	suvarchal docker-mcp-server HTTP index.ts pull_image os command injection	docker-mcp-server	5.5 (v4.0)	Medium
CVE-2026-5802	idachev mcp-javadc HTTP os command injection	mcp-javadc	5.5 (v4.0)	Medium
CVE-2026-7061	Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection	chatgpt-mcp-server	5.5 (v4.0)	Medium
CVE-2026-7062	Intina47 context-sync Git Integration git-integration.ts os command injection	context-sync	5.5 (v4.0)	Medium
CVE-2026-7064	AgentDeskAI browser-tools-mcp browser-connector.ts os command injection	browser-tools-mcp	5.5 (v4.0)	Medium
CVE-2026-7066	choieastsea simple-openstack-mcp server.py exec_openstack os command injection	simple-openstack-mcp	5.5 (v4.0)	Medium
CVE-2026-7220	jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection	FastlyMCP	5.5 (v4.0)	Medium
CVE-2026-7416	PolarVista xcode-mcp-server MCP index.ts run_tests os command injection	xcode-mcp-server	5.5 (v4.0)	Medium
CVE-2026-7443	BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection	mcp-dnstwist	5.5 (v4.0)	Medium
CVE-2026-7590	eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection	p 69 branch monkey mcp	5.5 (v4.0)	Medium
CVE-2026-76760	chenhg5 cc-connect webhook.go authenticate code injection	cc-connect	5.5 (v4.0)	Medium
CVE-2026-76761	chenhg5 cc-connect Management API engine.go shellExecCommand os command injection	cc-connect	5.5 (v4.0)	Medium
CVE-2026-7698	Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection	Easy7 Integrated Management Platform	5.5 (v4.0)	Medium
CVE-2026-82598	SeaCMS Template search.php parseIf code injection	SeaCMS	5.5 (v4.0)	Medium
CVE-2026-85137	SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection	SeaCMS	5.5 (v4.0)	Medium
CVE-2026-90617	GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection	PentestAgent	5.5 (v4.0)	Medium
CVE-2026-90619	0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection	HexStrike AI	5.5 (v4.0)	Medium
CVE-2026-90690	0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection	HexStrike AI	5.5 (v4.0)	Medium
CVE-2026-90843	SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection	WebMap	5.5 (v4.0)	Medium
CVE-2026-9474	yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection	StudentManagementSystem	5.5 (v4.0)	Medium
CVE-2026-54543	Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields	froxlor	5.4 (v3.1)	Medium
CVE-2026-58391	OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout	core	5.4 (v3.1)	Medium
CVE-2023-7299	DataGear resolveSql sql injection	datagear	5.3 (v4.0)	Medium
CVE-2025-10097	SimStudioAI sim route.ts code injection	sim	5.3 (v4.0)	Medium
CVE-2025-11344	ILIAS Certificate Import code injection	ilias	5.3 (v4.0)	Medium
CVE-2026-15485	TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection	TEW-821DAP	5.3 (v4.0)	Medium
CVE-2026-19785	francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection	RosarioSIS	5.3 (v4.0)	Medium
CVE-2026-29202	cPanel Code Injection Vulnerability	cPanel	5.3 (v4.0)	Medium
CVE-2026-5547	Tenda AC10 httpd formAddMacfilterRule os command injection	ac10 firmware	5.3 (v4.0)	Medium
CVE-2011-0518	LotusCMS 3.0 eval() Remote Command Execution	fraise	5.1 (v2.0)	Medium
CVE-2025-59751	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59752	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59753	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59754	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59759	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59773	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59774	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2024-31839	Chaos RAT XSS to RCE	chaos	4.8 (v3.1)	Medium
CVE-2026-112949	Vitest: Code injection via unauthenticated manual mock registration	vitest	4.7 (v3.1)	Medium
CVE-2025-63739	rockoa Improper Access Control Vulnerability	rockoa	4.3 (v3.1)	Medium
CVE-2025-67737	AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE	azuracast	3.7 (v3.1)	Low
CVE-2026-42201	Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands	coolify	3.3 (v3.1)	Low
CVE-2026-38924	Serena Incorrect Resource Transfer Between Spheres Vulnerability	Serena	2.9 (v3.1)	Low
CVE-2025-11138	mirweiye wenkucms common.php createPathOne os command injection	wenkucms	2.1 (v4.0)	Low
CVE-2025-11490	wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection	desktopcommandermcp	2.1 (v4.0)	Low
CVE-2025-11902	yanyutao0402 ChanCMS findField sql injection	chancms	2.1 (v4.0)	Low
CVE-2025-11903	yanyutao0402 ChanCMS update sql injection	chancms	2.1 (v4.0)	Low
CVE-2025-11905	yanyutao0402 ChanCMS gather.js getArticle code injection	chancms	2.1 (v4.0)	Low
CVE-2025-12266	Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection	Central Authentication Service	2.1 (v4.0)	Low
CVE-2025-14204	TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command inje	cherry-studio-TykoFork	2.1 (v4.0)	Low
CVE-2025-14731	CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine	ctcms	2.1 (v4.0)	Low
CVE-2026-10172	Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload	Multi-Store Inventory Management System	2.1 (v4.0)	Low
CVE-2026-101859	RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection	raspap-webgui	2.1 (v4.0)	Low
CVE-2026-101861	Langflow Code Execution via eval() in Component Input Schema	langflow	2.1 (v4.0)	Low
CVE-2026-10279	hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection	wezterm-mcp	2.1 (v4.0)	Low
CVE-2026-102906	0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection	github-mcp-server	2.1 (v4.0)	Low
CVE-2026-103540	formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine	Form Tools	2.1 (v4.0)	Low
CVE-2026-105329	TallCMS PluginManager ThemeManager.php code injection	TallCMS	2.1 (v4.0)	Low
CVE-2026-111986	AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection	stable-diffusion-webui	2.1 (v4.0)	Low
CVE-2026-112078	RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection	Retrieval-based-Voice-Conversion-WebUI	2.1 (v4.0)	Low
CVE-2026-11408	vertex-app vertex Log Viewer Endpoint LogMod.js os command injection	vertex	2.1 (v4.0)	Low
CVE-2026-12814	Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection	CF-WR631AX V3	2.1 (v4.0)	Low
CVE-2026-13560	Edimax EW-7478APC POST Request formAccept os command injection	EW-7478APC	2.1 (v4.0)	Low
CVE-2026-13561	Edimax EW-7478APC POST Request formiNICbasic os command injection	EW-7478APC	2.1 (v4.0)	Low
CVE-2026-13581	Edimax EW-7478APC POST Request formStaDrvSetup os command injection	EW-7478APC	2.1 (v4.0)	Low
CVE-2026-14691	SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code inject	Multi-Vendor Online Grocery Management System	2.1 (v4.0)	Low
CVE-2026-14698	SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload	Syllabus-Aligned Learning Management and Examination System	2.1 (v4.0)	Low
CVE-2026-15496	SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection	sonic-agent	2.1 (v4.0)	Low
CVE-2026-15512	pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection	Pig	2.1 (v4.0)	Low
CVE-2026-19932	DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection	Notice-System-Managent	2.1 (v4.0)	Low
CVE-2026-19958	iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection	pptr-mcp	2.1 (v4.0)	Low
CVE-2026-5351	Trendnet TEW-657BRM setup.cgi add_wps_client os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5352	Trendnet TEW-657BRM setup.cgi edit os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5353	Trendnet TEW-657BRM setup.cgi ping_test os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5354	Trendnet TEW-657BRM setup.cgi vpn_connect os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-5355	Trendnet TEW-657BRM setup.cgi vpn_drop os command injection	tew-657brm firmware	2.1 (v4.0)	Low
CVE-2026-6125	Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection	warm-flow	2.1 (v4.0)	Low
CVE-2026-6489	QueryMine sms Background Management addteacher.php unrestricted upload	sms	2.1 (v4.0)	Low
CVE-2026-7600	ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection	yii2-mcp-server	2.1 (v4.0)	Low
CVE-2026-7642	pskill9 website-downloader MCP index.ts download_website os command injection	website-downloader	2.1 (v4.0)	Low
CVE-2026-7653	r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection	mcp-server-rijksmuseum	2.1 (v4.0)	Low
CVE-2026-7683	Edimax BR-6428nC Web setWAN command injection	BR-6428nC	2.1 (v4.0)	Low
