Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.8 Medium
BIVOCOM TR321 Wireless Setting cross site scripting
- BIVOCOM TR321
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
BDCOM P3310D New RMON Statistics cross site scripting
- BDCOM P3310D
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
BDCOM P3310D New RMON History cross site scripting
- BDCOM P3310D
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
BDCOM P3310D rmon event Tab cross site scripting
- BDCOM P3310D
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
BDCOM P3310D New User index.asp cross site scripting
- BDCOM P3310D
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
AstrBot has Incomplete Filtering of Special Elements
- Code injection
- CWE-791
<=4.22.1 · no fixed version yet
GHSA-h3rr-9wqj-v3c6 · CVE-2026-6984 - CVSS 5.1 Medium
projeto-siga novo cross site scripting
- siga
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
simple-git is vulnerable to Remote Code Execution
- Command injection
- Code injection
<3.36.0 · fixed in 3.36.0
GHSA-hffm-xvc3-vprc · CVE-2026-6951 - CVSS 7.4 High
Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml
- skim
- Code injection
- CVSS 8.9 High
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
- Code injection
- Insecure deserialization
>=2.49.0, <2.55.0 · fixed in 2.55.0
GHSA-mw35-8rx3-xf9r · CVE-2026-41486 - CVSS 8.6 High
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
- Code injection
>=1.80.5, <1.83.7 · fixed in 1.83.7
GHSA-xqmj-j6mv-4862 · CVE-2026-42203 - CVSS 8.1 High
Contour has Lua code injection via Cookie Path Rewrite Policy
- Code injection
>=1.19.0, <1.31.6 || >=1.32.0, <1.32.5 || >=1.33.0, <1.33.4 · fixed in 1.31.6, 1.32.5, 1.33.4
GHSA-x4mj-7f9g-29h4 · CVE-2026-41246 - CVSS 8.8 High
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
- Code injection
- CWE-20
<5.19.6 || >=6.0.0, <6.2.5 · fixed in 5.19.6, 6.2.5
GHSA-w3w2-mpp5-92gm · CVE-2026-40466 - CVSS 8.8 High
Apache ActiveMQ Vulnerable to Code Injection
- Code injection
- CWE-20
<5.19.6 || >=6.0.0, <6.2.5 · fixed in 5.19.6, 6.2.5
GHSA-mr6m-xj7v-3cv3 · CVE-2026-41044 - CVSS 5.4 Medium
AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component
- Mintplex-Labs anything-llm
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
- Command injection
- Code injection
<2.0.3 · fixed in 2.0.3
GHSA-8h25-q488-4hxw · CVE-2026-41900 - CVSS 7.6 High
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
- Code injection
<4.9.0 || >=5.0.0, <5.4.0 · fixed in 4.9.0, 5.4.0
GHSA-jcjw-58rv-c452 · CVE-2026-34587 - CVSS 6.4 Medium
ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function
- Code injection
- CWE-777
<2.22.0 · fixed in 2.22.0
GHSA-pqhx-w72w-m393 · CVE-2026-39087 - CVSS 5.9 Medium
H2O-3 is Vulnerable to Code Injection
- Code injection
<3.46.0.10 · fixed in 3.46.0.10
GHSA-qmcv-hh7c-3m56 · CVE-2026-3960 - CVSS 9.9 CriticalCritical · CVSS 9+
WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability
- Funnelforms LLC FunnelFormsPro
- Code injection
- CVSS 6.3 Medium
verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()
- Code injection
- CWE-264
<=0.7.1 · no fixed version yet
GHSA-h57c-v2v3-5v3v · CVE-2026-6878 - CVSS 9.0 CriticalCritical · CVSS 9+
Luanti has a mod security sandbox escape
- luanti
- Code injection
- CVSS 4.0 Medium
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
- Code injection
>=3.0.0, <3.8.0 · fixed in 3.8.0
GHSA-jm34-66cf-qpvr · CVE-2026-41282 - CVSS 4.7 Medium
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
- Cross-site scripting (XSS)
- Code injection
<4.0.8 · fixed in 4.0.8
GHSA-6457-mxpq-4fqq · CVE-2026-41692 - CVSS 9.2 CriticalCritical · CVSS 9+
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- Command injection
- Code injection
>=1.48.0, <1.73.5 · fixed in 1.73.5
GHSA-jfwf-28xr-xw6q · CVE-2026-41179 - CVSS 7.4 High
Incomplete domain name sanitization during
- PowerDNS Authoritative
- Code injection
- CVSS 5.1 Medium
Bagisto affected by Cross-site Scripting
- Cross-site scripting (XSS)
- Code injection
<=2.3.15 · no fixed version yet
GHSA-65fp-7g2v-658r · CVE-2026-6745 - CVSS 5.1 Medium
WebSystems WebTOTUM Calendar cross site scripting
- WebSystems WebTOTUM
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Dolibarr Allows Code Injection through its Website Module
- Code injection
- Broken access control
<=15.0.3 · no fixed version yet
GHSA-676v-wh57-p375 · CVE-2026-31018 - CVSS 10.0 CriticalCritical · CVSS 9+
