# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-54823.md) `CVE-2026-54823` · CVE record: MarketingFire Widget Options · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2026 · Tags: Code injection - [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2026-1606.md) `CVE-2026-1606` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Code injection - [SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped \`data-obj\` attribute (Bypass for CVE-2026-45375's patch)](https://agentprime.io/advisories/CVE-2026-55570.md) `CVE-2026-55570` · CVE record: siyuan-note siyuan · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116 - [Jenkins Script Security Plugin has a script security bypass vulnerability](https://agentprime.io/advisories/GHSA-cfj9-2vgr-hpxp.md) `GHSA-cfj9-2vgr-hpxp`, `CVE-2026-57281` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1402.1405.vc96e74964250`, fixed in `1402.1405.vc96e74964250` · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection, Code injection, CWE-693 - [Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types](https://agentprime.io/advisories/GHSA-2w2h-gwwj-fh3q.md) `GHSA-2w2h-gwwj-fh3q`, `CVE-2026-57284` · Maven `io.jenkins.plugins:pipeline-groovy-lib`: affected `<4331.4333`, fixed in `4331.4333` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Code injection - [AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-12242.md) `CVE-2026-12242` · CVE record: adegans AdRotate Banner Manager · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: Code injection - [Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository](https://agentprime.io/advisories/GHSA-77g9-363w-rccq.md) `GHSA-77g9-363w-rccq`, `CVE-2026-55441` · crates.io `mise`: affected `<2026.6.4`, fixed in `2026.6.4` · CVSS 8.6 High · Not analysed yet · Published 23 Jun 2026 · Tags: Command injection, Code injection, Broken access control - [Code injection in Revive Adserver](https://agentprime.io/advisories/CVE-2026-34916.md) `CVE-2026-34916` · CVE record: Revive Adserver Revive Adserver · CVSS 8.8 High · Not analysed yet · Published 23 Jun 2026 · Tags: Code injection - [Code injection in Revive Adserver](https://agentprime.io/advisories/CVE-2026-44959.md) `CVE-2026-44959` · CVE record: Revive Adserver · CVSS 8.8 High · Not analysed yet · Published 23 Jun 2026 · Tags: Code injection - [FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE](https://agentprime.io/advisories/CVE-2026-28496.md) `CVE-2026-28496` · CVE record: FOSSBilling FOSSBilling · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Code injection - [expr-eval vulnerable to Code Execution](https://agentprime.io/advisories/GHSA-q9v2-7m5w-4693.md) `GHSA-q9v2-7m5w-4693`, `CVE-2026-12866` · Maven `org.webjars.npm:expr-eval` and 1 more: affected `<=2.0.2`, no fixed version yet · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Code injection - [Gogs has DoS in rendering issue index pattern](https://agentprime.io/advisories/GHSA-4j89-2c4f-44c6.md) `GHSA-4j89-2c4f-44c6`, `CVE-2026-52796`, `GO-2026-5124` · Go `gogs.io/gogs`: affected `<0.14.3`, fixed in `0.14.3` · CVSS 3.5 Low · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types](https://agentprime.io/advisories/GHSA-c8q4-9h32-2ww8.md) `GHSA-c8q4-9h32-2ww8`, `CVE-2026-44795` · Maven `io.spinnaker.orca:orca-core` and 1 more: affected `<2025.3.3 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3`, fixed in `2025.3.3`, `2025.4.4`, `2026.0.3` · CVSS 8.8 High · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection, Insecure deserialization - [xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro](https://agentprime.io/advisories/GHSA-w56x-9778-rppx.md) `GHSA-w56x-9778-rppx`, `CVE-2026-44179` · Maven `com.xwiki.pro:xwiki-pro-macros`: affected `>=1.13, <1.14.5`, fixed in `1.14.5` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)](https://agentprime.io/advisories/GHSA-fjj5-v948-whjj.md) `GHSA-fjj5-v948-whjj`, `CVE-2026-33646` · crates.io `mise`: affected `<2026.3.10`, fixed in `2026.3.10` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop](https://agentprime.io/advisories/CVE-2026-10789.md) `CVE-2026-10789` · CVE record: Autodesk Fusion · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [Duplicate Advisory: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation](https://agentprime.io/advisories/GHSA-frvg-495w-m47v.md) `GHSA-frvg-495w-m47v` · PyPI `langlow`: affected `<1.10.1`, fixed in `1.10.1` · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension](https://agentprime.io/advisories/CVE-2026-50178.md) `CVE-2026-50178` · CVE record: angular angular and 1 more · CVSS 8.7 High · Not analysed yet · Published 22 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension](https://agentprime.io/advisories/CVE-2026-49241.md) `CVE-2026-49241` · CVE record: angular angular · CVSS 8.7 High · Not analysed yet · Published 22 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-427, CWE-494 - [WebSphere Application Server Remote Code Execution](https://agentprime.io/advisories/CVE-2026-9072.md) `CVE-2026-9072` · CVE record: IBM WebSphere Application Server · CVSS 8.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [WebSphere Application Server Remote Code Execution](https://agentprime.io/advisories/CVE-2026-8858.md) `CVE-2026-8858` · CVE record: IBM WebSphere Application Server · CVSS 7.5 High · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP](https://agentprime.io/advisories/CVE-2026-56446.md) `CVE-2026-56446` · CVE record: misp misp · CVSS 8.7 High · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [langflow-ai langflow Bundle URL Loader code injection](https://agentprime.io/advisories/CVE-2026-12822.md) `CVE-2026-12822` · CVE record: langflow-ai langflow · CVSS 4.8 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Other injection, Code injection - [kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting](https://agentprime.io/advisories/CVE-2026-12811.md) `CVE-2026-12811` · CVE record: kortix-ai suna · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [Duplicate Advisory: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview](https://agentprime.io/advisories/GHSA-pmm4-v8f6-4vpp.md) `GHSA-pmm4-v8f6-4vpp` · Packagist `craftcms/cms`: affected `>=5.5.0, <=5.9.13`, no fixed version yet · CVSS 7.2 High · Withdrawn · Not analysed yet · Published 21 Jun 2026 · Tags: Code injection - [Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)](https://agentprime.io/advisories/GHSA-7pm4-56h2-5rxr.md) `GHSA-7pm4-56h2-5rxr`, `CVE-2026-5366` · PyPI `prefect`: affected `>=3.1.11, <3.6.25`, fixed in `3.6.25` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jun 2026 · Tags: Code injection - [Duplicate Advisory: Flowise OverrideConfig security vulnerability](https://agentprime.io/advisories/GHSA-5w6g-rc45-wvv9.md) `GHSA-5w6g-rc45-wvv9` · npm `flowise`: affected `<2.1.4`, fixed in `2.1.4` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 20 Jun 2026 · Tags: Code injection - [WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php](https://agentprime.io/advisories/CVE-2022-50972.md) `CVE-2022-50972` · CVE record: WooCommerce WooCommerce · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jun 2026 · Tags: Code injection - [@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised \_\_TINA_INTERNAL\_\_ marker in user-controlled YAML labels](https://agentprime.io/advisories/GHSA-4936-9hrh-qqpw.md) `GHSA-4936-9hrh-qqpw`, `CVE-2026-54074` · npm `@tinacms/cli`: affected `<2.4.3`, fixed in `2.4.3` · CVSS 7.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: Code injection - [OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source](https://agentprime.io/advisories/GHSA-9wxg-vf3r-56hc.md) `GHSA-9wxg-vf3r-56hc`, `CVE-2026-57583` · npm `@openzeppelin/wizard` and 3 more: affected `<0.10.11`, fixed in `0.10.11` · CVSS 3.3 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Code injection, CWE-116 - [ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys](https://agentprime.io/advisories/GHSA-jv2h-4p9v-wf5w.md) `GHSA-jv2h-4p9v-wf5w`, `CVE-2026-66065` · PyPI `ouroboros-ai`: affected `<0.42.1`, fixed in `0.42.1` · CVSS 8.4 High · Not analysed yet · Published 19 Jun 2026 · Tags: Code injection, CWE-15 - [CedarJava has policy injection vulnerability](https://agentprime.io/advisories/GHSA-qmch-v2q9-wg4p.md) `GHSA-qmch-v2q9-wg4p`, `CVE-2026-55773` · Maven `com.cedarpolicy:cedar-java`: affected `<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0`, fixed in `2.3.6`, `3.4.1`, `4.9.0` · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: Code injection - [JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer](https://agentprime.io/advisories/CVE-2026-54390.md) `CVE-2026-54390` · CVE record: JTL Software JTL Shop · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Code injection - [Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args](https://agentprime.io/advisories/GHSA-r253-r9jw-qg44.md) `GHSA-r253-r9jw-qg44`, `CVE-2026-57572`, `PYSEC-2026-2139` · PyPI `crawl4ai`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Code injection - [PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml](https://agentprime.io/advisories/GHSA-7qw2-w5rc-37x2.md) `GHSA-7qw2-w5rc-37x2`, `CVE-2026-57142`, `PYSEC-2026-3505` · PyPI `praisonai`: affected `>=4.5.87, <4.6.61`, fixed in `4.6.61` · CVSS 7.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Code injection, Broken access control - [PraisonAI: Remote Code Execution via Sandbox Escape in \`codeMode\` Tool](https://agentprime.io/advisories/GHSA-p69m-4f92-2v84.md) `GHSA-p69m-4f92-2v84`, `CVE-2026-57141` · npm `praisonai`: affected `<1.7.2`, fixed in `1.7.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Code injection - [PraisonAI: Jobs API exposes agent-execution endpoints with no authentication](https://agentprime.io/advisories/GHSA-fq2m-6wqh-x44g.md) `GHSA-fq2m-6wqh-x44g`, `CVE-2026-57131`, `PYSEC-2026-3511` · PyPI `praisonai`: affected `<4.6.59`, fixed in `4.6.59` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Code injection, Authentication bypass, Broken access control - [Karate Mock Server RCE via embedded expression evaluation of request-derived data](https://agentprime.io/advisories/GHSA-2c85-rfcc-g74j.md) `GHSA-2c85-rfcc-g74j` · Maven `io.karatelabs:karate-core`: affected `>=2.0.1, <2.1.0`, fixed in `2.1.0` · CVSS 4.0, no score published · Not analysed yet · Published 18 Jun 2026 · Tags: Code injection - [piscina: Prototype Pollution Gadget → RCE via inherited options.filename](https://agentprime.io/advisories/GHSA-x9g3-xrwr-cwfg.md) `GHSA-x9g3-xrwr-cwfg`, `CVE-2026-55388` · npm `piscina`: affected `<4.9.3 || >=5.0.0-alpha.0, <5.2.0 || >=6.0.0-rc.1, <6.0.0-rc.2`, fixed in `4.9.3`, `5.2.0`, `6.0.0-rc.2` · CVSS 8.1 High · Not analysed yet · Published 18 Jun 2026 · Tags: Code injection, Prototype pollution - [Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed](https://agentprime.io/advisories/GHSA-7p36-fq2r-4h7r.md) `GHSA-7p36-fq2r-4h7r`, `CVE-2026-11407`, `PKSA-6dhb-gq75-qpgr` · Packagist `pimcore/pimcore`: affected `<=11.5.14.1 || >=12.0.0-RC1, <=12.3.8`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: Code injection - [Duplicate Advisory: Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER](https://agentprime.io/advisories/GHSA-cc5p-54x3-hcf8.md) `GHSA-cc5p-54x3-hcf8` · PyPI `picklescan`: affected `*`, no fixed version yet · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 17 Jun 2026 · Tags: Code injection - [WordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-54816.md) `CVE-2026-54816` · CVE record: Monetizemore Advanced Ads · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: Code injection - [WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-40783.md) `CVE-2026-40783` · CVE record: Creative Themes Blocksy Companion Pro · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Code injection - [JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions.](https://agentprime.io/advisories/CVE-2026-36418.md) `CVE-2026-36418` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Code injection - [WordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin < 2.0.52 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-25470.md) `CVE-2026-25470` · CVE record: ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection - [WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2026-49113.md) `CVE-2026-49113` · CVE record: THEMECO Cornerstone · CVSS 8.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection - [Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution](https://agentprime.io/advisories/GHSA-365w-hqf6-vxfg.md) `GHSA-365w-hqf6-vxfg`, `CVE-2026-56260`, `CVE-2026-56261`, `CVE-2026-56262`, `CVE-2026-56263`, `CVE-2026-56264`, `CVE-2026-56265`, `CVE-2026-56266`, `GHSA-53rg-46cm-4g2v`, `GHSA-8qrg-7j2f-rf2h`, `GHSA-f23g-2f38-gg94`, `GHSA-g2pv-76hm-j4x9`, `GHSA-r9hw-78q5-478g`, `GHSA-xrfj-6m49-wfmm`, `PYSEC-2026-229`, `PYSEC-2026-230`, `PYSEC-2026-239`, `PYSEC-2026-3443`, `PYSEC-2026-3449`, `PYSEC-2026-596`, `PYSEC-2026-798` · PyPI `crawl4ai`: affected `<0.8.7`, fixed in `0.8.7` · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Path traversal, Cross-site scripting (XSS), Code injection, Authentication bypass - [Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API](https://agentprime.io/advisories/GHSA-qxjp-w3pj-48m7.md) `GHSA-qxjp-w3pj-48m7`, `CVE-2026-53753`, `PYSEC-2026-319` · PyPI `crawl4ai`: affected `<0.8.7`, fixed in `0.8.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection, CWE-913 - [Code injection in Oracle Corporation PeopleSoft Enterprise CS Campus Community](https://agentprime.io/advisories/CVE-2026-46851.md) `CVE-2026-46851` · CVE record: Oracle Corporation PeopleSoft Enterprise CS Campus Community · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection - [Code injection in Oracle Corporation MySQL Shell](https://agentprime.io/advisories/CVE-2026-46850.md) `CVE-2026-46850` · CVE record: Oracle Corporation MySQL Shell · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection - [Langflow: Unauthenticated RCE in Shareable Playgrounds](https://agentprime.io/advisories/GHSA-v5ff-9q35-q26f.md) `GHSA-v5ff-9q35-q26f`, `CVE-2026-48519`, `PYSEC-2026-243` · PyPI `langflow`: affected `<1.9.2`, fixed in `1.9.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection - [vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-q8gq-377p-jq3r.md) `GHSA-q8gq-377p-jq3r`, `CVE-2026-41523`, `PYSEC-2026-2300` · PyPI `vllm`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection, Denial of service - [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2026-24155.md) `CVE-2026-24155` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection - [WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-49774.md) `CVE-2026-49774` · CVE record: Filipe Nasc RD Station · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Code injection - [YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution](https://agentprime.io/advisories/GHSA-68mc-h6h8-79wj.md) `GHSA-68mc-h6h8-79wj`, `CVE-2026-50880` · npm `youtransfer`: affected `<=1.0.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Code injection - [Remotion: remote code execution (RCE) vulnerability](https://agentprime.io/advisories/GHSA-2jqp-f4gr-44fr.md) `GHSA-2jqp-f4gr-44fr`, `CVE-2026-30120` · npm `remotion`: affected `<4.0.410`, fixed in `4.0.410` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Code injection - [WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-48836.md) `CVE-2026-48836` · CVE record: MantraBrain Easy Invoice · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Code injection - [WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-39465.md) `CVE-2026-39465` · CVE record: MetaSlider Responsive Slider by MetaSlider · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Code injection - [Starlette: Arbitrary HTTP method dispatched to \`HTTPEndpoint\` attributes via \`getattr\`](https://agentprime.io/advisories/GHSA-x746-7m8f-x49c.md) `GHSA-x746-7m8f-x49c`, `CVE-2026-48817`, `PYSEC-2026-2280` · PyPI `starlette`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Code injection - [protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names](https://agentprime.io/advisories/GHSA-pr59-h9ph-3fr8.md) `GHSA-pr59-h9ph-3fr8`, `CVE-2026-54271` · npm `protobufjs-cli`: affected `<1.3.2 || >=2.0.0, <2.5.0`, fixed in `1.3.2`, `2.5.0` · CVSS 8.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .