Code injection.

Data deletion and attribute disclosure via field-name method injection in in-memory queries

• MongoDB Inc. Mongoid
• Code injection

Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

• MongoDB Inc. Mongoid
• Code injection

IBM MQ queue manager is vulnerable to remote code execution

• IBM MQ
• Code injection

Code injection in Interchange

• Interchange
• Code injection

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

• Code injection

<14.10.2 · fixed in 14.10.2

SveltyCMS SVG Media Upload media-service.server.ts cross site scripting

• SveltyCMS
• Cross-site scripting (XSS)
• Code injection

vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

• patriksimek vm2
• Code injection

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

• Code injection
• Denial of service

<2.11.4 · fixed in 2.11.4

AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

• AF Companion
• Code injection

Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

• givanz Vvveb
• Path traversal
• Code injection

CVE-2026-15815 CVE Record

• Grafana OSS
• Grafana Enterprise
• Path traversal
• Code injection

Grav CMS vulnerable to remote code execution via .zip file upload

• Code injection

<2.0.13 · fixed in 2.0.13

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

• Code injection

<2.0.15 · fixed in 2.0.15

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

• Path traversal
• Code injection

<2.0.1 · fixed in 2.0.1

Wavelog: Unauthenticated Remote Code Execution

• wavelog
• Code injection
• Broken access control

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

• Code injection
• Information disclosure

>=2.0.7, <2.0.11 · fixed in 2.0.11

Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

• Code injection

>=1.7.0, <2.0.9 · fixed in 2.0.9

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

• Information disclosure
• Code injection

<8.4 · fixed in 8.4

Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

• Code injection

=3.11.6 · no fixed version yet

WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability

• superweby Migratico Lite
• Code injection

Unsafe reflection in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others

• Dell OpenManage Server Administrator Managed Node (Patch) for Windows
• Dell OpenManage Server Administrator Managed Node for RHEL 8.10
• Code injection

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Code injection

wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

• wpShopGermany IT-RECHT KANZLEI
• Code injection

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

• Cross-site scripting (XSS)
• Code injection

>=2.0.0, <2.0.1 · fixed in 2.0.1

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

• Code injection

<1.0.7 · fixed in 1.0.7

Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution

• cms
• Code injection

Craft CMS before 4.18.6 Remote Code Execution via signed cookie

• cms
• Code injection

@refinedev/inferencer through 7.0.0 Code Injection via API Field Names

• @refinedev/inferencer
• Code injection

HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write

• HP Inc HP AC Print & Scan
• HP Inc HP Output Central
• Code injection

HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write

• HP Inc HP AC Print & Scan
• HP Inc HP Output Central
• Code injection

Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

• redocly-cli
• Code injection

Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised swi…

• Arista Networks EOS
• Code injection

ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting

• ChangeWeDer crm
• Cross-site scripting (XSS)
• Code injection

Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

• Functional Software, Inc. Sentry Seer
• Other injection
• Code injection

SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting

• SourceCodester Online Food Ordering System
• Cross-site scripting (XSS)
• Code injection

Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass

• Scada-LTS
• Code injection

PbootCMS Template Rendering ContentController.php decode_string cross site scripting

• PbootCMS
• Cross-site scripting (XSS)
• Code injection

Backstage: Improper input validation in TechDocs MkDocs configuration

• backstage
• Code injection
• CWE-20

Code injection in Jenkins Project Jenkins Script Security Plugin

• Jenkins Project Jenkins Script Security Plugin
• Code injection

Code injection in Jenkins Project Jenkins Script Security Plugin

• Jenkins Project Jenkins Script Security Plugin
• Code injection

Code injection in Jenkins Project Jenkins Script Security Plugin

• Jenkins Project Jenkins Script Security Plugin
• Code injection

Code injection in Advantech EKI-1242IEIMS and others

• Advantech EKI-1242IEIMS
• Advantech EKI-1242EIMS
• Code injection

Code injection in Advantech EKI-1242IEIMS and others

• Advantech EKI-1242IEIMS
• Advantech EKI-1242EIMS
• Code injection

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlis...

• Code injection

>=1.15.0, <2.0.0 · fixed in 2.0.0

Security Advisory 0174

• Arista Networks EOS
• Code injection

Security Advisory 0166

• Arista Networks EOS
• Code injection

WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

• WP Import Export Lite
• Code injection

WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

• WP Import Export Lite
• Code injection

a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting

• a2ui
• Cross-site scripting (XSS)
• Code injection

An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component

• Code injection

Code injection in Oracle Corporation Oracle GraalVM for JDK, Oracle GraalVM

• Oracle Corporation Oracle GraalVM for JDK, Oracle GraalVM
• Code injection

Code injection in Google Chrome

• Google Chrome
• Code injection

code-projects Record Management System reg.php cross site scripting

• code-projects Record Management System
• Cross-site scripting (XSS)
• Code injection

Koha Eval Code Injection Remote Code Execution Vulnerability

• Koha
• Code injection

Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine

• polyaxon
• Code injection

PHPGurukul Hostel Management System manage-students.php cross site scripting

• PHPGurukul Hostel Management System
• Cross-site scripting (XSS)
• Code injection

Governikus AusweisApp StartPAOSResponse cross site scripting

• Governikus AusweisApp
• Cross-site scripting (XSS)
• Code injection

PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting

• PHPGurukul Daily Expense Tracker System
• Cross-site scripting (XSS)
• Code injection

michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting

• michaelliao itranswarp
• Cross-site scripting (XSS)
• Code injection

Activiti through 7.1.0.M6 Expression Injection via Mail Task

• Activiti
• Code injection