CWE-95 · weakness in Command and Code Injection
Improper Neutralization of Directives in Dynamically Evaluated Code
218 CVEs · 4 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 4
- check available
- 7
- likely to be exploited
- 13
Every one of the 218 is a mark on the map. Named now: 1 to 26, most at risk first.
- XWiki Platform - Remote Code Execution
- GeoServer RCE in Evaluating Property Name Expressions
- Langflow < 1.9.0 - Remote Code Execution
- Arbitrary Code Execution (ACE) Vulnerability
- XWiki < 4.10.20 - Remote code execution
- XWiki Platform - Remote Code Execution
- SPIP Porte Plume Plugin - Remote Code Execution
- GeoServer and GeoTools - Remote Code Execution
- vBulletin 6.x - Remote Code Execution
- XWiki < 4.10.20 - Remote code execution
- DocsGPT - Unauthenticated Remote Code Execution
- Remote code execution through the section parameter in Administration as guest in XWiki Platform
- XWiki Platform: Remote code execution through space title and Solr space facet
- XWiki Platform RCE from account through SearchAdmin
- XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
- XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
- org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
- XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
- org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
- XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
- Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
- Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.
- Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
- Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.
- Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.
- Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.