Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.7 Medium
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading component.
- Code injection
- Broken access control
- CVSS 7.3 High
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its gRPC server component.
- Code injection
- Broken access control
- CVSS 4.8 Medium
Devs Palace ERP Online sales_save cross site scripting
- Devs Palace ERP Online
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Devs Palace ERP Online purchase_save cross site scripting
- Devs Palace ERP Online
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log...
- Code injection
<=8.2.0 · no fixed version yet
GHSA-444r-2whx-3685 · CVE-2021-47935 - CVSS 8.7 High
Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation
- Evolution CMS
- Code injection
- CVSS 8.7 High
ImpressCMS 1.4.2 Remote Code Execution via Autotasks
- ImpressCMS
- Code injection
- CVSS 8.7 High
Aero CMS 0.0.1 PHP Code Injection via posts.php
- MegaTKC Aero CMS
- Code injection
- CVSS 4.8 Medium
Devs Palace ERP Online item-save cross site scripting
- Devs Palace ERP Online
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Devs Palace ERP Online customer-save cross site scripting
- Devs Palace ERP Online
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Devs Palace ERP Online supplier-save cross site scripting
- Devs Palace ERP Online
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Devs Palace ERP Online purchase_return_save cross site scripting
- Devs Palace ERP Online
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
codelibs Fess JSP File AdminDesignAction.java update code injection
- codelibs Fess
- Other injection
- Code injection
- CVSS 5.3 Medium
JeecgBoot SVG File CommonController.java cross site scripting
- JeecgBoot
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
- Code injection
>=1.0.0, <1.0.7 || >=1.1.0, <1.1.6 · fixed in 1.0.7, 1.1.6
GHSA-v632-2m87-7469 · CVE-2026-41705 - CVSS 10.0 CriticalCritical · CVSS 9+
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
- gitroomhq postiz-app
- Code injection
- CVSS 7.5 High
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
- Code injection
<2.4.2 · fixed in 2.4.2
GHSA-gphh-9q3h-jgpp · CVE-2026-44209 - CVSS 8.2 High
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
- Code injection
- Memory corruption
>=7.12.0, <7.29.4 || >=8.0.0-alpha.0, <8.0.0-alpha.13 · fixed in 7.29.4, 8.0.0-alpha.13
GHSA-fv7c-fp4j-7gwp · CVE-2026-44728 - CVSS 5.3 Medium
Code injection in WebPros cPanel and others
- WebPros cPanel
- WebPros cPanel (CloudLinux 6, CentOS 6)
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Electerm users can run dangrous code through link or command line
- Code injection
- CWE-20
>=3.0.6, <3.8.8 · fixed in 3.8.8
GHSA-mpm8-cx2p-626q · CVE-2026-43944 - CVSS 9.4 CriticalCritical · CVSS 9+
SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE
- Cross-site scripting (XSS)
- Code injection
<0.0.0-20260512140701-d7b77d945e0d · fixed in 0.0.0-20260512140701-d7b77d945e0d
GHSA-2h64-c999-c9r6 · CVE-2026-44670 - CVSS 9.9 CriticalCritical · CVSS 9+
Remote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService`
- 0din-ai ai-scanner
- Code injection
- CVSS 8.3 High
Server-side template injection
- SEPPmail AG Secure Email Gateway
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated Remote Code Execution
- SEPPmail AG Secure Email Gateway
- Code injection
- CVSS 8.8 High
Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates
- Apache Software Foundation Apache CloudStack
- Code injection
- CVSS 3.0 Low
Template injection in OpenStack Ironic
- OpenStack Ironic
- Code injection
- CVSS 4.8 Medium
SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting
- SourceCodester Pharmacy Sales and Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess fil…
- Code injection
- CVSS 7.3 High
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.
- Code injection
- CVSS 5.3 Medium
SourceCodester Pizzafy Ecommerce System index.php cross site scripting
- SourceCodester Pizzafy Ecommerce System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.3 Medium
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
- Code injection
- Unrestricted file upload
<=2025.81 · no fixed version yet
GHSA-vf3q-frmr-vrr9 · CVE-2026-42879 - CVSS 7.8 High
Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext
- dail8859 NotepadNext
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
next-npm-version is vulnerable to Command injection
- Code injection
=1.0.1 · no fixed version yet
GHSA-2xx6-qf7x-grqh · CVE-2025-63706 - CVSS 9.8 CriticalCritical · CVSS 9+
Other issue in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
- CVSS 8.7 High
SurrealDB Injection on Open Notebook
- Open Notebook
- Cross-site request forgery (CSRF)
- Code injection
- CVSS 8.3 High
Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console
- Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900
- Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H
- Code injection
- CVSS 8.8 High
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
- Code injection
- CWE-358
<0.38.0 · fixed in 0.38.0
GHSA-98h9-4798-4q5v · CVE-2026-44513 - CVSS 10.0 CriticalCritical · CVSS 9+
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
- Code injection
- Prototype pollution
>=3.9.6, <3.11.0 · fixed in 3.11.0
GHSA-vwrp-x96c-mhwq · CVE-2026-44005 - CVSS 10.0 CriticalCritical · CVSS 9+
vm2 Access to Host Object Enables Sandbox Escape
- Code injection
- CWE-653
<3.11.0 · fixed in 3.11.0
GHSA-47x8-96vw-5wg6 · CVE-2026-43997 - CVSS 10.0 CriticalCritical · CVSS 9+
vm2 has a Sandbox Escape Vulnerability
- Code injection
- CWE-914
<3.11.0 · fixed in 3.11.0
GHSA-qcp4-v2jj-fjx8 · CVE-2026-44006 - CVSS 8.8 High
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
- Code injection
<0.38.0 · fixed in 0.38.0
GHSA-j7w6-vpvq-j3gm · CVE-2026-44827 - CVSS 9.8 CriticalCritical · CVSS 9+
ChestnutCMS v1.5.10 has a SQL injection vulnerability.
- Code injection
- CVSS 8.4 High
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
- Code injection
>=4.5.139, <4.6.32 · fixed in 4.6.32
GHSA-xcmw-grxf-wjhj · CVE-2026-44334 - CVSS 7.8 High
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
- Code injection
<3.1.49 · fixed in 3.1.49
GHSA-v87r-6q3f-2j67 · CVE-2026-44244 - CVSS 9.1 CriticalCritical · CVSS 9+
Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
- Code injection
>=13.0.0, <13.23.0 · fixed in 13.23.0
GHSA-j7j9-5253-f7vh · CVE-2026-42555 - CVSS 9.4 CriticalCritical · CVSS 9+
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
- Code injection
>=0.13.2, <0.13.22 · fixed in 0.13.22
GHSA-4rm2-28vj-fj39 · CVE-2026-44262 - CVSS 4.2 Medium
Code injection in Google Chrome
- Google Chrome
- Code injection
- CVSS 8.6 High
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
- Code injection
- CWE-479
>=4.0.0, <4.17.12 || >=5.0.0, <5.9.18 · fixed in 4.17.12, 5.9.18
GHSA-qrgm-p9w5-rrfw · CVE-2026-44011 - CVSS 9.0 CriticalCritical · CVSS 9+
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
- Code injection
<2.3.8 · fixed in 2.3.8
GHSA-4pvg-prr3-9cxr · CVE-2026-42238 - CVSS 6.6 Medium
Code injection in Oracle Corporation Oracle Cloud Native Environment Command Line Interface
- Oracle Corporation Oracle Cloud Native Environment Command Line Interface
- Code injection
- CVSS 8.8 High
GV-ASWeb Remote Code Execution (RCE) vulnerability
- GeoVision Inc. ASManager
- Code injection
- CVSS 4.0, no score published
jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine
- Code injection
<3.53.0 · fixed in 3.53.0
GHSA-mggx-p7jf-jgw4 - CVSS 9.1 CriticalCritical · CVSS 9+
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
- Code injection
<2.0.0-beta.2 · fixed in 2.0.0-beta.2
GHSA-w48r-jppp-rcfw · CVE-2026-42607 - CVSS 7.2 High
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
- Code injection
<=29.0 · no fixed version yet
GHSA-ghcv-22jf-vfxm · CVE-2026-43874 - CVSS 8.6 High
PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope
- Code injection
<1.1.36 · fixed in 1.1.36
GHSA-89g2-xw5c-v95p · CVE-2026-42079 - CVSS 8.4 High
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
- Code injection
- CWE-427
<2026.4.23 · fixed in 2026.4.23
GHSA-r39h-4c2p-3jxp · CVE-2026-45004 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has a WASM Sandbox Escape
- Code injection
- CWE-653
<3.10.5 · fixed in 3.10.5
GHSA-ffh4-j6h5-pg66 · CVE-2026-26956 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has a Sandbox Escape Issue via SuppressedError
- Code injection
- CWE-653
<3.11.0 · fixed in 3.11.0
GHSA-55hx-c926-fr95 · CVE-2026-26332 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has Sandbox Breakout Through Inspect Function
- Code injection
- CWE-653
<3.11.0 · fixed in 3.11.0
GHSA-v37h-5mfm-c47c · CVE-2026-24781 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has Sandbox Breakout Through Promise Species
- Code injection
- CWE-693
<3.10.5 · fixed in 3.10.5
GHSA-qvjj-29qf-hp7p · CVE-2026-24120