Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.7 High
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
- Code injection
<=0.9.5 · no fixed version yet
GHSA-6vr3-7wcx-v5g5 · CVE-2026-49143 - CVSS 8.2 High
Docling: Unsafe Playwright-based HTML Rendering
- Code injection
- Server-side request forgery (SSRF)
>=2.82.0, <2.91.0 · fixed in 2.91.0
GHSA-pj2v-ggqh-cmq2 · CVE-2026-44016 - CVSS 5.1 Medium
ahujasid blender-mcp server.py execute_blender_code code injection
- ahujasid blender-mcp
- Other injection
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
OpenMed vulnerable to remote code injection through privacy-filter model loading path
- Code injection
<1.5.2 · fixed in 1.5.2
GHSA-m3v4-v5gx-7wf5 · CVE-2026-47117 - CVSS 8.8 High
Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
- jhorowitz Content Visibility for Divi Builder
- Code injection
- CVSS 6.5 Medium
Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes
- Code injection
>=1.5.0, <1.42.0 · fixed in 1.42.0
GHSA-c2rv-hwqm-wjpg · CVE-2026-46718 - CVSS 9.3 CriticalCritical · CVSS 9+
Server-Side Template Injection (SSTI) in Wirtualna Uczelnia
- Simple SA Wirtualna Uczelnia
- Code injection
- CVSS 5.1 Medium
1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
- 1Panel-dev CordysCRM
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting
- westboy CicadasCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
- 1Panel-dev CordysCRM
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode Fees Management System index.php cross site scripting
- itsourcecode Fees Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Hotel and Tourism Reservation System tour.php cross site scripting
- code-projects Hotel and Tourism Reservation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
IBM WebSphere Application Server is affected by remote code execution
- IBM WebSphere Application Server
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests
- CloudPirates-io helm-charts
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling
- CloudPirates-io helm-charts
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Critical RCE vulnerability in Disig Web Signer
- Disig Web Signer
- Code injection
- CVSS 5.1 Medium
SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting
- SourceCodester Pharmacy Sales and Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting
- SourceCodester Pharmacy Sales and Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
- Code injection
- CWE-20
<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6
GHSA-v853-w46p-fv2h · CVE-2026-45505 - CVSS 8.1 High
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
- Code injection
- CWE-20
<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6
GHSA-hg6c-8mvr-jqc9 · CVE-2026-42588 - CVSS 5.1 Medium
SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting
- SourceCodester Pharmacy Sales and Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'...
- Code injection
>=3.0.0, <3.2.2 · fixed in 3.2.2
GHSA-c85c-g9wv-pph2 · CVE-2026-42252 - CVSS 5.1 Medium
SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting
- SourceCodester Pharmacy Sales and Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Mettle sendportal Campaign webview cross site scripting
- Mettle sendportal
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting
- raisulislamg4 student_management_system_by_php
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Aider is vulnerable to Code Injection via editor_coder.run function
- Other injection
- Code injection
<=0.86.2 · no fixed version yet
GHSA-7w7m-v5vp-w699 · CVE-2026-10175 - CVSS 5.3 Medium
Orthanc Explorer 2 URL StudyList.vue cross site scripting
- Orthanc Explorer 2
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
westboy CicadasCMS AbstractCacheManager.java search cross site scripting
- westboy CicadasCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting
- sambitraj STUDENT-MANAGEMENT-SYSTEM
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
- Path traversal
- Code injection
<4.6.40 · fixed in 4.6.40
GHSA-78r8-wwqv-r299 · CVE-2026-47398 - CVSS 6.3 Medium
FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable
- labring FastGPT
- Code injection
- CWE-184
- CVSS 9.3 CriticalCritical · CVSS 9+
amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection
- Code injection
<2.1.14 · fixed in 2.1.14
GHSA-29h4-r29x-hchv · CVE-2026-8838 - CVSS 4.5 Medium
Template injection in JetBrains IntelliJ IDEA
- JetBrains IntelliJ IDEA
- Code injection
- CVSS 7.0 High
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- Code injection
- Broken access control
>=0.19.0, <0.31.1 || >=1.0.0, <1.15.2 · fixed in 0.31.1, 1.15.2
GHSA-3g43-6gmg-66jw · CVE-2026-44495 - CVSS 8.3 High
Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
- home-assistant core
- Home Assistant Companion app (iOS)
- Code injection
- CWE-346
- CVSS 7.8 High
Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution
- MarcelRoozekrans roslyn-codelens-mcp
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution
- infiniflow ragflow
- Code injection
- CVSS 8.8 High
Code injection in Google Chrome
- Google Chrome
- Code injection
- CVSS 8.8 High
Code injection in Google Chrome
- Google Chrome
- Code injection
- CVSS 7.8 High
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
- Code injection
<3.12.2 || >=4.0.0, <4.0.3 · fixed in 3.12.2, 4.0.3
GHSA-gg2g-p7xc-qqmm · CVE-2026-46439 - CVSS 9.3 CriticalCritical · CVSS 9+
GitButler: Link injection via forge integration enables arbitrary script execution
- gitbutler
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Code injection in WebPros Comet Backup
- WebPros Comet Backup
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
- Code injection
<5.12.7 · fixed in 5.12.7
GHSA-2g95-6x5q-xjwj · CVE-2026-46621 - CVSS 9.8 CriticalCritical · CVSS 9+
Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override
- Code injection
<5.12.7 · fixed in 5.12.7
GHSA-vmwp-vh32-rj75 · CVE-2026-46562 - CVSS 9.8 CriticalCritical · CVSS 9+
Langroid has Prompt to SQL Injection, Leading to RCE
- SQL injection
- Code injection
<0.63.0 · fixed in 0.63.0
GHSA-mxfr-6hcw-j9rq · CVE-2026-25879 - CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)
- leiweibau Pi.Alert
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)
- leiweibau Pi.Alert
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
LiquidJS is Vulnerable to Remote Code Execution
- Code injection
<10.26.0 · fixed in 10.26.0
GHSA-gf2q-c269-pqgc · CVE-2026-45618 - CVSS 8.7 High
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
- Code injection
>=1.0.0, <2.0.0 || >=2.0.0, <3.0.0 || >=3.0.0, <3.27.0 · fixed in 2.0.0, 3.0.0, 3.27.0
PKSA-yd6k-t2gh-1m43 · CVE-2026-46636 - CVSS 7.2 High
affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
- cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
- Code injection
- CVSS 8.8 High
WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost
- smub WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
- Code injection
- CVSS 7.3 High
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob
- PMQS IO::Compress
- Code injection
- CVSS 4.8 Medium
QianFox FoxCMS Administrator Backend edit cross site scripting
- QianFox FoxCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
- Code injection
<5.12.7 · fixed in 5.12.7
GHSA-524g-x36v-9wm6 · CVE-2026-44632 - CVSS 7.3 High
An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/class/commonobject.class.php.
- Code injection
- CVSS 7.3 High
An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, call_user_func_array() in fun…
- Code injection
- CVSS 7.3 High
An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php
- Code injection
- CVSS 8.7 High
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
- Code injection
<4.9.1 || >=5.0.0, <5.4.1 · fixed in 4.9.1, 5.4.1
GHSA-86rh-h242-j8xp · CVE-2026-44174 - CVSS 8.9 High
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
- Code injection
- Broken access control
>=1.2.11, <1.3.1 · fixed in 1.3.1
GHSA-p69w-mmfv-xrfj · CVE-2026-43945 - CVSS 2.3 Low
ThingsBoard YAML provision getGatewayDockerComposeFile code injection
- ThingsBoard
- Other injection
- Code injection