CWE-94 · Code Injection (page 12)
Page 12 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-33239 | High | 7.8 | 2026-02-18 | NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection. A successful exploit of this vu… |
CVE-2025-33236 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection. A successful exploit of this vulnerabili… |
CVE-2026-2296 | High | 7.2 | 2026-02-18 | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and includi… |
CVE-2026-2622 | Low | 3.5 | 2026-02-17 | A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blo… |
CVE-2025-70830 | Critical | 9.9 | 2026-02-17 | A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitra… |
CVE-2025-65716 | High | 8.8 | 2026-02-16 | An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file. |
CVE-2025-65715 | High | 7.8 | 2026-02-16 | An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a… |
CVE-2026-2557 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the c… |
CVE-2026-2547 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in LigeroSmart up to 6.1.26. The impacted element is the function AgentDashboard of the file /otrs/index.pl. Performing a manipula… |
CVE-2026-2546 | Low | 3.5 | 2026-02-16 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulati… |
CVE-2026-2545 | Low | 3.5 | 2026-02-16 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulat… |
CVE-2025-33042 | High | 7.3 | 2026-02-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. … |
CVE-2026-26056 | High | 8.8 | 2026-02-12 | Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) compon… |
CVE-2026-25227 | Critical | 9.1 | 2026-02-12 | authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has th… |
CVE-2025-63421 | High | 7.8 | 2026-02-12 | An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the comeinst.exe file |
CVE-2026-26216 | Critical | 10.0 | 2026-02-12 | Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter cont… |
CVE-2026-0969 | High | 8.8 | 2026-02-12 | The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This v… |
CVE-2020-37186 | Critical | 9.8 | 2026-02-11 | Chevereto 3.13.4 Core contains a remote code execution vulnerability that allows attackers to inject malicious code during database configuration installation… |
CVE-2020-37178 | High | 7.5 | 2026-02-11 | KeePass Password Safe versions before 2.44 contain a denial of service vulnerability in the help system's HTML handling. Attackers can trigger the vulnerabilit… |
CVE-2025-69872 | Critical | 9.8 | 2026-02-11 | DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve ar… |
CVE-2026-1226 | | 2026-02-11 | CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when mali… | |
CVE-2026-1560 | High | 8.8 | 2026-02-11 | The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple fun… |
CVE-2025-14541 | High | 7.2 | 2026-02-11 | The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags para… |
CVE-2026-21537 | High | 8.8 | 2026-02-10 | Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent netw… |
CVE-2026-21256 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2026-25807 | High | 8.8 | 2026-02-09 | ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share… |
CVE-2026-2224 | Low | 3.5 | 2026-02-09 | A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /system/system/admins/manage/users/btn_funct… |
CVE-2026-2222 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/syst… |
CVE-2026-2214 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.php. This manipulatio… |
CVE-2026-1615 | Critical | 9.8 | 2026-02-09 | Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The libr… |
CVE-2026-2201 | Low | 2.4 | 2026-02-09 | A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the… |
CVE-2026-2200 | Low | 2.4 | 2026-02-09 | A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Execut… |
CVE-2026-2160 | Medium | 4.3 | 2026-02-08 | A vulnerability has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-2159 | Medium | 4.3 | 2026-02-08 | A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected is an unknown function of the file /tourism/classes/Master.php?f=regist… |
CVE-2026-2156 | Low | 2.4 | 2026-02-08 | A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announceme… |
CVE-2026-2154 | Medium | 4.3 | 2026-02-08 | A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown function of the file /… |
CVE-2026-2150 | Medium | 4.3 | 2026-02-08 | A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2026-2149 | Medium | 4.3 | 2026-02-08 | A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown fu… |
CVE-2026-2145 | Low | 3.5 | 2026-02-08 | A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the componen… |
CVE-2026-25636 | High | 8.2 | 2026-02-06 | calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitra… |
CVE-2026-2064 | Low | 3.5 | 2026-02-06 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.ph… |
CVE-2026-25587 | Critical | 10.0 | 2026-02-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Ma… |
CVE-2026-2008 | Medium | 6.3 | 2026-02-06 | A vulnerability was detected in abhiphile fermat-mcp up to 47f11def1cd37e45dd060f30cdce346cbdbd6f0a. This vulnerability affects the function eqn_chart of the f… |
CVE-2026-1977 | Medium | 6.3 | 2026-02-06 | A security vulnerability has been detected in isaacwasserman mcp-vegalite-server up to 16aefed598b8cd897b78e99b907f6e2984572c61. Affected by this vulnerability… |
CVE-2026-1971 | Low | 2.4 | 2026-02-06 | A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp. Such manipulation… |
CVE-2025-70073 | High | 7.2 | 2026-02-05 | An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function |
CVE-2020-37137 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an… |
