# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.](https://agentprime.io/advisories/CVE-2026-68489.md) `CVE-2026-68489` · CVE record: WebPros Plesk extension "Ruby" and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Code injection - [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-16428.md) `CVE-2026-16428` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Code injection - [itsourcecode Loan Management System navbar.php cross site scripting](https://agentprime.io/advisories/CVE-2026-90795.md) `CVE-2026-90795` · CVE record: itsourcecode Loan Management System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Apache Syncope: Groovy Sandbox escape for empty CommandArgs](https://agentprime.io/advisories/CVE-2026-77147.md) `CVE-2026-77147` · CVE record: Apache Software Foundation Apache Syncope · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Code injection - [Yot CMS Admin Console admin.php eval code injection](https://agentprime.io/advisories/CVE-2026-90709.md) `CVE-2026-90709` · CVE record: Yot CMS · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection, Code injection - [SourceCodester Inventory Management System Product Management products_handler.php cross site scripting](https://agentprime.io/advisories/CVE-2026-90696.md) `CVE-2026-90696` · CVE record: SourceCodester Inventory Management System · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting](https://agentprime.io/advisories/CVE-2026-90695.md) `CVE-2026-90695` · CVE record: SourceCodester Inventory Management System · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting](https://agentprime.io/advisories/CVE-2026-90694.md) `CVE-2026-90694` · CVE record: SourceCodester Inventory Management System · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Eval injection in Contec CONPROSYS HMI System(CHS)](https://agentprime.io/advisories/CVE-2026-82789.md) `CVE-2026-82789` · CVE record: Contec CONPROSYS HMI System(CHS) · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Code injection - [Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0](https://agentprime.io/advisories/CVE-2026-85192.md) `CVE-2026-85192` · CVE record: regularlabs.com Conditional Content Pro extension for Joomla · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Code injection - [SourceCodester Class and Exam Timetabling System subject1.php cross site scripting](https://agentprime.io/advisories/CVE-2026-90615.md) `CVE-2026-90615` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Totolink A3002MU Anchor Tag cross site scripting](https://agentprime.io/advisories/CVE-2026-90604.md) `CVE-2026-90604` · CVE record: Totolink A3002MU · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting](https://agentprime.io/advisories/CVE-2026-90602.md) `CVE-2026-90602` · CVE record: Anil-matcha Open-Generative-AI · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [kagisearch smallweb Query String Rendering sw.py index cross site scripting](https://agentprime.io/advisories/CVE-2026-90583.md) `CVE-2026-90583` · CVE record: kagisearch smallweb · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection](https://agentprime.io/advisories/CVE-2026-90581.md) `CVE-2026-90581` · CVE record: cym1102 nginxWebUI · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, Code injection - [Exrick xmall Order Printing order-print.jsp cross site scripting](https://agentprime.io/advisories/CVE-2026-90571.md) `CVE-2026-90571` · CVE record: Exrick xmall · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting](https://agentprime.io/advisories/CVE-2026-90570.md) `CVE-2026-90570` · CVE record: linlinjava litemall · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting](https://agentprime.io/advisories/CVE-2026-90569.md) `CVE-2026-90569` · CVE record: linlinjava litemall · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting](https://agentprime.io/advisories/CVE-2026-90568.md) `CVE-2026-90568` · CVE record: moxi624 Mogu Blog v2 · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting](https://agentprime.io/advisories/CVE-2026-90567.md) `CVE-2026-90567` · CVE record: quequnlong shiyi-blog · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting](https://agentprime.io/advisories/CVE-2026-90564.md) `CVE-2026-90564` · CVE record: quequnlong shiyi-blog · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting](https://agentprime.io/advisories/CVE-2026-90563.md) `CVE-2026-90563` · CVE record: maliangnansheng bbs-springboot · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting](https://agentprime.io/advisories/CVE-2026-90529.md) `CVE-2026-90529` · CVE record: DataEase · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [TDuckApp tduck-platform Form Write View index.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-90528.md) `CVE-2026-90528` · CVE record: TDuckApp tduck-platform · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [quequnlong shiyi-blog Add Message API index.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-90527.md) `CVE-2026-90527` · CVE record: quequnlong shiyi-blog · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [stilleshan ServerStatus Stats Generation main.cpp cross site scripting](https://agentprime.io/advisories/CVE-2026-90502.md) `CVE-2026-90502` · CVE record: stilleshan ServerStatus · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting](https://agentprime.io/advisories/CVE-2026-90497.md) `CVE-2026-90497` · CVE record: Fengoffice Feng Office · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [sanjevirau gsubs Electron index.js showQuerySuccessPage code injection](https://agentprime.io/advisories/CVE-2026-90491.md) `CVE-2026-90491` · CVE record: sanjevirau gsubs · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Other injection, Code injection - [Xuxueli xxl-job insert cross site scripting](https://agentprime.io/advisories/CVE-2026-90489.md) `CVE-2026-90489` · CVE record: Xuxueli xxl-job · CVSS 5.1 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection](https://agentprime.io/advisories/CVE-2026-90488.md) `CVE-2026-90488` · CVE record: Xuxueli xxl-job · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Other injection, Code injection - [vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attacke...](https://agentprime.io/advisories/GHSA-3c86-2m5g-59q7.md) `GHSA-3c86-2m5g-59q7`, `CVE-2026-90553`, `PYSEC-2026-3985` · PyPI `vllm`: affected `<0.28.0`, fixed in `0.28.0` · CVSS 8.5 High · Not analysed yet · Published 12 Sept 2026 · Tags: Code injection - [The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation](https://agentprime.io/advisories/CVE-2026-78159.md) `CVE-2026-78159` · CVE record: stellarwp The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Code injection - [Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values](https://agentprime.io/advisories/CVE-2026-81910.md) `CVE-2026-81910` · CVE record: Concrete CMS Concrete CMS · CVSS 5.