CWE-94 · Code Injection (page 5)
Page 5 of 74 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81662 | | 2026-08-27 | Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized… | |
CVE-2026-19225 | Medium | 6.6 | 2026-08-27 | The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any singl… |
CVE-2026-19223 | High | 7.2 | 2026-08-27 | The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a… |
CVE-2026-75414 | Critical | 9.8 | 2026-08-26 | In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerabili… |
CVE-2026-75411 | Critical | 9.8 | 2026-08-26 | JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityC… |
CVE-2026-52103 | Critical | 9.8 | 2026-08-26 | A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbit… |
CVE-2026-60004 | Critical | 9.8 | 2026-08-26 | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. |
CVE-2026-58474 | High | 8.8 | 2026-08-26 | whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace reposit… |
CVE-2026-74851 | High | 7.2 | 2026-08-26 | The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author r… |
CVE-2026-80201 | Low | 2.0 | 2026-08-26 | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() me… |
CVE-2026-76148 | High | 7.8 | 2026-08-26 | CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product. |
CVE-2026-57170 | High | 7.8 | 2026-08-26 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3… |
CVE-2026-54757 | High | 7.8 | 2026-08-25 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 throug… |
CVE-2026-79793 | Medium | 4.3 | 2026-08-25 | A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit… |
CVE-2026-79249 | Medium | 6.5 | 2026-08-25 | Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted file. (Chromium sec… |
CVE-2026-65082 | High | 7.0 | 2026-08-25 | NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vu… |
CVE-2026-55585 | High | 8.8 | 2026-08-25 | QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production… |
CVE-2026-55546 | Critical | 9.8 | 2026-08-25 | QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-contr… |
CVE-2026-57909 | | 2026-08-25 | A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected sy… | |
CVE-2026-49845 | Critical | 9.8 | 2026-08-25 | SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hiv… |
CVE-2026-78654 | High | 7.3 | 2026-08-25 | A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The… |
CVE-2026-56703 | High | 7.2 | 2026-08-25 | Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Auth… |
CVE-2026-52490 | Critical | 9.8 | 2026-08-24 | An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiff… |
CVE-2026-40877 | High | 8.7 | 2026-08-24 | Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which… |
CVE-2026-39975 | | 2026-08-24 | Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to cod… | |
CVE-2025-26238 | High | 8.1 | 2026-08-24 | In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code. |
CVE-2026-76836 | High | 8.8 | 2026-08-24 | AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config propert… |
CVE-2026-78367 | High | 7.0 | 2026-08-24 | A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes… |
CVE-2026-76841 | High | 8.8 | 2026-08-24 | Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader… |
CVE-2026-78187 | Low | 3.1 | 2026-08-24 | A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argumen… |
CVE-2026-78181 | High | 7.3 | 2026-08-24 | A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulatio… |
CVE-2026-78180 | High | 7.3 | 2026-08-24 | A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components… |
CVE-2026-78179 | Medium | 6.3 | 2026-08-24 | A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object… |
CVE-2026-19200 | High | 8.9 | 2026-08-24 | The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function… |
CVE-2026-78178 | High | 7.3 | 2026-08-24 | A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. Th… |
CVE-2026-78166 | Medium | 6.3 | 2026-08-24 | A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src… |
CVE-2026-78060 | Medium | 4.3 | 2026-08-23 | A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php… |
CVE-2026-78059 | Medium | 4.3 | 2026-08-23 | A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /php_action/printOrder.php. S… |
CVE-2026-78055 | Medium | 4.3 | 2026-08-23 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2026-78054 | Medium | 4.3 | 2026-08-23 | A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a man… |
CVE-2026-77992 | | 2026-08-22 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access c… | |
CVE-2026-76605 | | 2026-08-22 | Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. | |
CVE-2026-76604 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the exec… | |
CVE-2026-3424 | Medium | 5.3 | 2026-08-22 | The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2026-19221 | High | 7.2 | 2026-08-22 | The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any sin… |
CVE-2026-77415 | | 2026-08-21 | JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to e… | |
CVE-2026-77414 | | 2026-08-21 | JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty… | |
CVE-2026-77413 | | 2026-08-21 | JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty c… | |
CVE-2026-68508 | High | 7.8 | 2026-08-21 | Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by co… |
CVE-2026-59989 | | 2026-08-21 | Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filt… | |
CVE-2026-62675 | High | 8.8 | 2026-08-21 | Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenti… |
CVE-2026-62674 | Critical | 9.0 | 2026-08-21 | Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_E… |
CVE-2026-77806 | Critical | 9.8 | 2026-08-21 | SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injectio… |
CVE-2026-18781 | High | 8.1 | 2026-08-21 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping… |
CVE-2026-77647 | Critical | 9.8 | 2026-08-20 | SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect ide… |
CVE-2026-18287 | High | 7.8 | 2026-08-20 | Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-18286 | High | 7.8 | 2026-08-20 | Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2026-76635 | High | 7.2 | 2026-08-20 | baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled ta… |
CVE-2026-77077 | High | 7.6 | 2026-08-20 | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis… |
CVE-2026-77075 | High | 7.3 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering… |
CVE-2026-77074 | Medium | 6.5 | 2026-08-20 | n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users t… |
CVE-2026-73992 | Critical | 9.9 | 2026-08-20 | Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. |
CVE-2026-13405 | Medium | 6.6 | 2026-08-20 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later exe… |
CVE-2026-76760 | High | 7.3 | 2026-08-19 | A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manip… |
CVE-2026-76335 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the edit_manager_xml capability cou… |
CVE-2026-76315 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary co… |
CVE-2026-76314 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code… |
CVE-2026-63187 | Medium | 6.3 | 2026-08-19 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpol… |
CVE-2026-75149 | High | 8.8 | 2026-08-19 | marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supp… |
CVE-2026-72717 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71871 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71869 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71868 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71865 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter… | |
CVE-2026-71864 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter… | |
CVE-2026-62682 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0]… | |
CVE-2026-62681 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI… | |
CVE-2026-18874 | Medium | 6.2 | 2026-08-19 | A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenSh… |
CVE-2026-72530 | Critical | 9.0 | 2026-08-19 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlie… |
CVE-2026-64850 | | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class… | |
CVE-2026-53451 | Critical | 9.8 | 2026-08-19 | Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthent… |
CVE-2026-45272 | | 2026-08-19 | MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in we… | |
CVE-2026-76224 | High | 8.8 | 2026-08-19 | ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine d… |
CVE-2026-43961 | High | 7.8 | 2026-08-19 | A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark… |
CVE-2026-67364 | | 2026-08-19 | Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed vi… | |
CVE-2026-18937 | Critical | 9.0 | 2026-08-19 | The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowin… |
CVE-2026-75911 | High | 7.8 | 2026-08-18 | CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbi… |
CVE-2026-75858 | High | 7.8 | 2026-08-18 | CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's a… |
CVE-2026-73073 | | 2026-08-18 | Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command… | |
CVE-2026-45117 | Critical | 9.8 | 2026-08-18 | MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration value… |
CVE-2026-73343 | Critical | 10.0 | 2026-08-18 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. |
CVE-2026-50187 | High | 8.8 | 2026-08-18 | Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH… |
CVE-2026-32444 | Critical | 9.9 | 2026-08-18 | Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. |
CVE-2026-75827 | High | 8.8 | 2026-08-18 | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist inste… |
CVE-2026-75078 | Medium | 4.3 | 2026-08-17 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a… |
CVE-2026-67961 | High | 7.8 | 2026-08-17 | An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution. |
CVE-2026-67919 | Critical | 9.8 | 2026-08-17 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationCont… |
CVE-2026-38165 | Critical | 9.8 | 2026-08-17 | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute… |
CVE-2026-75077 | Medium | 4.3 | 2026-08-17 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2… |
CVE-2026-67960 | Critical | 9.8 | 2026-08-17 | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentCont… |