CVE-2026-78166	provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection	kafka-ui	2.1 (v4.0)	Low
CVE-2026-8188	Wavlink NU516U1 adm.cgi change_wifi_password os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8189	Wavlink NU516U1 adm.cgi wzdrepeater os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8190	Wavlink NU516U1 adm.cgi wan os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8191	Wavlink NU516U1 adm.cgi wifi_region os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8192	Wavlink NU516U1 adm.cgi wzdap os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8227	Wavlink NU516U1 adm.cgi wzdapMesh os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8228	Wavlink NU516U1 wireless.cgi advance os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8229	Wavlink NU516U1 wireless.cgi WifiBasic os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8230	Wavlink NU516U1 login.cgi sys_login1 os command injection	wl-nu516u1 firmware	2.1 (v4.0)	Low
CVE-2026-8264	Tenda AC6 httpd WifiApScan formWifiApScan os command injection	ac6 firmware	2.1 (v4.0)	Low
CVE-2026-90488	Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection	xxl-job	2.1 (v4.0)	Low
CVE-2026-90581	cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection	nginxWebUI	2.1 (v4.0)	Low
CVE-2026-91853	TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection	X5000R	2.1 (v4.0)	Low
CVE-2026-92993	Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection	mayfly-go	2.1 (v4.0)	Low
CVE-2026-9302	546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection	vps-inventory-monitoring	2.1 (v4.0)	Low
CVE-2026-9343	Edimax EW-7438RPn webs formWpsStart os command injection	EW-7438RPn	2.1 (v4.0)	Low
CVE-2026-9347	Edimax EW-7438RPn webs formWizSurvey os command injection	EW-7438RPn	2.1 (v4.0)	Low
CVE-2026-9424	Edimax EW-7438RPn Content-Type formWlanMP os command injection	EW-7438RPn	2.1 (v4.0)	Low
CVE-2026-9511	Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9512	Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9514	Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9515	Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9531	Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9532	Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9533	Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2026-9534	Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection	CA750-PoE	2.1 (v4.0)	Low
CVE-2025-11073	Keyfactor RG-EW5100BE HTTP POST Request cmd command injection	RG-EW5100BE	2.0 (v4.0)	Low
CVE-2025-11141	Ruijie NBR2100G-E branch_passw.php listAction os command injection	NBR2100G-E	2.0 (v4.0)	Low
CVE-2025-13198	DouPHP file.class.php unrestricted upload	DouPHP	2.0 (v4.0)	Low
CVE-2025-14729	CTCMS Content Management System Backend App Configuration Ct_App.php save code injection	ctcms	2.0 (v4.0)	Low
CVE-2025-14730	CTCMS Content Management System Backend System Configuration Ct_Config.php code injection	ctcms	2.0 (v4.0)	Low
CVE-2025-14837	ZZCMS Backend Website Settings siteconfig.php stripfxg code injection	zzcms	2.0 (v4.0)	Low
CVE-2025-15148	CmsEasy Backend Template Management template_admin.php savetemp_action code injection	cmseasy	2.0 (v4.0)	Low
CVE-2025-15394	iCMS POST Parameter ConfigAdmincp.php save code injection	icms	2.0 (v4.0)	Low
CVE-2026-105226	osCommerce osCommerce2 Newsletter Management newsletters.php include code injection	osCommerce2	2.0 (v4.0)	Low
CVE-2026-112195	FusionPBX Dialplan Editor dialplan.php os command injection	FusionPBX	2.0 (v4.0)	Low
CVE-2026-19964	Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection	Jij-MCP-Server	2.0 (v4.0)	Low
CVE-2026-5848	jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection	JimuReport	2.0 (v4.0)	Low
CVE-2026-81835	RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection	Roo-Code	2.0 (v4.0)	Low
CVE-2026-8259	Tenda AC6 httpd telnet os command injection	ac6 firmware	2.0 (v4.0)	Low
CVE-2026-8265	Tenda AC6 httpd getLogFile get_log_file os command injection	ac6 firmware	2.0 (v4.0)	Low
CVE-2026-82702	Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection	BR-6214K	2.0 (v4.0)	Low