CVE-2025-61732 | High | 8.6 | 2026-02-05 | A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. |
CVE-2026-25481 | Critical | 9.6 | 2026-02-04 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. Tabl… |
CVE-2026-25510 | Critical | 9.9 | 2026-02-03 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-24887 | High | 8.8 | 2026-02-03 | Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prom… |
CVE-2026-24149 | High | 7.8 | 2026-02-03 | NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A succ… |
CVE-2025-69983 | Critical | 9.8 | 2026-02-03 | FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied script… |
CVE-2026-25142 | Critical | 10.0 | 2026-02-02 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, whi… |
CVE-2026-1744 | Low | 2.4 | 2026-02-02 | A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulat… |
CVE-2020-37052 | Critical | 9.8 | 2026-01-30 | AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands t… |
CVE-2026-25153 | High | 7.7 | 2026-01-30 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In ver… |
CVE-2026-1705 | Low | 2.4 | 2026-01-30 | A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interfac… |
CVE-2026-25141 | Critical | 9.8 | 2026-01-30 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and… |
CVE-2025-24293 | High | 8.1 | 2026-01-30 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation me… |
CVE-2025-62348 | High | 7.8 | 2026-01-30 | Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintend… |
CVE-2026-1700 | Low | 3.5 | 2026-01-30 | A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknown code of the file /app/sms.php. This m… |
CVE-2026-1340 | Critical | 9.8 | 2026-01-29 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. |
CVE-2026-1281 | Critical | 9.8 | 2026-01-29 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. |
CVE-2026-24780 | High | 8.8 | 2026-01-29 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2026-1598 | Low | 3.5 | 2026-01-29 | A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. Impacted is an unknown function of the file /dashboard/home/… |
CVE-2026-24897 | Critical | 10.0 | 2026-01-28 | Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any sp… |
CVE-2025-69517 | High | 8.8 | 2026-01-28 | An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creatio… |
CVE-2025-57283 | High | 7.8 | 2026-01-28 | The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in… |
CVE-2026-1520 | Low | 2.4 | 2026-01-28 | A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such ma… |
CVE-2026-23830 | Critical | 10.0 | 2026-01-28 | SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `Sandbo… |
CVE-2026-24747 | High | 8.8 | 2026-01-27 | PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker… |
CVE-2025-69564 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_p… |
CVE-2026-24871 | | 2026-01-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before… | |
CVE-2026-24806 | | 2026-01-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/ba… | |
CVE-2026-22709 | Critical | 9.8 | 2026-01-26 | vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be b… |
CVE-2026-1444 | Low | 2.4 | 2026-01-26 | A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers… |
CVE-2026-1421 | Low | 3.5 | 2026-01-26 | A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation le… |
CVE-2026-24474 | | 2026-01-24 | Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, `use_animated_ope… | |
CVE-2024-11976 | High | 7.3 | 2026-01-23 | The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the softwar… |
CVE-2025-67847 | High | 8.8 | 2026-01-23 | A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient… |
CVE-2026-0771 | High | 7.1 | 2026-01-23 | Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-0768 | Critical | 9.8 | 2026-01-23 | Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… |
CVE-2026-0766 | High | 8.8 | 2026-01-23 | Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0761 | Critical | 9.8 | 2026-01-23 | Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2026-24132 | Critical | 9.8 | 2026-01-23 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0… |
CVE-2025-69319 | High | 7.5 | 2026-01-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This… |
CVE-2025-69001 | Medium | 5.3 | 2026-01-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Shahjahan Jewel FluentForm fluentform allows Code Injection.This issue affects Fluen… |
CVE-2025-68015 | Critical | 9.0 | 2026-01-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows… |
CVE-2025-67944 | Critical | 9.1 | 2026-01-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue af… |
CVE-2026-23946 | Medium | 6.8 | 2026-01-22 | Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical d… |
CVE-2026-22807 | High | 8.8 | 2026-01-21 | vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto… |
CVE-2026-22793 | Critical | 9.6 | 2026-01-21 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnera… |
CVE-2021-47778 | High | 7.2 | 2026-01-21 | GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through pl… |
CVE-2021-47770 | High | 8.8 | 2026-01-21 | OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hard… |
CVE-2026-20045 | High | 8.2 | 2026-01-21 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco U… |
CVE-2026-1245 | Medium | 6.5 | 2026-01-20 | A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in… |
CVE-2025-55423 | Critical | 9.8 | 2026-01-20 | A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwardin… |
CVE-2025-33233 | High | 7.8 | 2026-01-20 | NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. A successful exploit of this vulnerabil… |
CVE-2026-23947 | Critical | 9.8 | 2026-01-20 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to… |