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection - [CSTI in Arma Digital's Website Template](https://agentprime.io/advisories/CVE-2026-9160.md) `CVE-2026-9160` · CVE record: Arma Digital Media Inc. Website Template · CVSS 4.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection - [CVE-2026-86793](https://agentprime.io/advisories/CVE-2026-86793.md) `CVE-2026-86793` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection - [Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-14560.md) `CVE-2026-14560` · CVE record: Unknown teddy-bear-customize-addon · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection - [Certain Woltlab products are affected by RCE via Cache Poisoning.](https://agentprime.io/advisories/CVE-2026-79362.md) `CVE-2026-79362` · CVE record · CVSS 8.8 High · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection - [Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards](https://agentprime.io/advisories/CVE-2026-78571.md) `CVE-2026-78571` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards](https://agentprime.io/advisories/CVE-2026-79742.md) `CVE-2026-79742` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards](https://agentprime.io/advisories/CVE-2026-81204.md) `CVE-2026-81204` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards](https://agentprime.io/advisories/CVE-2026-81940.md) `CVE-2026-81940` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [OmniRoute ACP Custom-Agent Remote Code Execution (RCE)](https://agentprime.io/advisories/GHSA-hf57-cqmx-p4gr.md) `GHSA-hf57-cqmx-p4gr`, `CVE-2026-88062` · npm `omniroute`: affected `<=3.8.50`, no fixed version yet · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection, Authentication bypass - [IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-9176.md) `CVE-2026-9176` · CVE record: IBM WebSphere Application Server · CVSS 6.7 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Template injection in Forgejo](https://agentprime.io/advisories/CVE-2026-89094.md) `CVE-2026-89094` · CVE record: Forgejo Forgejo · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution](https://agentprime.io/advisories/GHSA-6xcw-7xm6-48c6.md) `GHSA-6xcw-7xm6-48c6`, `CVE-2026-86083` · npm `n8n`: affected `<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2`, fixed in `1.123.76`, `2.37.7`, `2.38.2` · CVSS 7.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Low-privilege RCE through element-search eager loading](https://agentprime.io/advisories/CVE-2026-79987.md) `CVE-2026-79987` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution](https://agentprime.io/advisories/GHSA-hw8v-xxg5-vvvx.md) `GHSA-hw8v-xxg5-vvvx`, `CVE-2026-86076` · npm `n8n`: affected `<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2`, fixed in `1.123.76`, `2.37.7`, `2.38.2` · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-81803.md) `CVE-2026-81803` · CVE record: Ateeq Rafeeq RepairBuddy · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66632.md) `CVE-2026-66632` · CVE record: Elliot Sowers/ RelyWP Simple Cloudflare Turnstile · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod](https://agentprime.io/advisories/CVE-2026-80351.md) `CVE-2026-80351` · CVE record: Apache Software Foundation Apache Camel K · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects](https://agentprime.io/advisories/CVE-2026-80352.md) `CVE-2026-80352` · CVE record: Apache Software Foundation Apache Camel K · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Velociraptor VQL injection during notebook restore from backup](https://agentprime.io/advisories/CVE-2026-19584.md) `CVE-2026-19584` · CVE record: Rapid7 Velociraptor · CVSS 7.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/\ endpoint](https://agentprime.io/advisories/CVE-2026-52098.md) `CVE-2026-52098` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, \_afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex (common_patterns.dart) compon…](https://agentprime.io/advisories/CVE-2026-52097.md) `CVE-2026-52097` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection - [Rizwan17 inventory-management-system Login Page index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-87926.md) `CVE-2026-87926` · CVE record: Rizwan17 inventory-management-system · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Rizwan17 inventory-management-system List DBOperation.php cross site scripting](https://agentprime.io/advisories/CVE-2026-87923.md) `CVE-2026-87923` · CVE record: Rizwan17 inventory-management-system · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution](https://agentprime.io/advisories/GHSA-2pxq-5vcg-rq29.md) `GHSA-2pxq-5vcg-rq29` · PyPI `gitpython`: affected `<=3.1.59`, no fixed version yet · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection - [Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)](https://agentprime.io/advisories/CVE-2026-41871.md) `CVE-2026-41871` · CVE record: Apache Software Foundation Apache Nutch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection, Broken access control - [Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)](https://agentprime.io/advisories/CVE-2026-41870.md) `CVE-2026-41870` · CVE record: Apache Software Foundation Apache Nutch · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection, Broken access control, CWE-913 - [Unauthenticated Remote Code Execution in Akana API Platform](https://agentprime.io/advisories/CVE-2026-85978.md) `CVE-2026-85978` · CVE record: Perforce Akana · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection, Broken access control, CWE-41 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .