CWE-78 · Command and Code Injection
OS Command Injection
6,927CVEs
116exploited
139with a public check
588likely (EPSS 10%+)
SortMost likely exploited
6,927 CVEs with CWE-78 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-1498In CISA KEVExploitedCisco HyperFlex HX Data Platform - Remote Command ExecutionCisco · Cisco HyperFlex HX Data Platform · CVSS 9.8 · 2021-05-06 | 9.8 | 100% | 2021-05-06 |
| CVE-2014-6271In CISA KEVExploitedShellShock - Remote Code ExecutionGNU · Bourne-Again Shell (Bash) · CVSS 9.8 · 2014-09-24 | 9.8 | 100% | 2014-09-24 |
| CVE-2019-16920In CISA KEVExploitedD-Link Routers - Remote Code ExecutionD-Link · Multiple Routers · CVSS 9.8 · 2019-09-27 | 9.8 | 100% | 2019-09-27 |
| CVE-2022-44877In CISA KEVExploitedCentOS Web Panel 7 <0.9.8.1147 - Remote Code ExecutionCWP · Control Web Panel · CVSS 9.8 · 2023-01-05 | 9.8 | 100% | 2023-01-05 |
| CVE-2020-8515In CISA KEVExploitedDrayTek - Remote Code ExecutionDrayTek · Multiple Vigor Routers · CVSS 9.8 · 2020-02-01 | 9.8 | 100% | 2020-02-01 |
| CVE-2020-9054In CISA KEVExploitedZyxel NAS Firmware 5.21- Remote Code ExecutionZyXEL · NAS326 · CVSS 9.8 · 2020-03-04 | 9.8 | 100% | 2020-03-04 |
| CVE-2024-4577In CISA KEVExploitedPHP CGI - Argument InjectionPHP Group · PHP · CVSS 9.8 · 2024-06-09 | 9.8 | 100% | 2024-06-09 |
| CVE-2020-25506In CISA KEVExploitedD-Link DNS-320 - Unauthenticated Remote Code ExecutionD-Link · DNS-320 Device · CVSS 9.8 · 2021-02-02 | 9.8 | 100% | 2021-02-02 |
| CVE-2019-10149In CISA KEVExploitedA flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command exe…exim · exim · CVSS 9 · 2019-06-05 | 9.0 | 100% | 2019-06-05 |
| CVE-2018-10562In CISA KEVExploitedDasan GPON Devices - Remote Code ExecutionDasan · Gigabit Passive Optical Network (GPON) Routers · CVSS 9.8 · 2018-05-04 | 9.8 | 100% | 2018-05-04 |
| CVE-2022-30525In CISA KEVExploitedZyxel Firewall - OS Command InjectionZyxel · USG FLEX 100(W) firmware · CVSS 9.8 · 2022-05-12 | 9.8 | 100% | 2022-05-12 |
| CVE-2014-7169In CISA KEVExploitedGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wr…GNU · Bourne-Again Shell (Bash) · CVSS 9.8 · 2014-09-25 | 9.8 | 100% | 2014-09-25 |
| CVE-2021-1497In CISA KEVExploitedCisco HyperFlex HX Data Platform - Remote Command ExecutionCisco · Cisco HyperFlex HX Data Platform · CVSS 9.8 · 2021-05-06 | 9.8 | 100% | 2021-05-06 |
| CVE-2026-10520In CISA KEVExploitedIvanti Sentry - OS Command Injectionivanti · Sentry · CVSS 10 · 2026-06-09 | 10.0 | 100% | 2026-06-09 |
| CVE-2024-45519In CISA KEVExploitedZimbra Collaboration Suite < 9.0.0 - Remote Code ExecutionSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 10 · 2024-10-02 | 10.0 | 100% | 2024-10-02 |
| CVE-2021-35394In CISA KEVExploitedRealTek AP Router SDK - Arbitrary Command InjectionRealtek · Jungle Software Development Kit (SDK) · CVSS 9.8 · 2021-08-16 | 9.8 | 100% | 2021-08-16 |
| CVE-2021-36260In CISA KEVExploitedHikvision IP camera/NVR - Remote Command ExecutionHikvision · Security cameras web server · CVSS 9.8 · 2021-09-22 | 9.8 | 100% | 2021-09-22 |
| CVE-2014-6278In CISA KEVExploitedGNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands vi…GNU · GNU Bash · CVSS 8.8 · 2014-09-30 | 8.8 | 100% | 2014-09-30 |
| CVE-2019-15107In CISA KEVExploitedWebmin <= 1.920 - Unauthenticated Remote Command ExecutionWebmin · Webmin · CVSS 9.8 · 2019-08-16 | 9.8 | 100% | 2019-08-16 |
| CVE-2025-48703In CISA KEVExploitedCWP (Control Web Panel) < 0.9.8.1205 - Remote Code Executioncentos-webpanel · CentOS Web Panel · CVSS 9 · 2025-09-19 | 9.0 | 100% | 2025-09-19 |
| CVE-2020-16846In CISA KEVExploitedSaltStack <=3002 - Shell InjectionSaltStack · Salt · CVSS 9.8 · 2020-11-06 | 9.8 | 100% | 2020-11-06 |
| CVE-2023-28771In CISA KEVExploitedImproper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4…Zyxel · ZyWALL/USG series firmware · CVSS 9.8 · 2023-04-25 | 9.8 | 99% | 2023-04-25 |
| CVE-2020-11978In CISA KEVExploitedApache Airflow <=1.10.10 - Remote Code ExecutionApache Software Foundation · Apache Airflow · CVSS 8.8 · 2020-07-16 | 8.8 | 99% | 2020-07-16 |
| CVE-2022-36804In CISA KEVExploitedAtlassian Bitbucket - Remote Command InjectionAtlassian · Bitbucket Server · CVSS 8.8 · 2022-08-25 | 8.8 | 99% | 2022-08-25 |
| CVE-2024-9463In CISA KEVExploitedPaloAlto Networks Expedition - Remote Code ExecutionPalo Alto Networks · Expedition · CVSS 9.9 · 2024-10-09 | 9.9 | 99% | 2024-10-09 |
| CVE-2019-11539In CISA KEVExploitedIn Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX bef…Ivanti · Pulse Connect Secure and Pulse Policy Secure · CVSS 8 · 2019-04-26 | 8.0 | 99% | 2019-04-26 |
| CVE-2024-50603In CISA KEVExploitedAviatrix Controller - Remote Code ExecutionAviatrix · Controller · CVSS 10 · 2025-01-08 | 10.0 | 99% | 2025-01-08 |
| CVE-2024-12987In CISA KEVExploitedDrayTek Vigor - Command InjectionDrayTek · Vigor2960 · CVSS 7.3 · 2024-12-27 | 7.3 | 98% | 2024-12-27 |
| CVE-2022-29303In CISA KEVExploitedSolarView Compact 6.00 - OS Command InjectionSolarView · Compact · CVSS 9.8 · 2022-05-12 | 9.8 | 98% | 2022-05-12 |
| CVE-2020-1956In CISA KEVExploitedApache Kylin 3.0.1 - Command Injection VulnerabilityApache · Kylin · CVSS 8.8 · 2020-05-22 | 8.8 | 98% | 2020-05-22 |
| CVE-2023-25280In CISA KEVExploitedD-Link DIR820LA1_FW105B03 'ping_addr' - OS Command InjectionD-Link · DIR-820 Router · CVSS 9.8 · 2023-03-16 | 9.8 | 98% | 2023-03-16 |
| CVE-2021-45382In CISA KEVExploitedD-Link - Remote Command ExecutionD-Link · Multiple Routers · CVSS 9.8 · 2022-02-17 | 9.8 | 98% | 2022-02-17 |
| CVE-2021-36380In CISA KEVExploitedSunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command InjectionSunhillo · SureLine · CVSS 9.8 · 2021-08-13 | 9.8 | 98% | 2021-08-13 |
| CVE-2019-7256In CISA KEVExploitedeMerge E3 1.00-06 - Remote Code ExecutionNice · Linear eMerge E3-Series · CVSS 9.8 · 2019-07-02 | 9.8 | 97% | 2019-07-02 |
