CVE-2026-16800

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

EUVD-2026-48608

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...

CVE-2026-16801

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...

CVE-2026-16801

Devolutions PowerShell Universal versions 2026.2.2 and earlier are vulnerable to a Code Injection flaw in the variables feature. An authenticated user with variable write permissions can execute arbitrary PowerShell code by providing a crafted variable value that is not properly escaped when writ...

CVE-2026-16800

Devolutions PowerShell Universal versions prior to 2026.2.3 (specifically 2026.2.2 and earlier) are vulnerable to a Code Injection flaw in the schedule feature. An authenticated user with schedule creation permissions can execute arbitrary PowerShell code by providing crafted schedule parameter n...

CVE-2026-16800

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

EUVD-2026-48607

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

CVE-2026-16800

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

GHSA-HC76-7MPC-QJQH ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder...

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder...

Code Injection

LiteLLM is vulnerable to Code Injection. The vulnerability is due to insufficient sandboxing and validation of custom Python code submitted through the Custom Code Guardrails create and update paths, which allows a privileged attacker with guardrail management access to execute arbitrary Python...

WordPress Customer Support Ticket System & Helpdesk plugin <= 6.0.5 - Unauthenticated Code Injection vulnerability

Unauthenticated Code Injection vulnerability discovered by theviper17y in WordPress Plugin WP Ticket Customer Service Software & Support Ticket System versions = 6.0.5...

CVE-2026-16801: Improper Control of Generation of Code

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...

PT-2026-64310

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description Improper control of code generation in the variables feature allows an authenticated user with variable write permissions to execute arbitrary PowerShell code. This occurs...

CVE-2026-16800: Improper Control of Generation of Code

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

PT-2026-64309

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description Improper control of code generation in the schedule feature allows an authenticated user with schedule creation permissions to execute arbitrary PowerShell code. This occu...

DEBIAN-CVE-2026-60122

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...

CVE-2026-60122

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...

UBUNTU-CVE-2026-60122

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...

CVE-2026-60122 gpsd gpsprof Code Injection via SKY.satellites used Field

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...