CWE-77 · weakness in Command and Code Injection
Command Injection
3,181 CVEs · 33 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 33
- check available
- 38
- likely to be exploited
- 240
Every one of the 3,181 is a mark on the map. Named now: 1 to 26, most at risk first.
- GlobalProtect - OS Command Injection
Palo Alto NetworksSalt Typhoon2 articles1 article this week: SOCRadar expands MCP server with 126 tools for security teams
- Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection
- Sophos Web Appliance - Remote Code Execution
- TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection
- PHP CGI v5.3.12/5.4.2 Remote Code Execution
- D-Link Network Attached Storage - Command Injection and Backdoor Account
- GoAnywhere - Authentication Bypass
- Progress ADC LoadMaster - Command Injection
- NETGEAR WNAP320 Access Point Firmware - Remote Command Injection
- VMware VRealize Network Insight - Remote Code Execution
- Alcatel-Lucent OmniPCX - Remote Command Execution
- The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP…
- Apache S2-032 Struts - Remote Code Execution
- Cleo Harmony < 5.8.0.24 - File Upload Vulnerability
- MeteoBridge <= 6.1 - Remote Code Execution
- D-Link DIR-823X set_prohibiting - Command Injection
- Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
- HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl,…
- D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
- An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote cod…
- A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote at…
- An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.
- A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Mi…
- TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .
- On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell me…
- The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execu…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.