CWE-94 · weakness in Command and Code Injection
Code Injection
5,818 CVEs · 71 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 71
- check available
- 115
- likely to be exploited
- 712
Every one of the 5,818 is a mark on the map. Named now: 1 to 26, most at risk first.
- PHPUnit - Remote Code Execution
- Microsoft Windows 'HTTP.sys' - Remote Code Execution
- VMware Workspace ONE Access - Server-Side Template Injection
- Microsoft SharePoint Remote Code Execution Vulnerability
- Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
- The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 G…
- Spring Cloud - Remote Code Execution
- GeoServer <1.2.2 - Remote Code Execution
- CraftCMS - Remote Code Execution
- Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution
- GitLab CE/EE - Remote Code Execution
- vBulletin 5.0.0-5.5.4 - Remote Command Execution
- Spring - Remote Code Execution
- Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a wri…
- HTTP File Server <2.3c - Remote Command Execution
- Drupal - Remote Code Execution
- Ivanti EPM Cloud Services Appliance Code Injection
- Sophos Firewall <= 19.0 MR1 - Remote Code Execution
- Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection
- Ivanti EPMM < 12.8.0.0 - Remote Code Execution
- Apache ActiveMQ - Remote Code Execution
- Spring Cloud Gateway Code Injection
- XStream 1.4.18 - Remote Code Execution
- Ruckus Wireless Admin - Remote Code Execution
- Craft CMS - Remote Code Execution via Template Path Manipulation
- Spring Data Commons - Remote Code Execution
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.