CVE-2025-52744

Improper Control of Generation of Code 'Code Injection' vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through = 1.0...

CVE-2025-52744

Improper Control of Generation of Code 'Code Injection' vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through = 1.0...

CVE-2026-26974

CVE-2026-26974 (Slyde) affects Slyde versions 0.0.4 and earlier. The root cause is Node.js automatically importing any /**.plugin.{js,mjs} files, including those from node_modules, enabling a malicious package with a .plugin.js file to execute arbitrary code when installed or required. Impact is ...

PT-2026-21033

Name of the Vulnerable Software and Affected Versions Inpersttion For Theme versions n/a through 1.0 Description An improper control of generation of code issue, specifically a code injection, exists in Inpersttion For Theme. This allows for code injection. Recommendations Versions prior to 1.1 a...

The vulnerability of the EcoStruxure Building Operation Workstation interface and the EcoStruxure Building Operation WebStation software’s web interface arises from improper code generation. This vulnerability allows a perpetrator to execute arbitrary code.

The vulnerability of the EcoStruxure Building Operation Workstation interface and the EcoStruxure Building Operation WebStation software’s web interface is related to incorrect code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially creat...

CVE-2025-33042 Apache Avro Java SDK: Code injection on Java generated code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 o...

Assessing Spear-Phishing Website Generation in Large Language Model Coding Agents

Large Language Models are expanding beyond being a tool humans use and into independent agents that can observe an environment, reason about solutions to problems, make changes that impact those environments, and understand how their actions impacted their environment. One of the most common...

The vulnerability of Microsoft Defender for Endpoint on Linux operating systems, related to improper code generation management, allows a malicious actor to execute arbitrary code.

The vulnerability of Microsoft Defender for Endpoint on Linux operating systems is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Microsoft Visual Studio software lies in its inadequate control over code generation, which allows attackers to execute arbitrary code.

The vulnerability of the Microsoft Visual Studio software lies in the insufficient control over code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-1226

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file...

CVE-2026-1226

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file...

CVE-2026-1226

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file...

CVE-2026-1226

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file...

CVE-2026-1226

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file...

PT-2026-7581

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file...

SecCodePRM: A Process Reward Model for Code Security

Large Language Models are rapidly becoming core components of modern software development workflows, yet ensuring code security remains challenging. Existing vulnerability detection pipelines either rely on static analyzers or use LLM/GNN-based detectors trained with coarse program-level...

The vulnerability of the Duo Workflow Service component, a service for interacting with external LLM-providers like GitLab AI Gateway, allows a perpetrator to execute arbitrary code.

The vulnerability of the Duo Workflow Service component, a service for interacting with external LLM-providers like GitLab AI Gateway, is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted request...

The vulnerability of the vscode-go extension of the Visual Studio Code editor allows a hacker to execute arbitrary code.

The vulnerability of the vscode-go extension of the Visual Studio Code editor is related to incorrect code generation management. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

Can Developers Rely on LLMs for Secure IaC Development?

We investigated the capabilities of GPT-4o and Gemini 2.0 Flash for secure Infrastructure as Code IaC development. For security smell detection, on the Stack Overflow dataset, which primarily contains small, simplified code snippets, the models detected at least 71% of security smells when prompt...

The vulnerability of the Ivanti Endpoint Manager Mobile (EPMM) application for managing the lifecycle of mobile devices and applications lies in improper code generation. This allows an attacker to execute arbitrary code.

The vulnerability of the Ivanti Endpoint Manager Mobile EPMM application for managing the lifecycle of mobile devices and applications is related to improper code generation. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...