Command injection vulnerabilities
User input is passed to a system shell, letting an attacker run their own operating system commands on the server.
Command injection in numbers
sbomify tracks 12,719 command injection vulnerabilities. Most are found in network device (43%), server software (20%) and web application (14%).
How to fix command injection vulnerabilities
Upgrade, and pass arguments to programs as a list instead of through a shell.
Most exploited command injection vulnerabilities
- CVE-2026-105134 Ahsay AhsayCBS Command Injection
- CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection
- CVE-2026-10520 Ivanti Sentry OS Command Injection
- CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation
- CVE-2025-20393 Cisco Multiple Products Improper Input Validation
- CVE-2024-50603 Aviatrix Controllers OS Command Injection
- CVE-2024-51378 CyberPanel Incorrect Default Permissions
- CVE-2024-45519 Synacor Zimbra Collaboration Suite (ZCS) Command Execution
- CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection
- CVE-2024-1212 Progress Kemp LoadMaster OS Command Injection
- CVE-2022-20708 Cisco Small Business RV Series Routers Stack-based Buffer Overflow
- CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection
Recently published
- CVE-2026-103038 PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host
- CVE-2026-108983 GV-ASManager Web Server Command Injection Vulnerability
- CVE-2026-112195 FusionPBX Dialplan Editor dialplan.php os command injection
- CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
- CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys
- CVE-2026-112301 orbitale imagemagick-php Command.php font os command injection
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.