CWE-77: Command injection
4,014 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 40 of them as exploited in the wild.
- Published CVEs
- 4,014
- Last 12 months
- 1,250
- Critical
- 1,141
- Known exploited
- 40
Critical 1,141High 1,505Medium 1,322Low 44Not scored 2
CVEs per yearBy the year they were published
- 201539
- 201629
- 2017106
- 201872
- 2019129
- 2020153
- 2021300
- 2022239
- 2023519
- 2024510
- 2025763
- 20261,130
Known exploitedNewest addition to KEV first
- CVE-2026-105134
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
Ahsay · AhsayCBS
ExploitedCritical10.0 - CVE-2026-96951
Windows Shell Security Feature Bypass Vulnerability
Microsoft · Microsoft Edge (Chromium-based)
ExploitedHigh8.8 - CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…
Product not named
ExploitedHigh8.1 - CVE-2026-8037
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Progress Software · LoadMaster
ExploitedCritical9.6 - CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test endpoints
BerriAI · litellm
ExploitedHigh8.7 - CVE-2025-29635
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending…
Product not named
ExploitedHigh7.2 - CVE-2026-22719
VMware Aria Operations command injection vulnerability
VMware · VMware Aria Operations
ExploitedHigh8.1 - CVE-2025-4008
Arbitrary Command Injection in Smartbedded MeteoBridge
Smartbedded · MeteoBridge
ExploitedHigh8.7 - CVE-2025-59689
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For…
Libraesva · Email Security Gateway
ExploitedMedium6.1 - CVE-2025-10035
Deserialization Vulnerability in GoAnywhere MFT's License Servlet
Fortra · GoAnywhere MFT
ExploitedCritical10.0
Newest CVEs
- CVE-2026-116779
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
signalwire · freeswitch
Critical9.8 - CVE-2026-116786
FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia
signalwire · freeswitch
High8.8 - CVE-2026-82413
ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)
ntop · ntopng
High8.8 - CVE-2026-123022
agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection
agentscope-ai · AgentScope
Medium6.9 - CVE-2026-122157
Purocean Yank Note Terminal index.ts checkPermission os command injection
Purocean · Yank Note
Medium5.3 - CVE-2026-122051
Edimax BR-6208AC mp command injection
Edimax · BR-6208AC
Critical10.0 - CVE-2026-97693
Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise
xerrors · Yuxi
Critical9.9 - CVE-2026-121932
Linksys E5350 apply.cgi system os command injection
Linksys · E5350
Critical10.0 - CVE-2026-121931
Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection
Linksys · WRT54GL
Critical9.4 - CVE-2026-121930
Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection
Linksys · WRT54GL
Critical9.4