agentprime: Code injectionEvery new Code injection Advisory and CVE.https://agentprime.io/CVE-2026-116786: FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofiahttps://agentprime.io/advisories/CVE-2026-116786/https://agentprime.io/advisories/CVE-2026-116786/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:25:23 GMTCVECVE-2026-100358: SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injectionhttps://agentprime.io/advisories/CVE-2026-100358/https://agentprime.io/advisories/CVE-2026-100358/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:47:59 GMTCVEcriticalCVE-2026-123198: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>https://agentprime.io/advisories/CVE-2026-123198/https://agentprime.io/advisories/CVE-2026-123198/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:16:35 GMTCVEcriticalBanks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEhttps://agentprime.io/advisories/GHSA-64vx-6h2c-rjh7/https://agentprime.io/advisories/GHSA-64vx-6h2c-rjh7/banks <2.4.3, fixed in 2.4.3. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:51:02 GMTPyPIbanksCVE-2026-120859: PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Fileshttps://agentprime.io/advisories/CVE-2026-120859/https://agentprime.io/advisories/CVE-2026-120859/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:14:58 GMTCVECVE-2026-120499: h5io before 0.2.6 Arbitrary Code Execution via read_hdf5https://agentprime.io/advisories/CVE-2026-120499/https://agentprime.io/advisories/CVE-2026-120499/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:55:32 GMTCVECVE-2026-54141: OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`https://agentprime.io/advisories/CVE-2026-54141/https://agentprime.io/advisories/CVE-2026-54141/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:35:41 GMTCVEcriticalCVE-2026-68524: Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loadinghttps://agentprime.io/advisories/CVE-2026-68524/https://agentprime.io/advisories/CVE-2026-68524/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:11:35 GMTCVECVE-2026-82894: Apache OFBiz: Content renderer runs a service name stored on the rowhttps://agentprime.io/advisories/CVE-2026-82894/https://agentprime.io/advisories/CVE-2026-82894/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:05:44 GMTCVECVE-2026-82910: Apache OFBiz: renderLink compiles link parameters as FreeMarker sourcehttps://agentprime.io/advisories/CVE-2026-82910/https://agentprime.io/advisories/CVE-2026-82910/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:03:20 GMTCVECVE-2026-82912: Apache OFBiz: Unsandboxed Groovy compiled from a service parameterhttps://agentprime.io/advisories/CVE-2026-82912/https://agentprime.io/advisories/CVE-2026-82912/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:02:28 GMTCVECVE-2026-82960: Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCEhttps://agentprime.io/advisories/CVE-2026-82960/https://agentprime.io/advisories/CVE-2026-82960/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:01:23 GMTCVECVE-2026-83542: Apache OFBiz: Unauthenticated RCE via login-page widget injectionhttps://agentprime.io/advisories/CVE-2026-83542/https://agentprime.io/advisories/CVE-2026-83542/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:59:22 GMTCVEcriticalCVE-2026-85627: Apache OFBiz: Authenticated Code Execution Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-85627/https://agentprime.io/advisories/CVE-2026-85627/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:53:26 GMTCVECVE-2026-123020: eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template enginehttps://agentprime.io/advisories/CVE-2026-123020/https://agentprime.io/advisories/CVE-2026-123020/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 12:45:21 GMTCVECVE-2026-73098: Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsinghttps://agentprime.io/advisories/CVE-2026-73098/https://agentprime.io/advisories/CVE-2026-73098/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 11:49:18 GMTCVEcriticalCVE-2026-123018: eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injectionhttps://agentprime.io/advisories/CVE-2026-123018/https://agentprime.io/advisories/CVE-2026-123018/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 11:45:20 GMTCVECVE-2026-122190: SourceCodester Online Food Ordering System Category Management add_category.php cross site scriptinghttps://agentprime.io/advisories/CVE-2026-122190/https://agentprime.io/advisories/CVE-2026-122190/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 03:15:20 GMTCVECVE-2026-122014: NPC-Worldwide npcpy sft.py load_sft_model code injectionhttps://agentprime.io/advisories/CVE-2026-122014/https://agentprime.io/advisories/CVE-2026-122014/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:00:26 GMTCVECVE-2026-121929: EmpireSoft EmpireCMS index.php cross site scriptinghttps://agentprime.io/advisories/CVE-2026-121929/https://agentprime.io/advisories/CVE-2026-121929/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:15:16 GMTCVECVE-2026-121928: InfiniFlow RAGFlow Images API file_utils.py cross site scriptinghttps://agentprime.io/advisories/CVE-2026-121928/https://agentprime.io/advisories/CVE-2026-121928/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:00:30 GMTCVECVE-2026-57853: DataGerry < 3.3.0 SSTI via DocAPI Template Renderinghttps://agentprime.io/advisories/CVE-2026-57853/https://agentprime.io/advisories/CVE-2026-57853/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 17:55:41 GMTCVECVE-2026-114424: Code execution through double evaluation in address replacement ruleshttps://agentprime.io/advisories/CVE-2026-114424/https://agentprime.io/advisories/CVE-2026-114424/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:28:20 GMTCVEcriticalCVE-2026-92196: Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-92196/https://agentprime.io/advisories/CVE-2026-92196/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:51:57 GMTCVECVE-2026-119084: Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parametershttps://agentprime.io/advisories/CVE-2026-119084/https://agentprime.io/advisories/CVE-2026-119084/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 21:05:30 GMTCVEcriticalCVE-2026-115731: Report Deserialization Code Executionhttps://agentprime.io/advisories/CVE-2026-115731/https://agentprime.io/advisories/CVE-2026-115731/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:40:10 GMTCVEcriticalStanza: RCE via pickle deserialization in the lemmatizerhttps://agentprime.io/advisories/GHSA-gh9r-c94j-cmp5/https://agentprime.io/advisories/GHSA-gh9r-c94j-cmp5/stanza >=1.14.0, <1.15.0, fixed in 1.15.0. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:29:16 GMTPyPIstanzaCVE-2026-63471: fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decoratorhttps://agentprime.io/advisories/CVE-2026-63471/https://agentprime.io/advisories/CVE-2026-63471/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 19:18:44 GMTCVEcriticalCVE-2026-63469: fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dicthttps://agentprime.io/advisories/CVE-2026-63469/https://agentprime.io/advisories/CVE-2026-63469/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 19:15:54 GMTCVEcriticalCVE-2026-63470: fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstringhttps://agentprime.io/advisories/CVE-2026-63470/https://agentprime.io/advisories/CVE-2026-63470/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 19:13:47 GMTCVEcriticalElo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member accesshttps://agentprime.io/advisories/GHSA-33r5-xmm8-v6x5/https://agentprime.io/advisories/GHSA-33r5-xmm8-v6x5/@enspirit/elo <1.0.1, fixed in 1.0.1. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 03 Nov 2026 17:53:42 GMTnpm@enspirit/elocriticalElo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelshttps://agentprime.io/advisories/GHSA-7w38-ggh5-v542/https://agentprime.io/advisories/GHSA-7w38-ggh5-v542/@enspirit/elo <1.0.1, fixed in 1.0.1. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 03 Nov 2026 17:51:30 GMTnpm@enspirit/elocriticalElo backends have code injection via unvalidated emission of programmatic AST fieldshttps://agentprime.io/advisories/GHSA-x9rp-7wh3-2rj5/https://agentprime.io/advisories/GHSA-x9rp-7wh3-2rj5/@enspirit/elo <1.0.1, fixed in 1.0.1. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 03 Nov 2026 17:48:09 GMTnpm@enspirit/eloCVE-2026-121260: Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injectionhttps://agentprime.io/advisories/CVE-2026-121260/https://agentprime.io/advisories/CVE-2026-121260/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:30:19 GMTCVEcriticalCVE-2026-121428: AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezonehttps://agentprime.io/advisories/CVE-2026-121428/https://agentprime.io/advisories/CVE-2026-121428/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 14:28:22 GMTCVECVE-2026-120597: Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scriptinghttps://agentprime.io/advisories/CVE-2026-120597/https://agentprime.io/advisories/CVE-2026-120597/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 22:30:20 GMTCVECVE-2026-86596: s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameterhttps://agentprime.io/advisories/CVE-2026-86596/https://agentprime.io/advisories/CVE-2026-86596/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 21:30:23 GMTCVEcriticalCVE-2026-119085: Template injection in the publishing component of awslabs Virtual Engineering Workbenchhttps://agentprime.io/advisories/CVE-2026-119085/https://agentprime.io/advisories/CVE-2026-119085/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 17:37:08 GMTCVEcriticalCVE-2026-102802: Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1https://agentprime.io/advisories/CVE-2026-102802/https://agentprime.io/advisories/CVE-2026-102802/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:29:10 GMTCVECVE-2026-105600: Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5https://agentprime.io/advisories/CVE-2026-105600/https://agentprime.io/advisories/CVE-2026-105600/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:23:25 GMTCVECVE-2026-120349: dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injectionhttps://agentprime.io/advisories/CVE-2026-120349/https://agentprime.io/advisories/CVE-2026-120349/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 06:00:13 GMTCVECVE-2026-120348: dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injectionhttps://agentprime.io/advisories/CVE-2026-120348/https://agentprime.io/advisories/CVE-2026-120348/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 05:45:11 GMTCVECVE-2026-120343: mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scriptinghttps://agentprime.io/advisories/CVE-2026-120343/https://agentprime.io/advisories/CVE-2026-120343/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 04:45:16 GMTCVECVE-2026-120339: mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php cross site scriptinghttps://agentprime.io/advisories/CVE-2026-120339/https://agentprime.io/advisories/CVE-2026-120339/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 03:45:08 GMTCVECVE-2026-120274: beecue FastBee Groovy Script Executor script code injectionhttps://agentprime.io/advisories/CVE-2026-120274/https://agentprime.io/advisories/CVE-2026-120274/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 21:00:27 GMTCVECVE-2026-120242: Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scriptinghttps://agentprime.io/advisories/CVE-2026-120242/https://agentprime.io/advisories/CVE-2026-120242/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 19:00:20 GMTCVECVE-2026-120338: Prefab UI Pyodide sandbox escape to host RCEhttps://agentprime.io/advisories/CVE-2026-120338/https://agentprime.io/advisories/CVE-2026-120338/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 15:24:54 GMTCVEcriticalCVE-2026-120218: Typemill SvgSanitizer.php saveImage cross site scriptinghttps://agentprime.io/advisories/CVE-2026-120218/https://agentprime.io/advisories/CVE-2026-120218/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 06:30:17 GMTCVECVE-2026-120190: PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scriptinghttps://agentprime.io/advisories/CVE-2026-120190/https://agentprime.io/advisories/CVE-2026-120190/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 00:30:25 GMTCVECVE-2026-120203: ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templateshttps://agentprime.io/advisories/CVE-2026-120203/https://agentprime.io/advisories/CVE-2026-120203/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 17:25:52 GMTCVE