Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.4 CriticalCritical · CVSS 9+
n8n has Potential Remote Code Execution via Merge Node
- SQL injection
- Code injection
<1.123.22 || >=2.0.0, <2.9.3 || >=2.10.0, <2.10.1 · fixed in 1.123.22, 2.9.3, 2.10.1
GHSA-wxx7-mcgf-j869 · CVE-2026-27497 - CVSS 9.4 CriticalCritical · CVSS 9+
n8n has a Sandbox Escape in its JavaScript Task Runner
- Code injection
<1.123.22 || >=2.0.0, <2.9.3 || >=2.10.0, <2.10.1 · fixed in 1.123.22, 2.9.3, 2.10.1
GHSA-jjpj-p2wh-qf23 · CVE-2026-27495 - CVSS 9.5 CriticalCritical · CVSS 9+
n8n has Unauthenticated Expression Evaluation via Form Node
- Code injection
<1.123.22 || >=2.0.0, <2.9.3 || >=2.10.0, <2.10.1 · fixed in 1.123.22, 2.9.3, 2.10.1
GHSA-75g8-rv7v-32f7 · CVE-2026-27493 - CVSS 9.8 CriticalCritical · CVSS 9+
Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
- Path traversal
- Code injection
<1.5.0 · fixed in 1.5.0
GHSA-65mp-fq8v-56jr · CVE-2026-27641 - CVSS 9.9 CriticalCritical · CVSS 9+
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- Code injection
- CWE-20
<3.30.4 · fixed in 3.30.4
GHSA-rvhr-26g4-p2r8 · CVE-2026-27702 - CVSS 8.9 High
c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property
- Code injection
- Insecure deserialization
<0.12.0 · fixed in 0.12.0
GHSA-5476-xc4j-rqcv · CVE-2026-27830 - CVSS 10.0 CriticalCritical · CVSS 9+
@enclave-vm/core is vulnerable to Sandbox Escape
- Code injection
<2.11.1 · fixed in 2.11.1
GHSA-f229-3862-4942 · CVE-2026-27597 - CVSS 8.8 High
LiveCodes vulnerable to JavaScript Injection via untrusted PR title in i18n-update-pull workflow
- live-codes livecodes
- Code injection
- CVSS 5.1 Medium
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scripting
- SourceCodester Patients Waiting Area Queue Management System
- Patrick Mvuma Patients Waiting Area Queue Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Advanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter
- mihail-barinov Advanced Woo Labels – Product Labels & Badges for WooCommerce
- Code injection
- CVSS 4.8 Medium
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting
- SourceCodester Patients Waiting Area Queue Management System
- Patrick Mvuma Patients Waiting Area Queue Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SPIP tickets < 4.3.3 Unauthenticated RCE
- SPIP tickets
- Code injection
- CVSS 8.7 High
SPIP interface_traduction_objets < 2.2.2 Authenticated RCE
- SPIP interface_traduction_objets
- Code injection
- CVSS 5.9 Medium
InvenTree Vulnerable to Server Side Template Injection (SSTI)
- InvenTree
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
- Code injection
<10.0.0 · fixed in 10.0.0
GHSA-v264-xqh4-9xmm · CVE-2026-27574 - CVSS 5.7 Medium
ImageMagick: Code Injection via PostScript header in ps coders
- Code injection
<14.10.3 · fixed in 14.10.3
GHSA-rw6c-xp26-225v · CVE-2026-25797 - CVSS 8.4 High
Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table
- Code injection
<2.11.1 · fixed in 2.11.1
GHSA-r837-hpv7-pc2f · CVE-2024-56373 - CVSS 5.3 Medium
SourceCodester Modern Image Gallery App upload.php cross site scripting
- SourceCodester Modern Image Gallery App
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Alinto SOGo cross site scripting
- Alinto SOGo
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
horilla-opensource horilla Leads global.js cross site scripting
- horilla
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
RCE vulnerability has been discovered in OpenText™ Carbonite Safe Server Backup.
