CWE-88: Argument injection

513 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 5 of them as exploited in the wild.

Critical 111High 257Medium 128Low 17Not scored 0

CVEs per yearBy the year they were published

CVE-2026-86060
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
Mikrotik · RouterOS
ExploitedCritical9.2
CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
GNU · Inetutils
ExploitedCritical9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and…
Product not named
ExploitedCritical9.8
CVE-2024-41710
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could…
Product not named
ExploitedMedium6.8
CVE-2022-36804
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version…
Atlassian · Bitbucket Server
ExploitedHigh8.8

CVE-2026-97350
Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows
Securepoint · Securepoint SSL VPN Client v2
Medium6.9
CVE-2026-91909
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')…
Dell · OpenManage Enterprise
Medium4.6
CVE-2026-62968
Dream Displays has command-line argument injection in yt-dlp invocation
arsmotorin · dreamdisplays
High8.7
CVE-2026-116252
pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
pgadmin.org · pgAdmin 4
High7.1
CVE-2026-111504
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')…
Dell · OpenManage Enterprise
High7.2
CVE-2026-119282
Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle
nrwl · nx
High7.3
CVE-2026-90868
OS Command Injection in Progress WS_FTP Server
Progress Software · WS_FTP Server
Critical9.9
CVE-2026-90865
Command Injection via FTP Notification Variables in Progress WS_FTP Server
Progress Software · WS_FTP Server
Critical9.0
CVE-2026-50056
Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
Zimbra · Zimbra Collaboration Suite
High7.8
CVE-2026-115372
Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
lxc · incus
Critical9.0