Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.7 High
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
- WebPros Plesk extension "Ruby"
- WebPros Plesk extension "Node.js Toolkit"
- Code injection
- CVSS 8.8 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Code injection
- CVSS 5.3 Medium
itsourcecode Loan Management System navbar.php cross site scripting
- itsourcecode Loan Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
Apache Syncope: Groovy Sandbox escape for empty CommandArgs
- Apache Software Foundation Apache Syncope
- Code injection
- CVSS 5.1 Medium
Yot CMS Admin Console admin.php eval code injection
- Yot CMS
- Other injection
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory Management System Product Management products_handler.php cross site scripting
- SourceCodester Inventory Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting
- SourceCodester Inventory Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting
- SourceCodester Inventory Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
Eval injection in Contec CONPROSYS HMI System(CHS)
- Contec CONPROSYS HMI System(CHS)
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0
- regularlabs.com Conditional Content Pro extension for Joomla
- Code injection
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System subject1.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Totolink A3002MU Anchor Tag cross site scripting
- Totolink A3002MU
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting
- Anil-matcha Open-Generative-AI
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
kagisearch smallweb Query String Rendering sw.py index cross site scripting
- kagisearch smallweb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection
- cym1102 nginxWebUI
- Other injection
- Code injection
- CVSS 5.3 Medium
Exrick xmall Order Printing order-print.jsp cross site scripting
- Exrick xmall
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting
- linlinjava litemall
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting
- linlinjava litemall
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting
- moxi624 Mogu Blog v2
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting
- quequnlong shiyi-blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting
- quequnlong shiyi-blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting
- maliangnansheng bbs-springboot
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting
- DataEase
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
TDuckApp tduck-platform Form Write View index.vue cross site scripting
- TDuckApp tduck-platform
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
quequnlong shiyi-blog Add Message API index.vue cross site scripting
- quequnlong shiyi-blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
stilleshan ServerStatus Stats Generation main.cpp cross site scripting
- stilleshan ServerStatus
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting
- Fengoffice Feng Office
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
sanjevirau gsubs Electron index.js showQuerySuccessPage code injection
- sanjevirau gsubs
- Other injection
- Code injection
- CVSS 5.1 Medium
Xuxueli xxl-job insert cross site scripting
- Xuxueli xxl-job
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection
- Xuxueli xxl-job
- Other injection
- Code injection
- CVSS 8.5 High
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attacke...
- Code injection
Published by the maintainers · not yet reviewed by GitHub
<0.28.0 · fixed in 0.28.0
GHSA-3c86-2m5g-59q7 · CVE-2026-90553 - CVSS 9.8 CriticalCritical · CVSS 9+
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
- stellarwp The Events Calendar
- Code injection
- CVSS 5.9 Medium
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values
- Concrete CMS
- Code injection
- CVSS 4.3 Medium
CSTI in Arma Digital's Website Template
- Arma Digital Media Inc. Website Template
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
CVE-2026-86793
- SGLang
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
- teddy-bear-customize-addon
- Code injection
- CVSS 8.8 High
Certain Woltlab products are affected by RCE via Cache Poisoning.
- Code injection
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 9.5 CriticalCritical · CVSS 9+
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
- Code injection
- Authentication bypass
<=3.8.50 · no fixed version yet
GHSA-hf57-cqmx-p4gr · CVE-2026-88062 - CVSS 6.7 Medium
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Template injection in Forgejo
- Forgejo
- Code injection
- CVSS 7.7 High
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
- Code injection
<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2 · fixed in 1.123.76, 2.37.7, 2.38.2
GHSA-6xcw-7xm6-48c6 · CVE-2026-86083 - CVSS 8.7 High
Low-privilege RCE through element-search eager loading
- cms
- Code injection
- CVSS 8.7 High
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
- Code injection
<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2 · fixed in 1.123.76, 2.37.7, 2.38.2
GHSA-hw8v-xxg5-vvvx · CVE-2026-86076 - CVSS 7.5 High
WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability
- Ateeq Rafeeq RepairBuddy
- Code injection
- CVSS 6.5 Medium
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
- Elliot Sowers/ RelyWP Simple Cloudflare Turnstile
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
- Apache Software Foundation Apache Camel K
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
- Apache Software Foundation Apache Camel K
- Code injection
- CVSS 7.7 High
Velociraptor VQL injection during notebook restore from backup
- Rapid7 Velociraptor
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint
- Code injection
- CVSS 6.8 Medium
An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex (common_patterns.dart) compon…
- Code injection
- CVSS 5.3 Medium
Rizwan17 inventory-management-system Login Page index.php cross site scripting
- Rizwan17 inventory-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Rizwan17 inventory-management-system List DBOperation.php cross site scripting
- Rizwan17 inventory-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution
- Code injection
<=3.1.59 · no fixed version yet
GHSA-2pxq-5vcg-rq29 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
- Apache Software Foundation Apache Nutch
- Code injection
- Broken access control
- CVSS 8.8 High
Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
- Apache Software Foundation Apache Nutch
- Code injection
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Remote Code Execution in Akana API Platform
- Perforce Akana
- Code injection
- Broken access control