CWE-74: Injection
5,750 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 13 of them as exploited in the wild.
- Published CVEs
- 5,750
- Last 12 months
- 2,267
- Critical
- 318
- Known exploited
- 13
Critical 318High 570Medium 4,794Low 67Not scored 1
CVEs per yearBy the year they were published
- 201516
- 201610
- 201766
- 201845
- 2019102
- 2020193
- 2021171
- 2022123
- 2023184
- 2024329
- 20252,569
- 20261,929
Known exploitedNewest addition to KEV first
- CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0 - CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0 - CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Hitachi Vantara · Pentaho Business Analytics Server
ExploitedHigh8.8 - CVE-2023-22527
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…
Atlassian · Confluence Data Center
ExploitedCritical10.0 - CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Product not named
ExploitedCritical9.8 - CVE-2022-46169
Unauthenticated Command Injection
Cacti · cacti
ExploitedCritical9.8 - CVE-2022-27924
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache…
Product not named
ExploitedCritical9.8 - CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or…
Product not named
ExploitedCritical9.8 - CVE-2019-11581
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker…
Atlassian · Jira Server and Data Center
ExploitedCritical9.8 - CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are…
Oracle Corporation · Tape Library ACSLS
ExploitedHigh7.5
Newest CVEs
- CVE-2026-124499
Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection
Fengoffice · Feng Office
Medium5.1 - CVE-2026-124331
Jinher OA ProjectAfficheManage.aspx sql injection
Jinher · OA
Medium6.9 - CVE-2026-124328
FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection
FlowCI · flow-core-x
Medium5.3 - CVE-2026-123535
Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age
tornadoweb · tornado
Low2.3 - CVE-2026-123990
DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection
DataEase
Medium6.9 - CVE-2026-66981
HCL AION is affected by multiple security vulnerabilities.
HCL Software · HCL AION
Medium6.5 - CVE-2026-123675
OpenBMB Internet of Agents Code Executor Tool code_executor.py execute_code code injection
OpenBMB · Internet of Agents
Medium6.9 - CVE-2026-118166
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag
Unknown · MC4WP: Mailchimp for WordPress
Medium4.8 - CVE-2026-85076
Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
jhuckaby · Cronicle
Critical9.0 - CVE-2026-123028
itsourcecode Online Book Store admin_edit.php sql injection
itsourcecode · Online Book Store
Medium6.9