CVE-20XX-?
agent?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

83 CVEs · updated 2026-11-12 03:50 UTC

Reset all
  1. CVE-2019-16920

    Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

    Drop everything exploited Injection Network gear Dlink dir-655 Firmware

    9.8 CRITICAL 100% exploit odds No fix listed
  2. CVE-2018-10562

    An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

    Drop everything exploited Injection Network gear Dasannetworks Gpon Router Firmware

    9.8 CRITICAL 100% exploit odds No fix listed
  3. CVE-2023-25280

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

    Drop everything exploited Injection Network gear Dlink dir-820l Firmware

    9.8 CRITICAL 98% exploit odds No fix listed
  4. CVE-2017-18368

    The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.

    Drop everything exploited Injection Network gear Billion 5200w-t Firmware

    9.8 CRITICAL 95% exploit odds No fix listed
  5. CVE-2018-14839

    LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.

    Drop everything exploited Injection Network gear Lg n1a1 Firmware

    9.8 CRITICAL 89% exploit odds No fix listed
  6. CVE-2019-16057

    The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

    Drop everything exploited Injection Network gear Dlink dns-320 Firmware

    9.8 CRITICAL 86% exploit odds No fix listed
  7. CVE-2021-27561

    Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.

    Drop everything exploited Injection Network gear Yealink Device Management

    9.8 CRITICAL 84% exploit odds No fix listed
  8. CVE-2005-2773

    HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.

    Drop everything exploited Injection Network gear HP Openview Network Node Manager

    9.8 CRITICAL 75% exploit odds No fix listed
  9. CVE-2017-6077

    ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

    Drop everything exploited Injection Network gear Netgear dgn2200 Firmware

    9.8 CRITICAL 69% exploit odds No fix listed
  10. CVE-2026-10520

    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

    Drop everything exploited Injection Network gear Ivanti Standalone Sentry

    10.0 CRITICAL 100% exploit odds Fix listed
  11. CVE-2024-9463

    An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

    Drop everything exploited Injection Network gear Paloaltonetworks Expedition

    9.9 CRITICAL 99% exploit odds Fix listed
  12. CVE-2021-1498

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

    Drop everything exploited Injection Network gear Cisco Hyperflex Hx Data Platform

    9.8 CRITICAL 100% exploit odds Fix listed
  13. CVE-2020-25506

    D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

    Drop everything exploited Injection Network gear Dlink dns-320 Firmware

    9.8 CRITICAL 100% exploit odds Fix listed
  14. CVE-2022-30525

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

    Drop everything exploited Injection Network gear Zyxel Usg Flex 100w Firmware

    9.8 CRITICAL 100% exploit odds Fix listed
  15. CVE-2021-1497

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

    Drop everything exploited Injection Network gear Cisco Hyperflex Hx Data Platform

    9.8 CRITICAL 100% exploit odds Fix listed
  16. CVE-2023-28771

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

    Drop everything exploited Injection Network gear Zyxel atp100 Firmware

    9.8 CRITICAL 99% exploit odds Fix listed
  17. CVE-2022-3236

    A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

    Drop everything exploited Injection Network gear Sophos Firewall

    9.8 CRITICAL 99% exploit odds Fix listed
  18. CVE-2023-48788

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.

    Drop everything exploited Injection Network gear Fortinet Forticlient Enterprise Management Server

    9.8 CRITICAL 98% exploit odds Fix listed
  19. CVE-2016-1555

    (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

    Drop everything exploited Injection Network gear Netgear wnap320 Firmware

    9.8 CRITICAL 98% exploit odds Fix listed
  20. CVE-2021-45382

    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

    Drop everything exploited Injection Network gear Dlink dir-820l Firmware

    9.8 CRITICAL 98% exploit odds Fix listed
  21. CVE-2026-21643

    An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

    Drop everything exploited Injection Network gear Fortinet Forticlientems

    9.8 CRITICAL 98% exploit odds Fix listed
  22. CVE-2018-6530

    OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

    Drop everything exploited Injection Network gear Dlink dir-860l Firmware

    9.8 CRITICAL 97% exploit odds Fix listed
  23. CVE-2019-12989

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

    Drop everything exploited Injection Network gear Citrix Netscaler sd-wan

    9.8 CRITICAL 95% exploit odds Fix listed
  24. CVE-2026-39808

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

    Drop everything exploited Injection Network gear Fortinet Fortisandbox

    9.8 CRITICAL 93% exploit odds Fix listed
  25. CVE-2026-76461

    A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

    Drop everything exploited Injection Network gear Cisco Asyncos

    9.8 CRITICAL 40% exploit odds Fix listed
  26. CVE-2022-26258

    D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

    Drop everything exploited Injection Network gear Dlink dir-820l Firmware

    9.8 CRITICAL 92% exploit odds Fix listed
  27. CVE-2019-17621

    The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

    Drop everything exploited Injection Network gear Dlink dir-859 Firmware

    9.8 CRITICAL 91% exploit odds Fix listed
  28. CVE-2024-9465

    An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

    Drop everything exploited Injection Network gear Paloaltonetworks Expedition

    9.2 CRITICAL 100% exploit odds Fix listed
  29. CVE-2024-21887

    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

    Drop everything exploited Injection Network gear Ivanti Connect Secure

    9.1 CRITICAL 100% exploit odds Fix listed
  30. CVE-2023-27992

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

    Drop everything exploited Injection Network gear Zyxel nas326 Firmware

    9.8 CRITICAL 82% exploit odds Fix listed
  31. CVE-2026-25089

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

    Drop everything exploited Injection Network gear Fortinet Fortisandbox

    9.8 CRITICAL 76% exploit odds Fix listed
  32. CVE-2026-9586

    An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

    Drop everything exploited Injection Network gear Sangoma Switchvox

    9.3 CRITICAL 19% exploit odds No fix listed
  33. CVE-2016-20017

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

    Drop everything exploited Injection Network gear Dlink dsl-2750b Firmware

    9.8 CRITICAL 66% exploit odds Fix listed
  34. CVE-2020-12271

    A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)

    Drop everything exploited Injection Network gear Sophos Sfos

    9.8 CRITICAL 43% exploit odds Fix listed
  35. CVE-2010-5330

    On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

    Drop everything exploited Injection Network gear Ui Airos

    9.8 CRITICAL 40% exploit odds Fix listed
  36. CVE-2021-20028

    Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

    Drop everything exploited Injection Network gear Sonicwall Sma 210 Firmware

    9.8 CRITICAL 30% exploit odds Fix listed
  37. CVE-2026-111560

    Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

    exploited Injection Network gear

    8.6 HIGH 6% exploit odds No fix listed
  38. CVE-2023-1389

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

    exploited Injection Network gear TP-Link Archer ax21 Firmware

    8.8 HIGH 100% exploit odds No fix listed
  39. CVE-2017-6334

    dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

    exploited Injection Network gear Netgear dgn2200 Series Firmware

    8.8 HIGH 73% exploit odds No fix listed
  40. CVE-2026-114625

    VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

    exploited Injection Network gear Arista Velocloud Orchestrator

    9.4 CRITICAL 1% exploit odds Fix listed
  41. CVE-2021-25297

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

    exploited Injection Network gear Nagios Xi

    8.8 HIGH 57% exploit odds No fix listed
  42. CVE-2024-12987

    A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

    exploited Injection Network gear Draytek vigor300b Firmware

    6.9 MEDIUM 98% exploit odds No fix listed
  43. CVE-2025-29635

    A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

    exploited Injection Network gear Dlink dir-823x Firmware

    7.2 HIGH 88% exploit odds No fix listed
  44. CVE-2023-33538

    TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

    exploited Injection Network gear TP-Link tl-wr940n Firmware

    8.8 HIGH 42% exploit odds No fix listed
  45. CVE-2023-39780

    On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.

    exploited Injection Network gear Asus rt-ax55 Firmware

    8.8 HIGH 40% exploit odds No fix listed
  46. CVE-2026-0322

    A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

    exploited Injection Network gear Paloaltonetworks pan-os

    8.6 HIGH 2% exploit odds Fix listed
  47. CVE-2015-2051

    The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

    exploited Injection Network gear Dlink dir-645 Firmware

    8.8 HIGH 97% exploit odds Fix listed
  48. CVE-2017-6884

    A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

    exploited Injection Network gear Zyxel emg2926 Firmware

    8.8 HIGH 33% exploit odds No fix listed
  49. CVE-2016-11021

    setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

    exploited Injection Network gear Dlink dcs-930l Firmware

    7.2 HIGH 70% exploit odds No fix listed
  50. CVE-2019-12991

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).

    exploited Injection Network gear Citrix Netscaler sd-wan

    8.8 HIGH 74% exploit odds Fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.