KEV 2026.10.301,766 entries+10 in 7d11 open federal deadlinesas of / search ? keys
KEV Now

Weakness / #7

CWE-94: Code injection in CISA KEV

Improper Control of Generation of Code ('Code Injection')

Catalog
2026.10.30
Rank
#7 of 198
MITRE
CWE-94 definition

Answer 72 KEV entries list CWE-94 (Code injection) as of catalog 2026.10.30, 4.1% of the catalog and rank 7 of 198 weaknesses. The most affected vendor is Microsoft (17).

Attacker input is treated as code and executed by the application.

KEV entries
724.1% of catalog
Vendors
38affected
Ransomware: known
1115.3%
First added
2021-11-03
Latest added
2026-10-14

VVendors

Vendors with CWE-94 KEV entries
VendorEntriesShare
Microsoft1723.6%
Ivanti79.7%
IBM34.2%
Apache34.2%
Craft CMS34.2%
VMware34.2%
Cisco22.8%
Citrix22.8%
VMware Tanzu22.8%
Adobe22.8%
Palo Alto Networks11.4%
Gitea11.4%

TAdditions by year

CWE-94 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 9; 2022: 23; 2023: 9; 2024: 6; 2025: 6; 2026: 19.01020302021: 9 added920212022: 23 added2320222023: 9 added920232024: 6 added620242025: 6 added620252026: 19 added (year to date)192026
CWE-94 KEV additions by year
YearAdded
20219
202223
20239
20246
20256
202619

PProducts

Products with CWE-94 KEV entries
ProductEntriesShare
Microsoft Windows45.6%
Microsoft Office45.6%
Ivanti Endpoint Manager Mobile (EPMM)34.2%
Craft CMS Craft CMS34.2%
Ivanti Pulse Connect Secure34.2%
Microsoft SharePoint22.8%
Citrix NetScaler ADC and NetScaler Gateway22.8%
Microsoft Internet Explorer22.8%

EAll entries

KEV entries listing CWE-94
CVEVendorProductAddedRansomware
CVE-2026-0322Palo Alto NetworksPAN-OSUnknown
CVE-2026-65660MicrosoftSharePointUnknown
CVE-2026-60004GiteaGiteaUnknown
CVE-2026-72530TrueConfServerUnknown
CVE-2025-62593Ray-ProjectRayUnknown
CVE-2026-9198IBMLangflowUnknown
CVE-2026-15410SonicWallSMA1000 AppliancesKnown
CVE-2025-67038LantronixEDS5000Unknown
CVE-2008-4250MicrosoftWindowsUnknown
CVE-2026-34197ApacheActiveMQUnknown
CVE-2009-0238MicrosoftOfficeUnknown
CVE-2026-1340IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2026-33017LangflowLangflowUnknown
CVE-2025-54068LaravelLivewireUnknown
CVE-2025-32432Craft CMSCraft CMSUnknown
CVE-2026-1281IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2026-20045CiscoUnified Communications ManagerUnknown
CVE-2025-37164Hewlett Packard Enterprise (HPE)OneViewUnknown
CVE-2009-0556MicrosoftOfficeUnknown
CVE-2025-6204Dassault SystèmesDELMIA AprisoUnknown
CVE-2025-49704MicrosoftSharePointKnown
CVE-2024-56145Craft CMSCraft CMSUnknown
CVE-2025-4428IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2025-1976BroadcomBrocade Fabric OSUnknown
CVE-2025-23209Craft CMSCraft CMSUnknown
CVE-2022-24816OSGeoJAI-EXTUnknown
CVE-2024-20359CiscoAdaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Unknown
CVE-2023-24955MicrosoftSharePoint ServerKnown
CVE-2021-44529IvantiEndpoint Manager Cloud Service Appliance (EPM CSA)Known
CVE-2024-21351MicrosoftWindowsUnknown
CVE-2023-6548CitrixNetScaler ADC and NetScaler GatewayUnknown
CVE-2018-14667Red HatJBoss RichFaces FrameworkUnknown
CVE-2023-33246ApacheRocketMQUnknown
CVE-2023-3519CitrixNetScaler ADC and NetScaler GatewayKnown
CVE-2023-25717Ruckus WirelessMultiple ProductsUnknown
CVE-2023-29492Novi SurveyNovi SurveyUnknown
CVE-2017-7494SambaSambaKnown
CVE-2013-3163MicrosoftInternet ExplorerUnknown
CVE-2021-39144XStreamXStreamUnknown
CVE-2022-41223MitelMiVoice ConnectKnown
CVE-2022-3236SophosFirewallUnknown
CVE-2022-22963VMware TanzuSpring CloudUnknown
CVE-2009-1862AdobeAcrobat and Reader, Flash PlayerUnknown
CVE-2009-0557MicrosoftOfficeUnknown
CVE-2014-4148MicrosoftWindowsUnknown
CVE-2022-22947VMwareSpring Cloud GatewayUnknown
CVE-2022-22954VMwareWorkspace ONE Access and Identity ManagerKnown
CVE-2022-22965VMwareSpring FrameworkUnknown
CVE-2018-1273VMware TanzuSpring Data CommonsKnown
CVE-2014-6287RejettoHTTP File Server (HFS)Unknown
CVE-2013-4810Hewlett Packard (HP)ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle ManagementUnknown
CVE-2009-1151phpMyAdminphpMyAdminUnknown
CVE-2020-8218Pulse SecurePulse Connect SecureUnknown
CVE-2013-1347MicrosoftInternet ExplorerUnknown
CVE-2012-1856MicrosoftOfficeUnknown
CVE-2010-0188AdobeReader and AcrobatKnown
CVE-2009-3129MicrosoftExcelUnknown
CVE-2014-6352MicrosoftWindowsUnknown
CVE-2017-9841PHPUnitPHPUnitUnknown
CVE-2013-3906MicrosoftGraphics ComponentUnknown
CVE-2015-1635MicrosoftHTTP.sysUnknown
CVE-2019-7609ElasticKibanaUnknown
CVE-2015-7450IBMWebSphere Application Server and Server Hypervisor EditionUnknown
CVE-2019-0193ApacheSolrUnknown
CVE-2021-22900IvantiPulse Connect SecureUnknown
CVE-2021-22894IvantiPulse Connect SecureUnknown
CVE-2020-8644PlaySMSPlaySMSUnknown
CVE-2020-8243IvantiPulse Connect SecureUnknown
CVE-2019-9082ThinkPHPThinkPHPUnknown
CVE-2019-4716IBMPlanning AnalyticsUnknown
CVE-2019-16759vBulletinvBulletinUnknown
CVE-2012-0158MicrosoftMSCOMCTL.OCXKnown

Cite this

72 CISA KEV entries list CWE-94 (Code injection), 4.1% of the catalog. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/cwe/cwe-94/

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings