Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-95

222 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.

All 222 in the listAtom feed of new CVEsWhat CWE-95 is, at MITRE (opens in a new tab)
Published CVEs
222
Last 12 months
131
Critical
105
Known exploited
4

Critical 105High 82Medium 29Low 5Not scored 1

CVEs per yearBy the year they were published

  1. 20204
  2. 20212
  3. 20226
  4. 202322
  5. 202431
  6. 202533
  7. 2026124

Known exploitedNewest addition to KEV first

  • CVE-2026-33017

    Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

    langflow-ai · langflow

    ExploitedCritical9.3
  • CVE-2025-24893

    Remote code execution as guest via SolrSearchMacros request in xwiki

    xwiki · xwiki-platform

    ExploitedCritical9.8
  • CVE-2024-36401

    Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

    geoserver · geoserver

    ExploitedCritical9.8
  • CVE-2023-7101

    Arbitrary Code Execution (ACE) Vulnerability

    Douglas Wilson · Spreadsheet::ParseExcel

    ExploitedHigh7.8

Newest CVEs

  • CVE-2026-114424

    Code execution through double evaluation in address replacement rules

    SEPPmail AG · SEPPmail Secure Email Gateway (SEG)

    Critical9.2
  • CVE-2026-44344

    Chamilo LMS: Conditional PHP execution through vendored QuickForm eval

    chamilo · chamilo-lms

    Medium6.6
  • CVE-2026-115943

    Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

    Spreadsheet-XLSX

    Not scored
  • CVE-2026-119121

    Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

    unclecode · crawl4ai

    Medium5.3
  • CVE-2026-90872

    Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

    Progress Software · WS_FTP Server

    Medium6.6
  • CVE-2026-44179

    XWiki Pro Macros: excerpt-include title and content injection executes code

    xwikisas · xwiki-pro-macros

    Critical9.9
  • CVE-2026-78497

    JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

    JQ-Lite

    High8.4
  • CVE-2026-111865

    THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection

    THU-MIG · yoloe

    Medium4.8
  • CVE-2026-111687

    WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint

    rachelos · we-mp-rss

    Critical9.3
  • CVE-2026-111391

    SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter

    sgl-project · sglang

    Critical9.2

Vendors it comes up for most

  1. xwiki31
  2. Open Source Robotics Foundation6
  3. mindsdb6
  4. FlowiseAI4
  5. orval-labs4
  6. xwikisas4
  7. Adobe3
  8. chamilo3
  9. Apache Software Foundation2
  10. Apple2