# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py \_load_text_config code injection](https://agentprime.io/advisories/CVE-2026-108957.md) `CVE-2026-108957` · CVE record: TinyLLaVA TinyLLaVA_Factory · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection - [iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection](https://agentprime.io/advisories/CVE-2026-108945.md) `CVE-2026-108945` · CVE record: iMoonLab yolov13 · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection - [repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection](https://agentprime.io/advisories/CVE-2026-108944.md) `CVE-2026-108944` · CVE record: repository RAE · CVSS 2.4 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection - [Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)](https://agentprime.io/advisories/CVE-2026-89107.md) `CVE-2026-89107` · CVE record: SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Code injection - [ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection](https://agentprime.io/advisories/CVE-2026-108943.md) `CVE-2026-108943` · CVE record: ModelTC LightX2V · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection, Code injection - [philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting](https://agentprime.io/advisories/CVE-2026-108942.md) `CVE-2026-108942` · CVE record: philz1337x clarity-upscaler · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.](https://agentprime.io/advisories/CVE-2026-78802.md) `CVE-2026-78802` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Code injection - [Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection](https://agentprime.io/advisories/CVE-2026-108941.md) `CVE-2026-108941` · CVE record: Linketic CityGaussian · CVSS 2.4 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Code injection - [IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI](https://agentprime.io/advisories/CVE-2026-96119.md) `CVE-2026-96119` · CVE record: IBM i · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Edimax BR-6208AC QoS Page formQoS cross site scripting](https://agentprime.io/advisories/CVE-2026-108936.md) `CVE-2026-108936` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [DataStage on Cloud Pak for Data Code Injection](https://agentprime.io/advisories/CVE-2026-82108.md) `CVE-2026-82108` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields](https://agentprime.io/advisories/CVE-2026-109652.md) `CVE-2026-109652` · CVE record: frappe erpnext · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Edimax BR-6208AC Port Forwarding formPortFw cross site scripting](https://agentprime.io/advisories/CVE-2026-108935.md) `CVE-2026-108935` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting](https://agentprime.io/advisories/CVE-2026-108934.md) `CVE-2026-108934` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Edimax BR-6208AC formFilter cross site scripting](https://agentprime.io/advisories/CVE-2026-108933.md) `CVE-2026-108933` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Maximo AI Service Code Injection](https://agentprime.io/advisories/CVE-2026-90920.md) `CVE-2026-90920` · CVE record: IBM Maximo AI Service · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting](https://agentprime.io/advisories/CVE-2026-108932.md) `CVE-2026-108932` · CVE record: Netcore NR268 · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [IBM Maximo Application Suite - Location Service for Esri Component Code Execution](https://agentprime.io/advisories/CVE-2026-18533.md) `CVE-2026-18533` · CVE record: IBM Maximo Application Suite - Location Service for Esri Component · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [IBM Maximo Application Suite - Location Service for Esri Component Code Execution](https://agentprime.io/advisories/CVE-2026-18537.md) `CVE-2026-18537` · CVE record: IBM Maximo Application Suite - Location Service for Esri Component · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting](https://agentprime.io/advisories/CVE-2026-108931.md) `CVE-2026-108931` · CVE record: Netcore NR268 · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108920.md) `CVE-2026-108920` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108919.md) `CVE-2026-108919` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting](https://agentprime.io/advisories/CVE-2026-108908.md) `CVE-2026-108908` · CVE record: Netcore NR268 · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass](https://agentprime.io/advisories/CVE-2026-109347.md) `CVE-2026-109347` · CVE record: vrana adminer · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection](https://agentprime.io/advisories/CVE-2026-109308.md) `CVE-2026-109308` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every](https://agentprime.io/advisories/CVE-2026-109305.md) `CVE-2026-109305` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [CVE-2026-107248](https://agentprime.io/advisories/CVE-2026-107248.md) `CVE-2026-107248` · CVE record: Thelia Thelia · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Netis WF2409E Wireless Settings cross site scripting](https://agentprime.io/advisories/CVE-2026-108898.md) `CVE-2026-108898` · CVE record: Netis WF2409E · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [CVE-2026-103537](https://agentprime.io/advisories/CVE-2026-103537.md) `CVE-2026-103537` · CVE record: Thelia Thelia · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [CVE-2026-103535](https://agentprime.io/advisories/CVE-2026-103535.md) `CVE-2026-103535` · CVE record: Thelia Thelia · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection, Unrestricted file upload - [CVE-2026-103528](https://agentprime.io/advisories/CVE-2026-103528.md) `CVE-2026-103528` · CVE record: Thelia Thelia · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template](https://agentprime.io/advisories/CVE-2026-109199.md) `CVE-2026-109199` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection - [Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108834.md) `CVE-2026-108834` · CVE record: Cairo-dock Glx-Dock · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Zen Cart Administrative Module Management general.php zen_call_function code injection](https://agentprime.io/advisories/CVE-2026-108827.md) `CVE-2026-108827` · CVE record: Zen Cart · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Code injection - [agno-agi agno PythonTools python.py run_python_code code injection](https://agentprime.io/advisories/CVE-2026-108816.md) `CVE-2026-108816` · CVE record: agno-agi agno · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection, Code injection - [idcCMS member_deal.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108815.md) `CVE-2026-108815` · CVE record: idcCMS · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting](https://agentprime.io/advisories/CVE-2026-108802.md) `CVE-2026-108802` · CVE record: y_project RuoYi · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine](https://agentprime.io/advisories/CVE-2026-108570.md) `CVE-2026-108570` · CVE record: Furion .NET Framework · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Code injection, CWE-791 - [InstantSoft icms2 Private Message index.tpl.php index cross site scripting](https://agentprime.io/advisories/CVE-2026-108566.md) `CVE-2026-108566` · CVE record: InstantSoft icms2 · CVSS 5.1 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability](https://agentprime.io/advisories/CVE-2026-62098.md) `CVE-2026-62098` · CVE record: kutethemes Boutique · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-42696.md) `CVE-2026-42696` · CVE record: Royal Plugins SiteVault – Backup, Restore, Migration \& Cloning · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-39802.md) `CVE-2026-39802` · CVE record: everestthemes Everest Backup · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates](https://agentprime.io/advisories/CVE-2026-108598.md) `CVE-2026-108598` · CVE record: floci-io floci · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint](https://agentprime.io/advisories/CVE-2026-108593.md) `CVE-2026-108593` · CVE record: decolua 9router · CVSS 7.3 High · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103071.md) `CVE-2026-103071` · CVE record: VillaTheme Thank You Page Customizer for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates](https://agentprime.io/advisories/CVE-2026-108551.md) `CVE-2026-108551` · CVE record: ferdikoomen openapi-typescript-codegen · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field](https://agentprime.io/advisories/CVE-2026-97670.md) `CVE-2026-97670` · CVE record: themefusion Avada (Fusion) Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting](https://agentprime.io/advisories/CVE-2026-104021.md) `CVE-2026-104021` · CVE record: hostspa Fastcache by Host.it · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection - [Tina: Code injection via unescaped Git branch name in generated client source](https://agentprime.io/advisories/GHSA-pwhx-cvv3-qj5c.md) `GHSA-pwhx-cvv3-qj5c`, `CVE-2026-108259` · npm `@tinacms/cli`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 8.2 High · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection - [Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-108264.md) `CVE-2026-108264` · CVE record: wizarrrr wizarr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection - [Astron Agent: Unsandboxed code-node leads to cross-tenant RCE](https://agentprime.io/advisories/CVE-2026-108263.md) `CVE-2026-108263` · CVE record: iflytek astron-agent · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection, Authentication bypass, Broken access control, CWE-653 - [Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite](https://agentprime.io/advisories/GHSA-p393-cf76-4jmr.md) `GHSA-p393-cf76-4jmr`, `CVE-2026-107806`, `GO-2026-6741` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20260421071512-7864e378f5cf, <1.9.10-0.20260728074146-a467ed652591`, fixed in `1.9.10-0.20260728074146-a467ed652591` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection - [SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount](https://agentprime.io/advisories/CVE-2026-104082.md) `CVE-2026-104082` · CVE record: Smartertools Smartermail · CVSS 8.6 High · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection - [Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code](https://agentprime.io/advisories/CVE-2026-104629.md) `CVE-2026-104629` · CVE record: Grid Protection Alliance openPDC and 2 more · CVSS 7.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection - [An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.](https://agentprime.io/advisories/CVE-2026-78797.md) `CVE-2026-78797` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection - [SumatraPDF: Markup/command-link injection into UI notification text](https://agentprime.io/advisories/CVE-2026-107732.md) `CVE-2026-107732` · CVE record: sumatrapdfreader sumatrapdf · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-11888.md) `CVE-2026-11888` · CVE record: IBM Security Verify Access and 3 more · CVSS 6.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection - [PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source](https://agentprime.io/advisories/GHSA-79fv-7hq9-w7xg.md) `GHSA-79fv-7hq9-w7xg`, `CVE-2026-61433`, `PYSEC-2026-4251` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, CWE-116 - [dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument](https://agentprime.io/advisories/CVE-2026-107700.md) `CVE-2026-107700` · CVE record: ntharim dot-access · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection - [Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)](https://agentprime.io/advisories/GHSA-8r5x-fm3f-whwj.md) `GHSA-8r5x-fm3f-whwj`, `CVE-2026-106446` · npm `handlebars`: affected `>=4.0.0, <4.7.10`, fixed in `4.7.10` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .