CWE-78 · weakness in Command and Code Injection
OS Command Injection
6,926 CVEs · 116 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 116
- check available
- 139
- likely to be exploited
- 587
Every one of the 6,926 is a mark on the map. Named now: 1 to 26, most at risk first.
- Cisco HyperFlex HX Data Platform - Remote Command Execution
- ShellShock - Remote Code Execution
- D-Link Routers - Remote Code Execution
- CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution
- DrayTek - Remote Code Execution
- Zyxel NAS Firmware 5.21- Remote Code Execution
- PHP CGI - Argument Injection
- D-Link DNS-320 - Unauthenticated Remote Code Execution
- A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command exe…
- Dasan GPON Devices - Remote Code Execution
- Zyxel Firewall - OS Command Injection
- GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wr…
- Cisco HyperFlex HX Data Platform - Remote Command Execution
- Ivanti Sentry - OS Command Injection
- Zimbra Collaboration Suite < 9.0.0 - Remote Code Execution
- RealTek AP Router SDK - Arbitrary Command Injection
- Hikvision IP camera/NVR - Remote Command Execution
- GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands vi…
- Webmin <= 1.920 - Unauthenticated Remote Command Execution
- CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution
- SaltStack <=3002 - Shell Injection
- Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4…
- Apache Airflow <=1.10.10 - Remote Code Execution
- Atlassian Bitbucket - Remote Command Injection
- PaloAlto Networks Expedition - Remote Code Execution
- In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX bef…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.