CVE-2026-96754

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96754

Versions of orval prior to 8.29.0 are vulnerable to a code injection flaw within the @orval/hono generator. The root cause is a failure to properly escape OpenAPI path values in single-quoted route literals. By crafting an OpenAPI document containing an apostrophe in a static path segment, an att...

RHLW-2026-6DD67008E326A981 Lightwell Security Advisory: avro 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042. CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema Java SDK CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated...

Exploit for Static Code Injection in N-Able N-Central

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit Ove...

MSC-2026-11701

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11698

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...

MSC-2026-11697

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11699

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11694

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...

CVE-2026-96755: Improper Control of Generation of Code

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96758: Improper Control of Generation of Code

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96754: Improper Control of Generation of Code

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

Linux Distros Unpatched Vulnerability : CVE-2026-91719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security...

PT-2026-97411

Name of the Vulnerable Software and Affected Versions @orval/core versions prior to 8.28.0 Description A code injection issue exists in the form-data serializer. The component fails to escape multipart property names within generated template literals. This allows attackers to inject $...

PT-2026-97408

Name of the Vulnerable Software and Affected Versions orval versions 8.14.0 through 8.28.1 Description The @orval/effect generator improperly converts OpenAPI schema defaults into template literals. This allows for code injection where arbitrary JavaScript expressions using the $... syntax can be...

CVE-2026-96756: Improper Control of Generation of Code

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

Arbitrary Code Injection

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2026-89276

Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation o...

CVE-2026-89275

Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

CVE-2026-84412

Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...