CWE-78: OS command injection
7,247 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 124 of them as exploited in the wild.
- Published CVEs
- 7,247
- Last 12 months
- 2,365
- Critical
- 2,288
- Known exploited
- 124
Critical 2,288High 3,706Medium 1,211Low 40Not scored 2
CVEs per yearBy the year they were published
- 201534
- 201631
- 2017158
- 2018335
- 2019394
- 2020538
- 2021492
- 2022585
- 2023598
- 2024802
- 2025903
- 20262,212
Known exploitedNewest addition to KEV first
- CVE-2026-110447
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September…
Collabora · Collabora Online - Built-in CODE Server
ExploitedCritical9.2 - CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM…
EG Secure Solutions Inc. · SiteGuard Server Edition for Apache httpd
ExploitedHigh8.5 - CVE-2026-105134
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
Ahsay · AhsayCBS
ExploitedCritical10.0 - CVE-2026-83549
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000…
SonicWall · SMA1000
ExploitedHigh7.8 - CVE-2026-49869
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
kestra-io · kestra
ExploitedCritical10.0 - CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP…
Zimbra · Collaboration
ExploitedHigh8.9 - CVE-2026-16812
VeloCloud Orchestrator OS Command Injection
Arista Networks · VeloCloud Orchestrator On-Prem
ExploitedCritical10.0 - CVE-2026-25089
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,…
Fortinet · FortiSandbox
ExploitedCritical9.1 - CVE-2026-39808
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may…
Fortinet · FortiSandbox
ExploitedCritical9.1 - CVE-2025-67038
Lantronix EDS5000, G520, and X300 OS Command Injection
Lantronix · EDS5000 series
ExploitedCritical9.3
Newest CVEs
- CVE-2026-6715
Multiple Vulnerabilities in IBM Concert Software
IBM · Concert
Critical9.8 - CVE-2026-15266
Multiple Vulnerabilities in IBM Concert Software
IBM · Concert
Critical9.8 - CVE-2026-119670
Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data Management
IBM · Storage Copy Data Management
Medium6.3 - CVE-2026-17408
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.8 - CVE-2026-17402
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.9 - CVE-2026-102610
fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
evalstate · fast-agent
Medium6.4 - CVE-2026-33050
GeoNode: OS command injection via uploaded file layer name
GeoNode · geonode
High8.8 - CVE-2026-123357
GROBID is vulnerable to OS command injection through crafted PDF filenames
grobidOrg · grobid
None0.0 - CVE-2026-122193
OS command injection in the example SSM documents in Trusted Remote Execution (REX)
AWS · trusted-remote-execution
Critical9.3 - CVE-2026-123855
In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs
JetBrains · Toolbox App
High7.5