Code injection.

WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability

• MarketingFire Widget Options
• Code injection

Improper Control of Generation of Code ('Code Injection') in GitLab

• GitLab
• Code injection

SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)

• siyuan
• Cross-site scripting (XSS)
• Code injection

Jenkins Script Security Plugin has a script security bypass vulnerability

• Other injection
• Code injection

<1402.1405.vc96e74964250 · fixed in 1402.1405.vc96e74964250

Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

• Code injection

<4331.4333 · fixed in 4331.4333

AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute

• adegans AdRotate Banner Manager
• Code injection

Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository

• Command injection
• Code injection

<2026.6.4 · fixed in 2026.6.4

Code injection in Revive Adserver

• Revive Adserver
• Code injection

Code injection in Revive Adserver

• Revive Adserver
• Code injection

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

• FOSSBilling
• Code injection

expr-eval vulnerable to Code Execution

• Code injection

<=2.0.2 · no fixed version yet

Gogs has DoS in rendering issue index pattern

• Code injection

<0.14.3 · fixed in 0.14.3

Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

• Code injection
• Insecure deserialization

<2025.3.3 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3 · fixed in 2025.3.3, 2025.4.4, 2026.0.3

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

• Code injection

>=1.13, <1.14.5 · fixed in 1.14.5

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

• Code injection

<2026.3.10 · fixed in 2026.3.10

MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop

• Autodesk Fusion
• Code injection

Duplicate Advisory: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

• Code injection

<1.10.1 · fixed in 1.10.1

Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension

• angular
• Angular.ng-template
• Cross-site scripting (XSS)
• Code injection

Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension

• angular
• Cross-site scripting (XSS)
• Code injection

WebSphere Application Server Remote Code Execution

• IBM WebSphere Application Server
• Code injection

WebSphere Application Server Remote Code Execution

• IBM WebSphere Application Server
• Code injection

Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP

• misp
• Code injection

langflow-ai langflow Bundle URL Loader code injection

• langflow
• Other injection
• Code injection

kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting

• kortix-ai suna
• Cross-site scripting (XSS)
• Code injection

Duplicate Advisory: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

• Code injection

>=5.5.0, <=5.9.13 · no fixed version yet

Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)

• Code injection

>=3.1.11, <3.6.25 · fixed in 3.6.25

Duplicate Advisory: Flowise OverrideConfig security vulnerability

• Code injection

<2.1.4 · fixed in 2.1.4

WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php

• WooCommerce
• Code injection

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

• Code injection

<2.4.3 · fixed in 2.4.3

OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

• Code injection
• CWE-116

<0.10.11 · fixed in 0.10.11

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

• Code injection
• CWE-15

<0.42.1 · fixed in 0.42.1

CedarJava has policy injection vulnerability

• Code injection

<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0 · fixed in 2.3.6, 3.4.1, 4.9.0

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

• JTL Software JTL Shop
• Code injection

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

• Command injection
• Code injection

<0.9.0 · fixed in 0.9.0

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

• Command injection
• Code injection

>=4.5.87, <4.6.61 · fixed in 4.6.61

PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

• Code injection

<1.7.2 · fixed in 1.7.2

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

• Code injection
• Authentication bypass

<4.6.59 · fixed in 4.6.59

Karate Mock Server RCE via embedded expression evaluation of request-derived data

• Code injection

>=2.0.1, <2.1.0 · fixed in 2.1.0

piscina: Prototype Pollution Gadget → RCE via inherited options.filename

• Code injection
• Prototype pollution

<4.9.3 || >=5.0.0-alpha.0, <5.2.0 || >=6.0.0-rc.1, <6.0.0-rc.2 · fixed in 4.9.3, 5.2.0, 6.0.0-rc.2

Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

• Code injection

<=11.5.14.1 || >=12.0.0-RC1, <=12.3.8 · no fixed version yet

Duplicate Advisory: Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER

• Code injection

* · no fixed version yet

WordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerability

• Monetizemore Advanced Ads
• Code injection

WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability

• Creative Themes Blocksy Companion Pro
• Code injection

JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions.

• Code injection

WordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin < 2.0.52 - Remote Code Execution (RCE) vulnerability

• ACPT (Pro) - Custom Post Types Plugin for WordPress
• Code injection

WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability

• THEMECO Cornerstone
• Code injection

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

• Path traversal
• Cross-site scripting (XSS)

<0.8.7 · fixed in 0.8.7

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

• Code injection
• CWE-913

<0.8.7 · fixed in 0.8.7

Code injection in Oracle Corporation PeopleSoft Enterprise CS Campus Community

• Oracle Corporation PeopleSoft Enterprise CS Campus Community
• Code injection

Code injection in Oracle Corporation MySQL Shell

• Oracle Corporation MySQL Shell
• Code injection

Langflow: Unauthenticated RCE in Shareable Playgrounds

• Code injection

<1.9.2 · fixed in 1.9.2

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

• Code injection
• Denial of service

<0.22.0 · fixed in 0.22.0

Code injection in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Code injection

WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability

• Filipe Nasc RD Station
• Code injection

YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

• Code injection

<=1.0.6 · no fixed version yet

Remotion: remote code execution (RCE) vulnerability

• Code injection

<4.0.410 · fixed in 4.0.410

WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability

• MantraBrain Easy Invoice
• Code injection

WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability

• Responsive Slider by MetaSlider
• Code injection

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

• Code injection

<1.1.0 · fixed in 1.1.0

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

• Code injection

<1.3.2 || >=2.0.0, <2.5.0 · fixed in 1.3.2, 2.5.0