| CVE-2020-25223In CISA KEVExploitedSophos UTM Preauth - Remote Code ExecutionSophos · SG UTM · CVSS 9.8 · 2020-09-25 | 9.8 | 97% | 2020-09-25 |
| CVE-2021-22502In CISA KEVExploitedMicro Focus Operations Bridge Reporter - Remote Code ExecutionMicro Focus · Operation Bridge Reporter. · CVSS 9.8 · 2021-02-08 | 9.8 | 97% | 2021-02-08 |
| CVE-2019-20500In CISA KEVExploitedD-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metach…D-Link · DWL-2600AP Access Point · CVSS 7.8 · 2020-03-05 | 7.8 | 97% | 2020-03-05 |
| CVE-2018-6530In CISA KEVExploitedD-Link - Unauthenticated Remote Code ExecutionD-Link · Multiple Routers · CVSS 9.8 · 2018-03-06 | 9.8 | 97% | 2018-03-06 |
| CVE-2017-3506In CISA KEVExploitedOracle Fusion Middleware Weblogic Server - Remote OS Command ExecutionOracle Corporation · WebLogic Server · CVSS 7.4 · 2017-04-24 | 7.4 | 96% | 2017-04-24 |
| CVE-2024-1212In CISA KEVExploitedProgress Kemp LoadMaster - Command InjectionProgress Software · LoadMaster · CVSS 10 · 2024-02-21 | 10.0 | 95% | 2024-02-21 |
| CVE-2018-14933In CISA KEVExploitedNUUO NVRmini - Remote Command ExecutionNUUO · NVRmini Devices · CVSS 9.8 · 2018-08-04 | 9.8 | 95% | 2018-08-04 |
| CVE-2024-51378In CISA KEVExploitedCyberPanel - Command InjectionCyberPersons · CyberPanel · CVSS 10 · 2024-10-29 | 10.0 | 95% | 2024-10-29 |
| CVE-2017-18368In CISA KEVExploitedThe ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding funct…Zyxel · P660HN-T1A Routers · CVSS 9.8 · 2019-05-02 | 9.8 | 95% | 2019-05-02 |
| CVE-2025-11953In CISA KEVExploitedReact Native Community CLI - Unauthenticated OS Command InjectionReact Native Community · CLI · CVSS 9.8 · 2025-11-03 | 9.8 | 94% | 2025-11-03 |
| CVE-2026-1731In CISA KEVExploitedBeyondTrust Remote Support - Unauthenticated WebSocket RCEBeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA) · CVSS 9.9 · 2026-02-06 | 9.9 | 94% | 2026-02-06 |
| CVE-2024-9474In CISA KEVExploitedPAN-OS Management Web Interface - Command InjectionPalo Alto Networks · Cloud NGFW · CVSS 6.9 · 2024-11-18 | 6.9 | 94% | 2024-11-18 |
| CVE-2022-33891In CISA KEVExploitedApache Spark UI - Remote Command InjectionApache Software Foundation · Apache Spark · CVSS 8.8 · 2022-07-18 | 8.8 | 93% | 2022-07-18 |
| CVE-2026-39808In CISA KEVExploitedFortinet FortiSandbox - Command InjectionFortinet · FortiSandbox · CVSS 9.1 · 2026-04-14 | 9.1 | 93% | 2026-04-14 |
| CVE-2023-20273In CISA KEVExploitedA vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is…Cisco · Cisco IOS XE Software · CVSS 7.2 · 2023-10-24 | 7.2 | 93% | 2023-10-24 |
| CVE-2018-11138In CISA KEVExploitedQuest KACE System Management Appliance 8.0.318 - Remote Code ExecutionQuest · KACE System Management Appliance · CVSS 9.8 · 2018-05-31 | 9.8 | 92% | 2018-05-31 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.