Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability
- Realtyna Organic IDX plugin
- Code injection
- CVSS 9.6 CriticalCritical · CVSS 9+
A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
- Centreon Infra Monitoring
- Code injection
- CVSS 5.3 Medium
primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution
- primefaces primereact
- Code injection
- Prototype pollution
- CVSS 5.1 Medium
DedeCMS Column Management search.php code injection
- DedeCMS
- Other injection
- Code injection
- CVSS 4.8 Medium
SourceCodester Online Book Store System User Management cross site scripting
- SourceCodester Online Book Store System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection
- Pig
- Other injection
- Code injection
- CVSS 5.1 Medium
vnotex vnote YAML Frontmatter markdownit.js cross site scripting
- vnote
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection
- SonicCloudOrg sonic-agent
- Other injection
- Code injection
- CVSS 5.1 Medium
Akpali9 Attendance-Management-System absent.php cross site scripting
- Akpali9 Attendance-Management-System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
igweze wizgrade studentConductManager.php cross site scripting
- igweze wizgrade
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 Critical
Duplicate Advisory: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
- Code injection
<=1.6.77 · no fixed version yet
GHSA-mhgx-w3w5-2rvc - CVSS 8.8 High
WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
- smackcoders WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
- Apache Software Foundation Apache IoTDB
- Code injection
- CVSS 4.8 Medium
MyEMS Admin Backend svg.py on_post cross site scripting
- MyEMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting
- NousResearch hermes-agent
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.4 High
Vim: Arbitrary Code Execution via PHP Omni-Completion
- vim
- Code injection
- CVSS 8.4 High
Vim: Arbitrary Code Execution via C Omni-Completion
- vim
- Code injection
- CVSS 8.6 High
SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)
- siyuan
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
- Code injection
- Denial of service
<4.6.6 · fixed in 4.6.6
GHSA-px5m-h76g-p7p8 · CVE-2026-52778 - CVSS 7.1 High
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
- Code injection
<4.6.6 · fixed in 4.6.6
GHSA-65p8-9433-jpcp · CVE-2026-52762 - CVSS 9.1 CriticalCritical · CVSS 9+
Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
- metabase
- Code injection
- CVSS 5.3 Medium
YzmCMS Header yzmphp.php get_url cross site scripting
- YzmCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution
- apidevtools json-schema-ref-parser
- Code injection
- Prototype pollution
- CVSS 5.3 Medium
enquirer Public Package API Enquirer.set prototype pollution
- enquirer
- Code injection
- Prototype pollution
- CVSS 8.6 High
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
- Code injection
>=5.5.0, <5.9.14 · fixed in 5.9.14
GHSA-86vw-x4ww-x467 · CVE-2026-56382 - CVSS 6.5 Medium
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOpera...
- Code injection
- Broken access control
<7.260401.0 · fixed in 7.260401.0
GHSA-qpp6-p693-rmm4 · CVE-2026-35211 - CVSS 8.0 High
DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN
- Code injection
>=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10.0-rc1, <10.0 · fixed in 8.4, 9.3, 10.0
GHSA-9x82-rm84-c6x7 · CVE-2026-49832 - CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk
- Code injection
- CVSS 8.8 High
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile
- Code injection
- CVSS 8.4 High
Koodo Reader: Remote code execution via malicious epub file
- koodo-reader
- Code injection
- CVSS 8.5 High
calibre: Arbitrary Code Execution in Template Formatter via Book Metadata
- kovidgoyal calibre
- Code injection
- CVSS 8.7 High
DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
- dataease
- Code injection
- CVSS 8.6 High
EGroupware has Authenticated RCE via Malicious eTemplate Upload
- Command injection
- Code injection
<23.1.20260601 || >=26.0.20251208, <26.4.20260413 · fixed in 23.1.20260601, 26.4.20260413
