CWE-88: Argument injection
522 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 5 of them as exploited in the wild.
- Published CVEs
- 522
- Last 12 months
- 244
- Critical
- 112
- Known exploited
- 5
Critical 112High 261Medium 131Low 18Not scored 0
CVEs per yearBy the year they were published
- 20071
- 20161
- 20173
- 201814
- 201939
- 202022
- 202128
- 202248
- 202319
- 202436
- 202551
- 2026239
Known exploitedNewest addition to KEV first
- CVE-2026-86060
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
Mikrotik · RouterOS
ExploitedCritical9.2 - CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
GNU · Inetutils
ExploitedCritical9.8 - CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and…
Product not named
ExploitedCritical9.8 - CVE-2024-41710
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could…
Product not named
ExploitedMedium6.8 - CVE-2022-36804
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version…
Atlassian · Bitbucket Server
ExploitedHigh8.8
Newest CVEs
- CVE-2026-82830
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM · Guardium Data Protection
Medium6.7 - CVE-2026-17410
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.9 - CVE-2026-17062
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Low2.7 - CVE-2026-123285
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
JetBrains · Datalore
Medium6.3 - CVE-2026-123281
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
JetBrains · Datalore
High7.5 - CVE-2026-110930
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an…
OpenAI · Codex Desktop for Windows
High8.0 - CVE-2026-82413
ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)
ntop · ntopng
High8.8 - CVE-2026-123014
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the…
iTerm2 · iTerm2
High8.7 - CVE-2026-121749
nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
nvm-sh · nvm
Medium4.6 - CVE-2026-97350
Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows
Securepoint · Securepoint SSL VPN Client v2
Medium6.9