Code injection.

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

• Code injection

>=0.51.0, <0.60.2 · fixed in 0.60.2

Artica Proxy 4.50 Session Fixation via fw.login.php

• ArticaTech Artica Proxy
• Code injection

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

• owen2345 camaleon-cms
• Code injection

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

• Code injection
• Memory corruption

<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0 · fixed in 2.3.6, 3.4.1, 4.9.0

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

• Code injection

>=0.14.1, <3.4.1 · fixed in 3.4.1

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3

• balbooa.com Balbooa Forms component for Joomla
• Code injection

Code Injection in JSON Pointer Processing Component in Cribl Stream

• Cribl Stream
• Code injection

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

• vBulletin
• Code injection

WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution

• FacturaONE para WooCommerce con VeriFactu
• Code injection

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

• koxudaxi datamodel-code-generator
• Code injection

Oh My Posh: Arbitrary command execution via template injection in the path segment

• Code injection

<29.35.1 · fixed in 29.35.1

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute ...

• Code injection

<3.9.3 · fixed in 3.9.3

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

• Code injection

<16.1.2 · fixed in 16.1.2

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

• Code injection
• Information disclosure

<0.10.0 · fixed in 0.10.0

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

• Code injection

<0.1.5 || >=2.0.0-alpha.1, <2.0.0-beta.5 · fixed in 0.1.5, 2.0.0-beta.5

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

• Code injection

<2.1.7 · fixed in 2.1.7

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

• Path traversal
• Code injection

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

• Code injection
• CWE-829

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

• Code injection
• Insecure deserialization

<2.56.0 · fixed in 2.56.0

Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator

• Code injection

<1.29.1 || >=1.30.0, <1.32.4 · fixed in 1.29.1, 1.32.4

Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

• Code injection

<1.29.1 || >=1.30.0, <1.32.0 · fixed in 1.29.1, 1.32.0

Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

• Code injection

<1.29.1 || >=1.30.0, <1.32.0 · fixed in 1.29.1, 1.32.0

Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates

• microweber
• Code injection

Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

• Code injection

<1.29.1 || >=1.30.0, <1.32.3 · fixed in 1.29.1, 1.32.3

Code injection in Devolutions PowerShell Universal

• Devolutions PowerShell Universal
• Code injection

Code injection in Devolutions PowerShell Universal

• Devolutions PowerShell Universal
• Code injection

Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

• Apache Software Foundation Apache OpenNLP
• Code injection

Cal.com before 5.9.9 Remote Code Execution via RSC

• calcom cal.diy
• Code injection

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

• Code injection

>=6.4.0, <7.18.0 · fixed in 7.18.0

gpsd gpsprof Code Injection via SKY.satellites used Field

• gpsd
• Code injection

Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution

• Quenary tugtainer
• Code injection

Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

• Code injection

>=1.7.0 · no fixed version yet

Code injection in JetBrains TeamCity

• JetBrains TeamCity
• Code injection

Code injection in JetBrains TeamCity

• JetBrains TeamCity
• Code injection

Code injection in JetBrains IntelliJ IDEA

• JetBrains IntelliJ IDEA
• Code injection

Code injection in JetBrains GoLand

• JetBrains GoLand
• Code injection

Code injection in JetBrains GoLand

• JetBrains GoLand
• Code injection

WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability

• WPLake Advanced Views
• Code injection

Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

• emarket-design Customer Support Ticket System & Helpdesk
• Code injection

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism

• Code injection

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

• Code injection

<1.82.0 · fixed in 1.82.0

n8n: Expression sandbox escape via arrow-function bodies enabling command execution

• Code injection

<2.31.5 || >=2.32.0, <2.32.1 · fixed in 2.31.5, 2.32.1

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

• Code injection

<1.123.64 || >=2.0.0-rc.0, <2.29.8 || >=2.30.0, <2.30.1 · fixed in 1.123.64, 2.29.8, 2.30.1

Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris

• Fujitsu Linux openFT
• Fujitsu Oracle Solaris openFT
• Code injection

DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• Code injection

RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• Code injection

Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

• Code injection

* · no fixed version yet

Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution

• sevenspark DTX – Dynamic Text Extension for Contact Form 7
• Code injection

SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting

• SourceCodester Class and Exam Timetabling System
• Cross-site scripting (XSS)
• Code injection

SourceCodester Class and Exam Timetabling System class.php cross site scripting

• SourceCodester Class and Exam Timetabling System
• Cross-site scripting (XSS)
• Code injection

TypeORM: migration:generate template-literal code injection

• Code injection

<0.3.31 || >=1.0.0, <1.1.0 · fixed in 0.3.31, 1.1.0

Unauthenticated RCE

• Autel MaxiCharger Single
• Code injection

MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

• meltano hub
• Command injection
• Code injection

Code injection in Atlassian Sourcetree for Mac

• Atlassian Sourcetree for Mac
• Code injection

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

• Code injection

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

• gitleaks
• Code injection

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1

• themexpert.com Quix Page Builder Pro extension for Joomla
• Code injection

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR

• NLNETLABS Net::DNS
• Code injection

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file

• Code injection

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _fetch_html and _download_binar…

• Code injection