CWE-74 · weakness in Injection and Smuggling
Injection
1,090 CVEs · 13 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 13
- check available
- 28
- likely to be exploited
- 58
Every one of the 1,090 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
- Atlassian Confluence - Remote Code Execution
- Oracle WebLogic Server - Remote Command Execution
- GLPI <=10.0.2 - Remote Command Execution
- Cacti <=1.2.22 - Remote Command Injection
- Apache Solr <=8.3.1 - Remote Code Execution
- Hitachi Pentaho Business Analytics Server - Remote Code Execution
- Cisco ISE - Remote Code Execution
- Zimbra Collaboration Suite - Memcached Command Injection
- vBulletin 5.5.4 - 5.6.2- Remote Command Execution
- Atlassian Jira Server-Side Template Injection
- Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
- Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an…
- pfSense - Arbitrary File Write
- FUEL CMS 1.4.1 - Remote Code Execution
- LDAP Injection In OpenAM
- IBM Operational Decision Manager - JNDI Injection
- Jolokia Agent - JNDI Code Injection
- osTicket - Arbitrary File Read
- Craft CMS < 3.3.0 - Server-Side Template Injection
- Strapi Versions <=4.5.5 - SSTI to Remote Code Execution
- Symfony Profiler - Remote Access via Injected Arguments
- Roxy-WI - Remote Code Execution
- Camaleon CMS < 2.8.1 Arbitrary File Write to RCE
- Nette Framework - Remote Code Execution
- pyload - Log Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.