Spinnaker: RCE via expression parsing due to unrestricted context handling
- Code injection
>=2026.0-0, <2026.0.1 || >=2025.4-0, <2025.4.2 || <2025.3.2 · fixed in 2026.0.1, 2025.4.2, 2025.3.2
GHSA-69rw-45wj-g4v6 · CVE-2026-32613 - CVSS 5.1 Medium
Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection
- Pagekit CMS
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
- givanz Vvveb
- Code injection
- CVSS 4.8 Medium
erponline.xyz ERP Online Inventory Edit Item cross site scripting
- erponline.xyz ERP Online
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
CVE-2026-5760
- SGLang
- Code injection
- CVSS 5.1 Medium
Qibo CMS Internal Message cross site scripting
- Qibo CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Yifang CMS Extended Management L_rbac_admin.php store cross site scripting
- Yifang CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
BichitroGan ISP Billing Software Pool List add cross site scripting
- BichitroGan ISP Billing Software
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
BichitroGan ISP Billing Software Profile users-view cross site scripting
- BichitroGan ISP Billing Software
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
BichitroGan ISP Billing Software Customer edit cross site scripting
- BichitroGan ISP Billing Software
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
1024bit extend-deep index.js prototype pollution
- 1024bit extend-deep
- Code injection
- Prototype pollution
- CVSS 5.1 Medium
langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
AgentScope Vulnerable to Remote Code Injection
- Other injection
- Code injection
<=1.0.18 · no fixed version yet
GHSA-cr24-fv3h-8cjm · CVE-2026-6603 - CVSS 6.9 Medium
Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization
- Code injection
- Prototype pollution
<=1.3.1 · no fixed version yet
GHSA-3jc6-6r48-v6qf · CVE-2026-6594 - CVSS 5.1 Medium
langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting
- langflow
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
ComfyUI View Endpoint server.py cross site scripting
- ComfyUI
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
ComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting
- ComfyUI
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting
- Wavlink WL-WN579A3
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Remote Code Execution (RCE) via String Literal Injection into math-codegen
- Code injection
<0.4.3 · fixed in 0.4.3
GHSA-p6x5-p4xf-cc4r · CVE-2026-41507 - CVSS 10.0 CriticalCritical · CVSS 9+
Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution
- firebird
- Path traversal
- Code injection
- CVSS 5.1 Medium
lukevella rallly Reset Password reset-password-form.tsx cross site scripting
- lukevella rallly
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
classroombookings User Display Name layout.php read cross site scripting
- classroombookings
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.2 High
Template injection in JetBrains YouTrack
- JetBrains YouTrack
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE
- siyuan
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Unsafe object property setter in mathjs
- Broken access control
- Code injection
>=13.1.1, <15.2.0 · fixed in 15.2.0
GHSA-29qv-4j9f-fjw5 · CVE-2026-40897 - CVSS 9.4 CriticalCritical · CVSS 9+
protobufjs has an arbitrary code execution issue
- Code injection
<6.11.6 || >=7.0.0, <7.5.5 || >=8.0.0, <8.0.1 · fixed in 6.11.6, 7.5.5, 8.0.1
GHSA-xq3m-2v4x-88gg · CVE-2026-41242 - CVSS 9.4 CriticalCritical · CVSS 9+
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
- Code injection
<3.1.0 · fixed in 3.1.0
GHSA-9wc7-mj3f-74xv · CVE-2026-41137 - CVSS 8.3 High
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
- Code injection
<3.1.0 · fixed in 3.1.0
GHSA-f228-chmx-v6j6 · CVE-2026-41138 - CVSS 8.1 High
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
- Code injection
<1.14.2 || >=2.0-RC1, <2.7.32 || >=3.0-RC1, <3.14.16 || >=4.0-M1, <4.7.5 || >=5.0-M1, <5.2.3 · fixed in 1.14.2, 2.7.32, 3.14.16, 4.7.5, 5.2.3
GHSA-vp6r-9m58-5xv8 · CVE-2026-41883 - CVSS 5.6 Medium
Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates
- Code injection
<1.0.0 · fixed in 1.0.0
GHSA-33qf-q99x-wpm8 · CVE-2026-40602 - CVSS 8.1 High
Statamic: Unsafe method invocation via query value resolution allows data destruction
- Code injection
<5.73.20 || >=6.0.0-alpha.1, <6.13.0 · fixed in 5.73.20, 6.13.0
GHSA-4jjr-vmv7-wh4w · CVE-2026-41175