GHSA-8737-2x9g-xjj7 · CVE-2026-40187 - CVSS 8.7 High
EGroupware has a Remote Code Execution Vulnerability
- Path traversal
- Code injection
<23.1.20260224 || >=26.0.20251208, <26.2.20260224 · fixed in 23.1.20260224, 26.2.20260224
GHSA-h9qx-v5xp-ph8p · CVE-2026-27823 - CVSS 8.9 High
FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
- FOSSBilling
- Code injection
- CVSS 8.7 High
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
- Code injection
>=5.9.0, <5.10.0 · fixed in 5.10.0
GHSA-f74w-488g-8x5r · CVE-2026-55794 - CVSS 10.0 CriticalCritical · CVSS 9+
Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
- Code injection
<0.65.2 · fixed in 0.65.2
GHSA-q9p7-wqxg-mrhc · CVE-2026-54769 - CVSS 9.8 CriticalCritical · CVSS 9+
Formie Hidden field defaults vulnerable to Server-Side Template Injection
- Code injection
<3.1.27 · fixed in 3.1.27
GHSA-565m-g33j-jq96 · CVE-2026-52889 - CVSS 9.9 CriticalCritical · CVSS 9+
Code injection in WebPros Plesk
- WebPros Plesk
- Code injection
- CVSS 5.1 Medium
crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting
- crater
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting
- mjperpinosa stumasy
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
mjperpinosa stumasy calculate.php eval code injection
- mjperpinosa stumasy
- Other injection
- Code injection
- CVSS 5.3 Medium
stephen-kruger bluebox cross site scripting
- stephen-kruger bluebox
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection
- SourceCodester Multi-Vendor Online Grocery Management System
- Other injection
- Code injection
- CVSS 5.3 Medium
code-projects Assessment Management remove-user.php cross site scripting
- code-projects Assessment Management
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Assessment Management view-users.php cross site scripting
- code-projects Assessment Management
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting
- kirilkirkov Ecommerce-CodeIgniter-Bootstrap
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting
- kirilkirkov Ecommerce-CodeIgniter-Bootstrap
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vul...
- Code injection
<3.9.4 · fixed in 3.9.4
GHSA-9r6g-266r-89x4 · CVE-2026-12252 - CVSS 5.4 Medium
CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
- villatheme CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
- Code injection
>=1.3.0 || >=5.0.0, <5.2.11 || >=6.0.0, <6.0.9 || >=7.0.0, <7.1.2 · fixed in 5.2.11, 6.0.9, 7.1.2
GHSA-9fx4-7cmj-47vg · CVE-2026-9558 - CVSS 7.7 High
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
- Command injection
- Code injection
<2026.5.18 · fixed in 2026.5.18
GHSA-v6r2-jh58-xx6w · CVE-2026-53810 - CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability
- Creative Themes Blocksy Companion Pro
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability
- Rustaurius Five Star Business Profile and Schema
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Path Traversal in Altium Git Service Allows Remote Code Execution
- Altium Enterprise Server
- Altium 365
- Path traversal
- Code injection
- CVSS 8.8 High
Buffer overflow in Google Chrome
- Google Chrome
- Code injection
- Memory corruption
- CVSS 8.8 High
Buffer overflow in Google Chrome
- Google Chrome
- Code injection
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Rancher vulnerable to command injection through unsanitized YAML parameter
- Code injection
<0.0.0-20260617231817-2aa77eb283e7 || >=2.10.0, <2.10.12 || >=2.11.0, <2.11.14 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.6 || >=2.14.0, <2.14.2 · fixed in 0.0.0-20260617231817-2aa77eb283e7, 2.10.12, 2.11.14, 2.12.10, 2.13.6, 2.14.2
GHSA-mhc6-2gfq-xx62 · CVE-2026-44939 - CVSS 8.7 High
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- Broken access control
- Code injection
<3.27.0 · fixed in 3.27.0
GHSA-529h-vh3j-85hq · CVE-2026-46636 - CVSS 7.1 High
GeoNetwork has reflected XSS through client-side template injection
- Cross-site scripting (XSS)
- Code injection
>=3.0.0, <=3.12.12 || >=4.0.0-alpha.1, <=4.0.6 || >=4.2.0, <4.2.15 || >=4.4.0, <4.4.10 · fixed in 4.2.15, 4.4.10
GHSA-2v4m-fw6c-g78f · CVE-2026-39379