CWE-74: Injection
5,730 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 13 of them as exploited in the wild.
- Published CVEs
- 5,730
- Last 12 months
- 2,259
- Critical
- 316
- Known exploited
- 13
Critical 316High 569Medium 4,778Low 66Not scored 1
CVEs per yearBy the year they were published
- 202020
- 20206
- 20203
- 2021168
- 2022135
- 2023172
- 2023116
- 202326
- 202328
- 20252,571
- 2025331
- 20261,880
Known exploitedNewest addition to KEV first
- CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0 - CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0 - CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Hitachi Vantara · Pentaho Business Analytics Server
ExploitedHigh8.8 - CVE-2023-22527
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…
Atlassian · Confluence Data Center
ExploitedCritical10.0 - CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Product not named
ExploitedCritical9.8 - CVE-2022-46169
Unauthenticated Command Injection
Cacti · cacti
ExploitedCritical9.8 - CVE-2022-27924
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache…
Product not named
ExploitedCritical9.8 - CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or…
Product not named
ExploitedCritical9.8 - CVE-2019-11581
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker…
Atlassian · Jira Server and Data Center
ExploitedCritical9.8 - CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are…
Oracle Corporation · Tape Library ACSLS
ExploitedHigh7.5
Newest CVEs
- CVE-2026-121524
sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection
sumiie24 · School-Management-System
Medium6.9 - CVE-2026-115779
Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
Effect-TS · effect
Medium6.3 - CVE-2026-121502
mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection
mathurvishal · CloudClassroom-PHP-Project
Medium6.9 - CVE-2026-57154
OPNsense: Configuration line injection via multiple GUI text fields
opnsense · core
High8.1 - CVE-2026-121260
Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection
Ziroom · ZHOME A0101
Critical9.4 - CVE-2026-120329
Broken Access Control in extension "Mail" (mail)
TYPO3 · Extension "Mail"
Medium5.3 - CVE-2026-120349
dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection
dayrui · XunRuiCMS
Medium6.9 - CVE-2026-120348
dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection
dayrui · XunRuiCMS
Medium6.9 - CVE-2026-120347
dayrui XunRuiCMS Member View.php View sql injection
dayrui · XunRuiCMS
Medium6.9 - CVE-2026-120342
mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection
mathurvishal · CloudClassroom-PHP-Project
Medium6.9