CVE-2026-76484 | High | 8.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software… |
CVE-2026-62176 | Critical | 9.1 | 2026-10-07 | PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents… |
CVE-2026-106577 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values c… |
CVE-2026-96408 | Critical | 9.4 | 2026-10-07 | A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or… |
CVE-2026-104677 | High | 7.2 | 2026-10-07 | The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability tha… |
CVE-2026-97679 | High | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements… |
CVE-2026-97676 | High | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements… |
CVE-2026-97674 | High | 8.1 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special el… |
CVE-2026-97655 | High | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner. |
CVE-2026-93674 | Critical | 9.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS… |
CVE-2026-93449 | High | 8.5 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. |
CVE-2026-93445 | High | 8.1 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. |
CVE-2026-93443 | High | 7.5 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements… |
CVE-2026-88962 | High | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. |
CVE-2026-104334 | Critical | 9.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation. |
CVE-2026-106509 | High | 7.7 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation… |
CVE-2026-105812 | Critical | 9.0 | 2026-10-06 | Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated sa… |
CVE-2026-79810 | High | 7.2 | 2026-10-06 | Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attac… |
CVE-2026-106446 | Critical | 9.8 | 2026-10-06 | Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept… |
CVE-2026-106441 | High | 7.8 | 2026-10-06 | Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config… |
CVE-2026-106416 | Medium | 5.4 | 2026-10-06 | Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted… |
CVE-2026-106189 | | | 2026-10-06 | Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin pol… |
CVE-2026-105858 | High | 8.1 | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request t… |
CVE-2026-105857 | Critical | 10.0 | 2026-10-06 | Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0… |
CVE-2026-105950 | Low | 3.5 | 2026-10-06 | A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formw… |
CVE-2026-105801 | | | 2026-10-06 | openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document con… |
CVE-2026-105796 | High | 8.8 | 2026-10-06 | Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment termi… |
CVE-2026-82531 | High | 8.1 | 2026-10-06 | Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-compo… |
CVE-2026-39776 | High | 8.0 | 2026-10-06 | Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions. |
CVE-2026-39725 | High | 8.8 | 2026-10-06 | Contributor Remote Code Execution (RCE) in Content Visibility for Divi Builder <= 5.03 versions. |
CVE-2026-32568 | Critical | 9.9 | 2026-10-06 | Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions. |
CVE-2026-105809 | Medium | 4.3 | 2026-10-06 | A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of… |
CVE-2026-105808 | Low | 3.5 | 2026-10-06 | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults… |
CVE-2026-105708 | Medium | 4.3 | 2026-10-06 | A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the compone… |
CVE-2026-105705 | Medium | 4.3 | 2026-10-06 | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performi… |
CVE-2026-105764 | | | 2026-10-06 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumb… |
CVE-2026-105677 | High | 7.2 | 2026-10-05 | Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Adm… |
CVE-2026-105642 | High | 8.8 | 2026-10-05 | Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG han… |
CVE-2026-12171 | High | 7.8 | 2026-10-05 | auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into i… |
CVE-2026-88393 | Critical | 9.8 | 2026-10-05 | WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed… |
CVE-2026-105329 | Medium | 6.3 | 2026-10-05 | A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of… |
CVE-2026-88391 | Critical | 9.8 | 2026-10-05 | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console… |
CVE-2026-105315 | Medium | 4.7 | 2026-10-05 | A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of th… |
CVE-2026-105291 | Medium | 4.3 | 2026-10-05 | A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/C… |
CVE-2026-105289 | Low | 3.5 | 2026-10-05 | A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model… |
CVE-2026-105288 | Medium | 4.3 | 2026-10-05 | A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP… |
CVE-2026-104811 | | | 2026-10-05 | DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication… |
CVE-2026-105226 | Medium | 4.7 | 2026-10-05 | A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php… |
CVE-2026-105225 | Medium | 4.3 | 2026-10-05 | A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the compo… |
CVE-2026-105188 | Low | 3.5 | 2026-10-05 | A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/… |
CVE-2026-105173 | Low | 3.5 | 2026-10-05 | A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventSt… |
CVE-2026-105135 | Critical | 10.0 | 2026-10-04 | A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the c… |
CVE-2026-105099 | Low | 3.5 | 2026-10-04 | A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the… |
CVE-2026-92084 | Critical | 9.1 | 2026-10-03 | The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to… |
CVE-2026-103519 | Medium | 5.4 | 2026-10-03 | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the… |
CVE-2026-100157 | Medium | 6.5 | 2026-10-03 | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the… |
CVE-2026-100152 | Medium | 6.5 | 2026-10-03 | The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitr… |
CVE-2026-92536 | High | 8.8 | 2026-10-03 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2026-104851 | High | 8.8 | 2026-10-02 | fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceF… |
CVE-2026-104849 | | | 2026-10-02 | Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task… |
CVE-2026-51922 | Critical | 9.8 | 2026-10-02 | agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can tr… |
CVE-2026-51918 | Critical | 9.8 | 2026-10-02 | FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code (). |
CVE-2026-51917 | High | 7.3 | 2026-10-02 | FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code. |
CVE-2026-51911 | Critical | 9.8 | 2026-10-02 | vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacke… |
CVE-2026-51898 | Critical | 9.8 | 2026-10-02 | sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute. |
CVE-2026-104612 | Medium | 4.3 | 2026-10-02 | A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcemen… |
CVE-2026-10026 | High | 7.2 | 2026-10-02 | The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validatio… |
CVE-2026-51886 | Critical | 9.8 | 2026-10-01 | langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/… |
CVE-2026-51881 | Critical | 9.8 | 2026-10-01 | deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execut… |
CVE-2026-55251 | Medium | 6.5 | 2026-10-01 | NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .githu… |
CVE-2026-96658 | Critical | 9.9 | 2026-10-01 | A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox wit… |
CVE-2026-103686 | Low | 3.5 | 2026-10-01 | A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the com… |
CVE-2026-92966 | Critical | 9.1 | 2026-10-01 | The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all… |
CVE-2026-51872 | Critical | 9.8 | 2026-09-30 | Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py. |
CVE-2026-51871 | Critical | 9.8 | 2026-09-30 | Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code ex… |
CVE-2026-51866 | Critical | 9.8 | 2026-09-30 | In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow. |
CVE-2026-51861 | Critical | 9.8 | 2026-09-30 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. |
CVE-2026-51858 | Critical | 9.8 | 2026-09-30 | In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary. |
CVE-2026-51857 | Critical | 9.8 | 2026-09-30 | In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval… |
CVE-2026-51856 | Critical | 9.8 | 2026-09-30 | In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt th… |
CVE-2026-102131 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An… |
CVE-2026-102130 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the applicati… |
CVE-2026-102097 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated adm… |
CVE-2026-55107 | Critical | 10.0 | 2026-09-30 | Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user… |
CVE-2026-55094 | | | 2026-09-30 | Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vuln… |
CVE-2026-96349 | Critical | 10.0 | 2026-09-30 | Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. |
CVE-2026-94389 | Critical | 9.0 | 2026-09-30 | Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions. |
CVE-2026-102847 | Medium | 4.3 | 2026-09-30 | A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file… |
CVE-2026-86131 | Critical | 9.8 | 2026-09-30 | A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server t… |
CVE-2026-79538 | Critical | 9.8 | 2026-09-29 | metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (create… |
CVE-2026-39117 | Critical | 9.8 | 2026-09-29 | An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index… |
CVE-2024-31026 | Critical | 9.8 | 2026-09-29 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the c… |
CVE-2026-102830 | Medium | 6.8 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5… |
CVE-2026-102425 | Critical | 10.0 | 2026-09-29 | Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PH… |
CVE-2026-77177 | Critical | 9.8 | 2026-09-29 | Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with… |
CVE-2026-84154 | Critical | 9.9 | 2026-09-29 | A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an att… |
CVE-2026-102292 | Medium | 4.3 | 2026-09-29 | A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functional… |
CVE-2026-102290 | Low | 3.5 | 2026-09-29 | A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a… |
CVE-2026-102264 | Low | 3.5 | 2026-09-29 | A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file fron… |
CVE-2024-42002 | High | 8.4 | 2026-09-28 | A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions fro… |