Skip to content
CVE Tracker

CWE-77: Command injection

4,000 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 40 of them as exploited in the wild.

All 4,000 in the listAtom feed of new CVEsWhat CWE-77 is, at MITRE (opens in a new tab)
Published CVEs
4,000
Last 12 months
1,237
Critical
1,134
Known exploited
40

Critical 1,134High 1,501Medium 1,319Low 44Not scored 2

CVEs per yearBy the year they were published

  1. 20199
  2. 20194
  3. 20192
  4. 2022323
  5. 202274
  6. 2023200
  7. 2023181
  8. 202356
  9. 2024509
  10. 20261,052
  11. 2026717
  12. 2026548

Known exploitedNewest addition to KEV first

  • CVE-2026-105134

    Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

    Ahsay · AhsayCBS

    ExploitedCritical10.0
  • CVE-2026-96951

    Windows Shell Security Feature Bypass Vulnerability

    Microsoft · Microsoft Edge (Chromium-based)

    ExploitedHigh8.8
  • CVE-2016-3081

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…

    Product not named

    ExploitedHigh8.1
  • CVE-2026-8037

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    Progress Software · LoadMaster

    ExploitedCritical9.6
  • CVE-2026-42271

    LiteLLM: Authenticated command execution via MCP stdio test endpoints

    BerriAI · litellm

    ExploitedHigh8.7
  • CVE-2025-29635

    A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending…

    Product not named

    ExploitedHigh7.2
  • CVE-2026-22719

    VMware Aria Operations command injection vulnerability

    VMware · VMware Aria Operations

    ExploitedHigh8.1
  • CVE-2025-4008

    Arbitrary Command Injection in Smartbedded MeteoBridge

    Smartbedded · MeteoBridge

    ExploitedHigh8.7
  • CVE-2025-59689

    Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For…

    Libraesva · Email Security Gateway

    ExploitedMedium6.1
  • CVE-2025-10035

    Deserialization Vulnerability in GoAnywhere MFT's License Servlet

    Fortra · GoAnywhere MFT

    ExploitedCritical10.0

Newest CVEs

  • CVE-2026-95727

    Authenticated Command Injection Vulnerability in HPE Networking VIA

    Hewlett Packard Enterprise (HPE) · Virtual Intranet Access (VIA)

    High7.2
  • CVE-2026-105982

    Command Injection in IPsec VPN

    Welotec · TK100

    High8.6
  • CVE-2026-105980

    Command Injection in WireGuard VPN

    Welotec · TK100

    High8.6
  • CVE-2026-105979

    Command Injection in ZeroTier VPN

    Welotec · TK100

    High8.6
  • CVE-2026-120345

    WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection

    WAVLINK · WN551X3-A

    Critical10.0
  • CVE-2026-120344

    WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection

    WAVLINK · WN551X3-A

    Critical10.0
  • CVE-2026-120282

    WAVLINK WN536AX6-A protocol.csp host_black os command injection

    WAVLINK · WN536AX6-A

    Critical9.4
  • CVE-2026-120280

    WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-120279

    WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-120277

    WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection

    WAVLINK · WN536AX6-A

    Critical10.0

Vendors it comes up for most

  1. TOTOLINK185
  2. D-Link166
  3. Cisco122
  4. Hewlett Packard Enterprise (HPE)109
  5. Microsoft86
  6. WAVLINK83
  7. Tenda53
  8. Edimax44
  9. QNAP Systems Inc.42
  10. Dell41