CVE-2026-82703	Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection	BR-6214K	2.0 (v4.0)	Low
CVE-2026-85040	ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection	CRMEB	2.0 (v4.0)	Low
CVE-2026-90705	D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection	DWR-M921	2.0 (v4.0)	Low
CVE-2026-90706	D-Link DWR-M921 formWsc os command injection	DWR-M921	2.0 (v4.0)	Low
CVE-2026-90788	magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection	MacCMS10	2.0 (v4.0)	Low
CVE-2026-94103	RooCMS Frontend Rendering site_pagePHP.php eval code injection	RooCMS	2.0 (v4.0)	Low
CVE-2026-113388	opensource-socialnetwork Cache Settings dynamic.php input code injection	opensource-socialnetwork	1.9 (v4.0)	Low
CVE-2026-16129	princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist	SafestClaw	1.9 (v4.0)	Low
CVE-2026-5621	ChrisChinchilla Vale-MCP HTTP index.ts os command injection	Vale-MCP	1.9 (v4.0)	Low
CVE-2026-108827	Zen Cart Administrative Module Management general.php zen_call_function code injection	Zen Cart	1.2 (v4.0)	Low
CVE-2024-30850	Chaos RAT XSS to RCE	-	N/A	N/A

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-15	CVE-2026-45087
CWE-19	CVE-2016-4977
CWE-20	CVE-2021-44228 , CVE-2023-26068 , CVE-2025-34102 , CVE-2026-57499 , CVE-2026-24893 , CVE-2026-34197 , CVE-2026-35031 , CVE-2026-45505 , CVE-2026-84317 , CVE-2025-34115 , CVE-2026-28797 , CVE-2026-55094 , CVE-2026-54710 , CVE-2026-42588 , CVE-2025-60787 , CVE-2026-27891
CWE-22	CVE-2024-13984 , CVE-2026-7411 , CVE-2026-57155 , CVE-2019-3396 , CVE-2021-32682 , CVE-2019-25687 , CVE-2026-48768 , CVE-2026-64824 , CVE-2026-50006 , CVE-2026-35031 , CVE-2026-57296 , CVE-2026-82217 , CVE-2026-85731 , CVE-2019-25671 , CVE-2026-116009 , CVE-2026-40521 , CVE-2025-59711 , CVE-2026-19942 , CVE-2026-46581 , CVE-2026-53554 , CVE-2026-9777 , CVE-2025-59709 , CVE-2026-40909 , CVE-2026-4502 , CVE-2025-13262 , CVE-2011-0518
CWE-59	CVE-2026-85731 , CVE-2026-71964
CWE-73	CVE-2024-13984 , CVE-2026-57155 , CVE-2026-85520 , CVE-2025-65473 , CVE-2026-50006 , CVE-2025-58762
CWE-74	CVE-2013-2251 , CVE-2023-22527 , CVE-2023-4450 , CVE-2023-43661 , CVE-2026-45344 , CVE-2026-71320 , CVE-2022-43769 , CVE-2026-11450 , CVE-2026-116253 , CVE-2026-5739 , CVE-2025-13786 , CVE-2025-13792 , CVE-2026-112252 , CVE-2026-5333 , CVE-2026-5631 , CVE-2026-5736 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2026-9474 , CVE-2026-54543 , CVE-2023-7299 , CVE-2025-10097 , CVE-2025-11344 , CVE-2026-19785 , CVE-2025-11902 , CVE-2025-11903 , CVE-2025-11905 , CVE-2025-12266 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-15512 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-6125 , CVE-2026-7683 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-11073 , CVE-2025-14729 , CVE-2025-14730 , CVE-2025-14837 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-81835 , CVE-2026-94103 , CVE-2026-113388 , CVE-2026-108827
CWE-77	CVE-2026-105134 , CVE-2026-108576 , CVE-2026-26015 , CVE-2026-72869 , CVE-2021-1498 , CVE-2022-40881 , CVE-2023-50917 , CVE-2026-35847 , CVE-2026-8037 , CVE-2026-47670 , CVE-2025-10364 , CVE-2025-59735 , CVE-2025-59736 , CVE-2025-59737 , CVE-2025-59738 , CVE-2025-59739 , CVE-2025-59740 , CVE-2025-59741 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-102240 , CVE-2026-108804 , CVE-2026-41304 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9408 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2017-11391 , CVE-2017-11392 , CVE-2020-15874 , CVE-2023-1389 , CVE-2025-51457 , CVE-2026-88622 , CVE-2025-4008 , CVE-2026-100896 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-108894 , CVE-2026-109108 , CVE-2026-113390 , CVE-2026-113506 , CVE-2026-55182 , CVE-2026-82692 , CVE-2026-85223 , CVE-2026-86299 , CVE-2026-90699 , CVE-2026-101009 , CVE-2026-82690 , CVE-2026-82691 , CVE-2026-85222 , CVE-2026-85224 , CVE-2026-90702 , CVE-2026-90703 , CVE-2026-92397 , CVE-2026-92398 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2026-36540 , CVE-2018-12465 , CVE-2025-32813 , CVE-2024-12987 , CVE-2026-11450 , CVE-2026-19983 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5333 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7062 