- OpenText™ Carbonite Safe Server Backup
- Code injection
- CVSS 5.3 Medium
itsourcecode Event Management System navbar.php cross site scripting
- itsourcecode Event Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
xingfuggz BaykeShop Article Sidebar custom.html cross site scripting
- xingfuggz BaykeShop
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
erzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scripting
- erzhongxmu JEEWMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
erzhongxmu JEEWMS UEditor getContent.jsp cross site scripting
- erzhongxmu JEEWMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler
- Code injection
- CWE-791
<=0.0.2 · no fixed version yet
GHSA-q5xx-fxv3-xxqf · CVE-2026-2969 - CVSS 4.8 Medium
a466350665 Smart-SSO Role Edit UserController.java save cross site scripting
- a466350665 Smart-SSO
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
a466350665 Smart-SSO Login login.html cross site scripting
- a466350665 Smart-SSO
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting
- 07FLYCMS
- 07FLY-CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 2.3 Low
higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution
- higuma web-audio-recorder-js
- Code injection
- Prototype pollution
- CVSS 8.8 High
TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable.
- Code injection
- CVSS 5.1 Medium
rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting
- rymcu forest
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
rymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scripting
- rymcu forest
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SapneshNaik Student Management System index.php cross site scripting
- SapneshNaik Student Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
itsourcecode Student Management System Add Student add_student cross site scripting
- itsourcecode Student Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
YiFang CMS Extended Management D_friendLinkGroup.php update cross site scripting
- YiFang CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
YiFang CMS Extended Management D_adManage.php update cross site scripting
- YiFang CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
YiFang CMS Extended Management D_adPosition.php update cross site scripting
- YiFang CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
funadmin: XSS through Value argument in Backend Interface component
- Cross-site scripting (XSS)
- Code injection
<=7.1.0-rc4 · no fixed version yet
GHSA-rfh7-7v27-6p9r · CVE-2026-2897 - CVSS 7.7 High
Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
- metabase
- Code injection
- CVSS 7.2 High
Moodle has a Remote Code Execution risk via file restore
- Code injection
<4.5.9 || >=5.0.0-beta, <5.0.5 || >=5.1.0-beta, <5.1.2 · fixed in 4.5.9, 5.0.5, 5.1.2
GHSA-ggxq-2mg9-8966 · CVE-2026-26045 - CVSS 5.1 Medium
detronetdip E-commerce function.php get_safe_value cross site scripting
- detronetdip E-commerce
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability
- WesternDeal WPForms Google Sheet Connector
- Code injection
- CVSS 7.7 High
WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability
- Inpersttion For Theme
- Code injection
- CVSS 5.1 Medium
rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting
- rachelos WeRSS we-mp-rss
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
- Code injection
<1.39.4 · fixed in 1.39.4
GHSA-xjw9-4gw8-4rqx · CVE-2026-26030 - CVSS 8.1 High
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method
- Code injection
- CWE-116
<4.2.0 · fixed in 4.2.0
GHSA-9vjf-qc39-jprp · CVE-2026-25755 - CVSS 9.3 CriticalCritical · CVSS 9+
SPIP Saisies Plugin < 5.11.1 Remote Code Execution
- SPIP Saisies pour formulaire
- Code injection
- CVSS 8.4 High
Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
- WSO2 Identity Server
- Command injection
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
- InvoicePlane
- Code injection
- File inclusion
- CVSS 9.3 CriticalCritical · CVSS 9+
MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
- sergejey MajorDoMo
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
NLTK has a Zip Slip Vulnerability
- Code injection
<3.9.3 · fixed in 3.9.3
GHSA-7p94-766c-hgjp · CVE-2025-14009 - CVSS 7.1 High
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
- Code injection
- CWE-184
<1.0.3 · fixed in 1.0.3
GHSA-97f8-7cmv-76j2 · CVE-2026-53875 - CVSS 7.8 High
Code injection in OpenCFD OpenFOAM
- OpenCFD OpenFOAM
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-Bridge
- NVIDIA Megatron-Bridge
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-Bridge
- NVIDIA Megatron-Bridge
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 7.2 High
Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter
- acowebs Product Addons for Woocommerce – Product Options with Custom Fields
- Code injection