Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
itsourcecode Online Medicine Delivery System index.php cross site scripting
- itsourcecode Online Medicine Delivery System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-88f2-fpv8-89q2 · CVE-2026-62682 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via schema default -> zod module-level template literal
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-w727-8j6c-2rj4 · CVE-2026-72717 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via array-items default -> zod module-level template literal
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-2h9g-j24r-h63g · CVE-2026-71869 - CVSS 4.3 Medium
Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
- Elastic Kibana
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-8j6p-r8jg-mxqh · CVE-2026-71871 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- SQL injection
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-2w86-xfrc-g85r · CVE-2026-71867 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-3575-w9fc-c2j6 · CVE-2026-71868 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-653q-5476-x79g · CVE-2026-71865 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-6437-gxhq-pqv8 · CVE-2026-71864 - CVSS 9.1 CriticalCritical · CVSS 9+
GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
- core-geonetwork
- Code injection
- CVSS 5.3 Medium
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
- SUSE Fleet
- Server-side request forgery (SSRF)
- Code injection
- CVSS 6.9 Medium
SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
- SeaCMS
- Other injection
- Code injection
- CVSS 8.7 High
n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
- n8n
- Code injection
- CVSS 7.2 High
n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
- n8n
- Code injection
- CVSS 5.1 Medium
langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
langgenius dify Splash Layout splash.tsx router.replace cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
- Code injection
<0.3.0 · fixed in 0.3.0
GHSA-jrrm-9hc7-2v3h · CVE-2026-62674 - CVSS 8.8 High
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
- Code injection
<0.3.0 · fixed in 0.3.0
GHSA-756x-9hf6-q4h4 · CVE-2026-62675 - CVSS 7.1 High
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
- Code injection
- Information disclosure
<2.0.2 · fixed in 2.0.2
GHSA-mc5q-6hpj-rp7j · CVE-2026-61450 - CVSS 9.1 CriticalCritical · CVSS 9+
Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- Code injection
- CVSS 8.8 High
Code injection in Jenkins
- Jenkins
- Code injection
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-p4cg-3328-rvfg · CVE-2026-72716 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
- SQL injection
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-6mr6-jvcr-2f25 · CVE-2026-71866 - CVSS 8.7 High
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
- Code injection
<2.0.7 · fixed in 2.0.7
GHSA-fj2p-qj2f-74v5 · CVE-2026-64850 - CVSS 7.5 High
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
- Path traversal
- Code injection
<10.34.5 || >=11.0.0, <11.11.0 · fixed in 10.34.5, 11.11.0
GHSA-vq4v-j7r6-jq4m · CVE-2026-82393 - CVSS 7.8 High
Faker: helpers.fake exploitable into arbritary code execution
- Code injection
<10.5.0 · fixed in 10.5.0
GHSA-qxc2-j82w-r537 · CVE-2026-73231 - CVSS 9.9 CriticalCritical · CVSS 9+
WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
- WatchMan-Site7
- Code injection
- CVSS 7.6 High
Template injection in Eclipse Foundation Eclipse Ditto
- Eclipse Foundation Eclipse Ditto
- Other injection
- Code injection
- CVSS 5.1 Medium
OpenCart Autocomplete Workflow edit.php cross site scripting
- OpenCart
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
OpenCart Autocomplete Workflow address.php cross site scripting
- OpenCart
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Unauthenticated Remote Code Execution in HPE Networking Fabric Composer
- Hewlett Packard Enterprise (HPE) Fabric Composer
- Code injection
- CVSS 8.8 High
Code injection in Dell PowerStore 500T and others
- Dell PowerStore 500T
- Dell PowerStore 1000T
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO
- Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects)
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Code injection in the Lutece Core
- Lutece Core
- Code injection
- CVSS 8.7 High
Eval injection in WebPros cPanel
- WebPros cPanel
- Code injection
- CVSS 8.8 High
An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted…
- Code injection
- CVSS 5.3 Medium
Typora Mermaid Rendering cross site scripting
- Typora
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting
- code-projects Online Shopping System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
- quarkus-qute
- Red Hat Build of Apache Camel 3.33.3.SP1
- Code injection
- CVSS 5.1 Medium
yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection
- yaojingang GEOFlow
- Other injection
- Code injection
- CVSS 5.3 Medium
yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting
- yaojingang GEOFlow
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Inventory System User Registration register.php cross site scripting
- code-projects Simple Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting
- code-projects Employee Leave Managing System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SeaCMS err.php cross site scripting
- SeaCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.9 High
EEx template evaluation of prompt content in AshAi enables remote code execution
- Code injection
>=0.1.0, <1.0.0 · fixed in 1.0.0
GHSA-2g59-hg7m-qc83 · CVE-2026-77956 - CVSS 6.9 Medium
SeaCMS Template search.php parseIf code injection
- SeaCMS
- Other injection
- Code injection
- CVSS 5.3 Medium
SourceCodester Queue Management System add_customer.php cross site scripting
- SourceCodester Queue Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Beetel 450TC3 User Management cross site scripting
- Beetel 450TC3
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting
- coppermine-gallery Coppermine Photo Gallery
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting
- coppermine-gallery Coppermine Photo Gallery
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock
- skyvern
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
- IBM Langflow OSS
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
- IBM Langflow OSS
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
- SQL injection
- Code injection
<12.3.10 || >=2026.1.0, <2026.1.6 · fixed in 12.3.10, 2026.1.6
GHSA-9x44-4gxf-8c25 · CVE-2026-55634 - CVSS 9.9 CriticalCritical · CVSS 9+
Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)
- Code injection
>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8
GHSA-c64q-hj4j-375f · CVE-2026-55565 - CVSS 9.8 CriticalCritical · CVSS 9+
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
- Code injection
>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8
GHSA-73mf-m39p-wpm9 · CVE-2026-55559 - CVSS 9.1 CriticalCritical · CVSS 9+
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
- Code injection
>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8
GHSA-3g44-3m7x-cgg2 · CVE-2026-55511 - CVSS 7.1 High
Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
- flextype
- Code injection