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90619 , CVE-2026-90690 , CVE-2026-90843 , CVE-2026-15485 , CVE-2026-5547 , CVE-2025-11138 , CVE-2025-11490 , CVE-2025-14204 , CVE-2026-101859 , CVE-2026-10279 , CVE-2026-102906 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-13560 , CVE-2026-13561 , CVE-2026-13581 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7600 , CVE-2026-7642 , CVE-2026-7653 , CVE-2026-7683 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-8264 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9343 , CVE-2026-9347 , CVE-2026-9424 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11073 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-8259 , CVE-2026-8265 , CVE-2026-82702 , CVE-2026-82703 , CVE-2026-85040 , CVE-2026-90705 , CVE-2026-90706 , CVE-2026-90788 , CVE-2026-5621
CWE-78	CVE-2011-10017 , CVE-2025-34037 , CVE-2026-100382 , CVE-2026-105134 , CVE-2026-108576 , CVE-2026-19188 , CVE-2026-34234 , CVE-2026-41900 , CVE-2026-45087 , CVE-2026-49869 , CVE-2026-105691 , CVE-2026-105697 , CVE-2026-105740 , CVE-2026-34038 , CVE-2026-40933 , CVE-2026-42454 , CVE-2026-45629 , CVE-2026-45632 , CVE-2026-48030 , CVE-2026-57155 , CVE-2026-63298 , CVE-2026-72738 , CVE-2026-72740 , CVE-2026-72865 , CVE-2026-72868 , CVE-2026-72869 , CVE-2026-72872 , CVE-2026-72876 , CVE-2026-72882 , CVE-2026-72902 , CVE-2026-73263 , CVE-2026-73294 , CVE-2017-17105 , CVE-2018-7890 , CVE-2019-12780 , CVE-2019-12988 , CVE-2021-1497 , CVE-2021-1498 , CVE-2021-32682 , CVE-2021-36260 , CVE-2022-29303 , CVE-2022-44877 , CVE-2023-3368 , CVE-2023-46359 , CVE-2024-2389 , CVE-2024-50603 , CVE-2025-66401 , CVE-2026-110392 , CVE-2026-12940 , CVE-2026-15733 , CVE-2026-18482 , CVE-2026-37281 , CVE-2026-42846 , CVE-2026-45018 , CVE-2026-45695 , CVE-2026-45748 , CVE-2026-48687 , CVE-2026-49819 , CVE-2026-53545 , CVE-2026-57124 , CVE-2026-79408 , CVE-2026-35906 , CVE-2026-72878 , CVE-2014-125118 , CVE-2020-36856 , CVE-2025-34152 , CVE-2025-66210 , CVE-2026-103056 , CVE-2026-47670 , CVE-2026-58146 , CVE-2026-63732 , CVE-2026-6644 , CVE-2026-72879 , CVE-2026-73483 , CVE-2009-20010 , CVE-2025-2611 , CVE-2025-32778 , CVE-2025-34102 , CVE-2025-59735 , CVE-2025-59736 , CVE-2025-59737 , CVE-2025-59738 , CVE-2025-59739 , CVE-2025-59740 , CVE-2025-59741 , CVE-2025-71284 , CVE-2025-71336 , CVE-2025-71429 , CVE-2026-101001 , CVE-2026-101072 , CVE-2026-101075 , CVE-2026-101076 , CVE-2026-102240 , CVE-2026-105110 , CVE-2026-107780 , CVE-2026-108804 , CVE-2026-113802 , CVE-2026-19586 , CVE-2026-34106 , CVE-2026-34108 , CVE-2026-34109 , CVE-2026-34110 , CVE-2026-34111 , CVE-2026-34112 , CVE-2026-34115 , CVE-2026-41315 , CVE-2026-41923 , CVE-2026-41925 , CVE-2026-53975 , CVE-2026-58147 , CVE-2026-58457 , CVE-2026-59111 , CVE-2026-60121 , CVE-2026-61498 , CVE-2026-63766 , CVE-2026-64625 , CVE-2026-67308 , CVE-2026-71921 , CVE-2026-71944 , CVE-2026-71945 , CVE-2026-71946 , CVE-2026-71947 , CVE-2026-71948 , CVE-2026-71949 , CVE-2026-71950 , CVE-2026-71951 , CVE-2026-71952 , CVE-2026-71953 , CVE-2026-71954 , CVE-2026-71955 , CVE-2026-71956 , CVE-2026-71984 , CVE-2026-71992 , CVE-2026-89308 , CVE-2026-27175 , CVE-2026-59800 , CVE-2026-63304 , CVE-2026-63305 , CVE-2026-80138 , CVE-2025-66203 , CVE-2026-10131 , CVE-2026-10135 , CVE-2026-12486 , CVE-2026-12849 , CVE-2026-12850 , CVE-2026-12851 , CVE-2026-33568 , CVE-2026-35499 , CVE-2026-40627 , CVE-2026-57499 , CVE-2026-79766 , CVE-2026-79916 , CVE-2026-9814 , CVE-2026-102608 , CVE-2026-45630 , CVE-2026-45750 , CVE-2026-91931 , CVE-2026-33765 , CVE-2026-5850 , CVE-2026-5851 , CVE-2026-5852 , CVE-2026-5853 , CVE-2026-5854 , CVE-2026-5975 , CVE-2026-5976 , CVE-2026-5977 , CVE-2026-5978 , CVE-2026-5993 , CVE-2026-5994 , CVE-2026-5996 , CVE-2026-5997 , CVE-2026-6025 , CVE-2026-6026 , CVE-2026-6028 , CVE-2026-6029 , CVE-2026-6112 , CVE-2026-6113 , CVE-2026-6114 , CVE-2026-6115 , CVE-2026-6116 , CVE-2026-6131 , CVE-2026-6132 , CVE-2026-6138 , CVE-2026-6139 , CVE-2026-6140 , CVE-2026-6154 , CVE-2026-6155 , CVE-2026-6156 , CVE-2026-6195 , CVE-2026-7121 , CVE-2026-7122 , CVE-2026-7123 , CVE-2026-7124 , CVE-2026-7125 , CVE-2026-7136 , CVE-2026-7137 , CVE-2026-7138 , CVE-2026-7139 , CVE-2026-7140 , CVE-2026-7152 , CVE-2026-7153 , CVE-2026-7154 , CVE-2026-7155 , CVE-2026-7156 , CVE-2026-7202 , CVE-2026-7203 , CVE-2026-7204 , CVE-2026-7240 , CVE-2026-7241 , CVE-2026-7242 , CVE-2026-7243 , CVE-2026-7244 , CVE-2026-73570 , CVE-2026-7538 , CVE-2026-7823 , CVE-2026-9384 , CVE-2026-9385 , CVE-2026-9386 , CVE-2026-9387 , CVE-2026-9388 , CVE-2026-9404 , CVE-2026-9405 , CVE-2026-9406 , CVE-2026-9407 , CVE-2026-9408 , CVE-2026-9432 , CVE-2026-9433 , CVE-2026-9434 , CVE-2026-9435 , CVE-2026-9436 , CVE-2026-9454 , CVE-2026-9455 , CVE-2026-9456 , CVE-2026-9457 , CVE-2026-9458 , CVE-2026-9476 , CVE-2026-9477 , CVE-2026-9478 , CVE-2017-17405 , CVE-2017-6884 , CVE-2018-16660 , CVE-2018-20323 , CVE-2020-12109 , CVE-2020-7351 , CVE-2021-3577 , CVE-2023-34127 , CVE-2025-30004 , CVE-2025-66209 , CVE-2026-105106 , CVE-2026-105797 , CVE-2026-110908 , CVE-2026-24893 , CVE-2026-26899 , CVE-2026-30971 , CVE-2026-34057 , CVE-2026-34153 , CVE-2026-34158 , CVE-2026-34197 , CVE-2026-34594 , CVE-2026-34599 , CVE-2026-35196 , CVE-2026-35519 , CVE-2026-35520 , CVE-2026-41208 , CVE-2026-45578 , CVE-2026-45662 , CVE-2026-52483 , CVE-2026-52484 , CVE-2026-54149 , CVE-2026-58195 , CVE-2026-59734 , CVE-2026-62312 , CVE-2026-72875 , CVE-2026-73222 , CVE-2026-77601 , CVE-2026-79423 , CVE-2026-82804 , CVE-2005-10004 , CVE-2013-10039 , CVE-2015-10145 , CVE-2025-30007 , CVE-2025-34115 , CVE-2025-34311 , CVE-2025-34312 , CVE-2025-34334 , CVE-2026-100852 , CVE-2026-28797 , CVE-2026-34791 , CVE-2026-34792 , CVE-2026-34793 , CVE-2026-34794 , CVE-2026-34795 , CVE-2026-34796 , CVE-2026-34797 , CVE-2026-46746 , CVE-2026-58000 , CVE-2026-58452 , CVE-2026-69096 , CVE-2026-71966 , CVE-2026-72870 , CVE-2026-72874 , CVE-2026-73680 , CVE-2026-76060 , CVE-2026-79756 , CVE-2026-90770 , CVE-2026-92580 , CVE-2023-47105 , CVE-2025-68700 , CVE-2026-100896 , CVE-2026-102911 , CVE-2026-108540 , CVE-2026-108894 , CVE-2026-109108 , CVE-2026-111214 , CVE-2026-111217 , CVE-2026-111218 , CVE-2026-113390 , CVE-2026-113506 , CVE-2026-22100 , CVE-2026-40187 , CVE-2026-53804 , CVE-2026-5917 , CVE-2026-61517 , CVE-2026-63725 , CVE-2026-65711 , CVE-2026-67599 , CVE-2026-71906 , CVE-2026-71907 , CVE-2026-71908 , CVE-2026-71913 , CVE-2026-71915 , CVE-2026-71918 , CVE-2026-71919 , CVE-2026-71923 , CVE-2026-71924 , CVE-2026-71925 , CVE-2026-71926 , CVE-2026-71927 , CVE-2026-71928 , CVE-2026-71929 , CVE-2026-71930 , CVE-2026-71931 , CVE-2026-71943 , CVE-2026-75121 , CVE-2026-75122 , CVE-2026-75123 , CVE-2026-80214 , CVE-2026-82692 , CVE-2026-84194 , CVE-2026-85223 , CVE-2026-86299 , CVE-2026-86733 , CVE-2026-90699 , CVE-2026-101009 , CVE-2026-82690 , CVE-2026-82691 , CVE-2026-85222 , CVE-2026-85224 , CVE-2026-90702 , CVE-2026-90703 , CVE-2026-92397 , CVE-2026-92398 , CVE-2026-55786 , CVE-2024-58274 , CVE-2025-69755 , CVE-2018-6961 , CVE-2026-48695 , CVE-2026-55173 , CVE-2026-79755 , CVE-2021-21315 , CVE-2026-108161 , CVE-2026-57999 , CVE-2026-53534 , CVE-2025-67888 , CVE-2026-10870 , CVE-2026-10871 , CVE-2026-10873 , CVE-2026-18900 , CVE-2026-19771 , CVE-2018-12465 , CVE-2020-8816 , CVE-2021-33544 , CVE-2025-58763 , CVE-2025-60787 , CVE-2026-28409 , CVE-2026-71284 , CVE-2026-81669 , CVE-2026-92263 , CVE-2026-48997 , CVE-2026-58502 , CVE-2024-12987 , CVE-2026-19983 , CVE-2026-79761 , CVE-2026-55679 , CVE-2026-72739 , CVE-2026-45626 , CVE-2026-10214 , CVE-2026-102874 , CVE-2026-18641 , CVE-2026-19379 , CVE-2026-5677 , CVE-2026-5678 , CVE-2026-5688 , CVE-2026-5689 , CVE-2026-5690 , CVE-2026-5691 , CVE-2026-5692 , CVE-2026-5741 , CVE-2026-5802 , CVE-2026-7061 , CVE-2026-7062 , CVE-2026-7064 , CVE-2026-7066 , CVE-2026-7220 , CVE-2026-7416 , CVE-2026-7443 , CVE-2026-7590 , CVE-2026-76761 , CVE-2026-7698 , CVE-2026-90617 , CVE-2026-90619 , CVE-2026-90690 , CVE-2026-90843 , CVE-2026-15485 , CVE-2026-5547 , CVE-2026-42201 , CVE-2025-11138 , CVE-2025-11490 , CVE-2025-14204 , CVE-2026-101859 , CVE-2026-10279 , CVE-2026-102906 , CVE-2026-11408 , CVE-2026-12814 , CVE-2026-13560 , CVE-2026-13561 , CVE-2026-13581 , CVE-2026-15496 , CVE-2026-5351 , CVE-2026-5352 , CVE-2026-5353 , CVE-2026-5354 , CVE-2026-5355 , CVE-2026-7600 , CVE-2026-7642 , CVE-2026-7653 , CVE-2026-8188 , CVE-2026-8189 , CVE-2026-8190 , CVE-2026-8191 , CVE-2026-8192 , CVE-2026-8227 , CVE-2026-8228 , CVE-2026-8229 , CVE-2026-8230 , CVE-2026-8264 , CVE-2026-91853 , CVE-2026-92993 , CVE-2026-9343 , CVE-2026-9347 , CVE-2026-9424 , CVE-2026-9511 , CVE-2026-9512 , CVE-2026-9514 , CVE-2026-9515 , CVE-2026-9531 , CVE-2026-9532 , CVE-2026-9533 , CVE-2026-9534 , CVE-2025-11141 , CVE-2026-112195 , CVE-2026-8259 , CVE-2026-8265 , CVE-2026-82702 , CVE-2026-82703 , CVE-2026-85040 , CVE-2026-90705 , CVE-2026-90706 , CVE-2026-90788 , CVE-2026-5621
CWE-79	CVE-2026-73041 , CVE-2026-73042 , CVE-2026-48768 , CVE-2024-39024 , CVE-2026-104078 , CVE-2017-7896 , CVE-2023-5244 , CVE-2026-58391 , CVE-2025-59751 , CVE-2025-59752 , CVE-2025-59753 , CVE-2025-59754 , CVE-2025-59759 , CVE-2025-59773 , CVE-2025-59774 , CVE-2024-31839
CWE-83	CVE-2026-58391
CWE-88	CVE-2026-57572 , CVE-2026-113708 , CVE-2026-44450 , CVE-2026-73294 , CVE-2026-100714 , CVE-2026-40281 , CVE-2026-108963 , CVE-2026-107639 , CVE-2026-47250
CWE-89	CVE-2026-55634 , CVE-2018-12464 , CVE-2020-5722 , CVE-2022-27927 , CVE-2022-40032 , CVE-2022-40347 , CVE-2026-38428 , CVE-2026-33324 , CVE-2025-34102 , CVE-2026-34612 , CVE-2026-32271 , CVE-2023-34133 , CVE-2026-55679 , CVE-2026-112252 , CVE-2026-5736 , CVE-2026-9474 , CVE-2023-7299 , CVE-2026-19785 , CVE-2025-11902 , CVE-2025-11903
CWE-93	CVE-2026-84372 , CVE-2026-35519 , CVE-2026-35520 , CVE-2026-111221
CWE-94	CVE-2022-22947 , CVE-2026-10134 , CVE-2026-41900 , CVE-2026-53753 , CVE-2026-57572 , CVE-2026-8984 , CVE-2025-11539 , CVE-2026-46512 , CVE-2026-55565 , CVE-2026-55634 , CVE-2026-8481 , CVE-2020-11546 , CVE-2020-8644 , CVE-2022-22954 , CVE-2022-42889 , CVE-2023-25717 , CVE-2024-32641 , CVE-2025-29306 , CVE-2025-65719 , CVE-2026-104586 , CVE-2026-30993 , CVE-2026-31040 , CVE-2026-38431 , CVE-2026-3960 , CVE-2026-4257 , CVE-2026-46562 , CVE-2026-51861 , CVE-2026-51866 , CVE-2026-51886 , CVE-2026-51911 , CVE-2026-55559 , CVE-2026-57131 , CVE-2026-62379 , CVE-2026-67827 , CVE-2026-67919 , CVE-2026-75031 , CVE-2026-75411 , CVE-2026-75414 , CVE-2026-79538 , CVE-2026-83627 , CVE-2026-86793 , CVE-2026-88393 , CVE-2026-48519 , CVE-2026-70477 , CVE-2026-88062 , CVE-2025-62593 , CVE-2026-45272 , CVE-2026-55413 , CVE-2026-69256 , CVE-2026-82244 , CVE-2026-93985 , CVE-2026-108598 , CVE-2026-12257 , CVE-2026-29014 , CVE-2026-58138 , CVE-2026-65008 , CVE-2026-70553 , CVE-2026-96754 , CVE-2026-114053 , CVE-2026-82531 , CVE-2026-37637 , CVE-2026-46621 , CVE-2026-55511 , CVE-2026-58400 , CVE-2026-42238 , CVE-2026-47252 , CVE-2026-62674 , CVE-2026-69251 , CVE-2026-73485 , CVE-2026-73486 , CVE-2026-73487 , CVE-2026-43945 , CVE-2022-4223 , CVE-2023-43661 , CVE-2024-41667 , CVE-2025-4428 , CVE-2025-66438 , CVE-2026-104851 , CVE-2026-34197 , CVE-2026-4327 , CVE-2026-45505 , CVE-2026-48017 , CVE-2026-55585 , CVE-2026-62675 , CVE-2026-6543 , CVE-2026-65660 , CVE-2026-78834 , CVE-2026-96795 , CVE-2022-50944 , CVE-2025-66294 , CVE-2026-100856 , CVE-2026-100864 , CVE-2026-109308 , CVE-2026-116811 , CVE-2026-28797 , CVE-2026-34965 , CVE-2026-49143 , CVE-2026-55094 , CVE-2026-64850 , CVE-2026-69100 , CVE-2026-72819 , CVE-2026-76836 , CVE-2026-82278 , CVE-2026-85604 , CVE-2026-85610 , CVE-2026-86732 , CVE-2026-42785 , CVE-2026-54710 , CVE-2026-56382 , CVE-2026-56703 , CVE-2026-61523 , CVE-2026-65693 , CVE-2026-69088 , CVE-2026-22244 , CVE-2026-42588 , CVE-2026-47398 , CVE-2026-71320 , CVE-2026-105764 , CVE-2012-5223 , CVE-2026-46581 , CVE-2026-108593 , CVE-2022-43769 , CVE-2025-62429 , CVE-2026-13392 , CVE-2026-77939 , CVE-2026-116253 , CVE-2026-5739 , CVE-2013-4212 , CVE-2026-55679 , CVE-2026-44287 , CVE-2025-13786 , CVE-2025-13792 , CVE-2026-54611 , CVE-2026-5631 , CVE-2026-76760 , CVE-2026-82598 , CVE-2026-85137 , CVE-2025-10097 , CVE-2025-11344 , CVE-2026-29202 , CVE-2026-112949 , CVE-2025-11905 , CVE-2025-12266 , CVE-2026-101861 , CVE-2026-105329 , CVE-2026-111986 , CVE-2026-112078 , CVE-2026-14691 , CVE-2026-15512 , CVE-2026-19932 , CVE-2026-19958 , CVE-2026-6125 , CVE-2026-78166 , CVE-2026-90488 , CVE-2026-90581 , CVE-2026-9302 , CVE-2025-14729 , CVE-2025-14730 , CVE-2025-14837 , CVE-2025-15148 , CVE-2025-15394 , CVE-2026-105226 , CVE-2026-19964 , CVE-2026-5848 , CVE-2026-81835 , CVE-2026-94103 , CVE-2026-113388 , CVE-2026-108827
CWE-95	CVE-2013-10070 , CVE-2026-46562 , CVE-2026-47391 , CVE-2026-39932 , CVE-2025-31114 , CVE-2026-61511 , CVE-2026-55094 , CVE-2026-40187 , CVE-2025-48868 , CVE-2026-101861
CWE-98	CVE-2026-39353
CWE-116	CVE-2022-36446 , CVE-2025-60787 , CVE-2026-112949
CWE-120	CVE-2026-36796
CWE-121	CVE-2026-76070 , CVE-2026-76071 , CVE-2026-36783
CWE-183	CVE-2026-16129
CWE-184	CVE-2026-49869 , CVE-2026-41934 , CVE-2026-44287 , CVE-2026-16129
CWE-187	CVE-2026-35031
CWE-200	CVE-2025-69755 , CVE-2026-51078
CWE-250	CVE-2026-41900 , CVE-2026-9209 , CVE-2026-55094
CWE-253	CVE-2026-15686
CWE-266	CVE-2026-101860
CWE-269	CVE-2026-45632 , CVE-2026-104798 , CVE-2026-49819 , CVE-2026-40484 , CVE-2026-76801 , CVE-2026-72830 , CVE-2026-73664 , CVE-2026-101860
CWE-276	CVE-2025-34332 , CVE-2025-34333
CWE-284	CVE-2026-34234 , CVE-2026-41900 , CVE-2019-2729 , CVE-2026-50006 , CVE-2026-43945 , CVE-2026-73664 , CVE-2026-11344 , CVE-2026-11474 , CVE-2025-63739 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-285	CVE-2025-66301 , CVE-2026-34239
CWE-287	CVE-2026-49869 , CVE-2015-1187 , CVE-2017-14706 , CVE-2023-34124 , CVE-2025-27621
CWE-288	CVE-2026-43945 , CVE-2025-4427
CWE-305	CVE-2023-34124
CWE-306	CVE-2026-45087 , CVE-2026-81735 , CVE-2022-1388 , CVE-2026-45695 , CVE-2026-47391 , CVE-2026-49819 , CVE-2026-57124 , CVE-2026-57131 , CVE-2026-53649 , CVE-2026-88062 , CVE-2014-125118 , CVE-2025-34102 , CVE-2026-105110 , CVE-2026-9209 , CVE-2026-73222 , CVE-2023-54350 , CVE-2025-34115 , CVE-2025-4008 , CVE-2026-55094 , CVE-2026-63722 , CVE-2026-55786 , CVE-2026-49471 , CVE-2026-112949
CWE-350	CVE-2026-97875
CWE-352	CVE-2026-53649 , CVE-2025-62593 , CVE-2025-56798 , CVE-2026-73222 , CVE-2026-34228 , CVE-2026-49471
CWE-362	CVE-2026-42099
CWE-400	CVE-2021-44228
CWE-434	CVE-2022-44276 , CVE-2026-103889 , CVE-2026-72592 , CVE-2026-107188 , CVE-2026-53649 , CVE-2009-20006 , CVE-2024-58348 , CVE-2026-35047 , CVE-2026-44402 , CVE-2023-7305 , CVE-2026-40484 , CVE-2026-50006 , CVE-2026-58409 , CVE-2025-59710 , CVE-2025-65471 , CVE-2026-33704 , CVE-2021-47943 , CVE-2026-105123 , CVE-2026-34735 , CVE-2026-40488 , CVE-2026-67206 , CVE-2026-109397 , CVE-2026-23698 , CVE-2026-41587 , CVE-2026-53599 , CVE-2026-27891 , CVE-2026-11344 , CVE-2026-11474 , CVE-2026-54611 , CVE-2026-10172 , CVE-2026-14698 , CVE-2026-6489 , CVE-2025-13198
CWE-470	CVE-2026-46562 , CVE-2026-55559 , CVE-2026-62379 , CVE-2026-58400 , CVE-2026-79987 , CVE-2025-68455 , CVE-2026-6020 , CVE-2026-34216
CWE-479	CVE-2026-44011
CWE-494	CVE-2026-66398 , CVE-2026-107812
CWE-502	CVE-2021-44228 , CVE-2025-55182
CWE-552	CVE-2026-40484
CWE-639	CVE-2026-72876 , CVE-2026-45750
CWE-641	CVE-2026-46581
CWE-644	CVE-2026-67179
CWE-647	CVE-2022-43939
CWE-669	CVE-2026-38924
CWE-693	CVE-2026-41900 , CVE-2026-39353 , CVE-2026-84317 , CVE-2026-84318
CWE-732	CVE-2026-39353 , CVE-2026-73664
CWE-791	CVE-2025-14731 , CVE-2026-103540
CWE-829	CVE-2026-45272 , CVE-2026-47398
CWE-835	CVE-2024-20353
CWE-836	CVE-2023-34132
CWE-862	CVE-2026-45632 , CVE-2026-72868 , CVE-2026-72876 , CVE-2026-79920 , CVE-2026-49819 , CVE-2026-57131 , CVE-2026-41315 , CVE-2026-50006 , CVE-2022-4223 , CVE-2026-86438 , CVE-2025-11372 , CVE-2025-67737
CWE-863	CVE-2026-43945 , CVE-2021-3577 , CVE-2026-105797 , CVE-2026-76836
CWE-913	CVE-2026-53753
CWE-915	CVE-2026-72710 , CVE-2026-78416
CWE-917	CVE-2021-44228 , CVE-2022-22947 , CVE-2021-45046 , CVE-2019-16469
CWE-918	CVE-2026-49869 , CVE-2021-22986 , CVE-2021-32682
CWE-942	CVE-2026-34449 , CVE-2026-53649
CWE-1188	CVE-2026-104078
CWE-1336	CVE-2026-44181 , CVE-2026-55559 , CVE-2025-66438 , CVE-2026-104851 , CVE-2025-66294 , CVE-2026-105985 , CVE-2026-28797 , CVE-2026-72827 , CVE-2025-49619 , CVE-2026-22244 , CVE-2026-77939 , CVE-2025-14731 , CVE-2026-103540
CWE-1392	CVE-2026-41939

Atomicorp WAF Rule 393655

Rule Summary

Description

Selected Related CVEs

Observed CWEs