VulnCheck KEV: CVE-2026-94169

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

CVE-2026-68571: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted...

PT-2026-115604

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description Improper Control of Generation of Code Code Injection occurs when a special parameter in the JDBC URL allows for the execution of arbitrary code. This issue primarily impacts services directly...

PT-2026-115520

Name of the Vulnerable Software and Affected Versions The Grid versions prior to 2.8.2 Description Improper control of code generation allows for command injection, leading to remote code execution. This occurs when the software fails to properly sanitize input used in the generation of code...

Adobe ColdFusion 2023.x < 2023 Update 26 / 2025.x < 2025 Update 14 Multiple Vulnerabilities (APSB26-144)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 26 or 2025.x update 14. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-144 advisory. - ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type...

CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792145295)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792145295 advisory. - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName...

CVE-2026-12272: Use of Insufficiently Random Values

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TCDYNAMICSECURITY constant being hardcoded to a publicly known value. This makes it possible for...

CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792144313)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792144313 advisory. - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByNa...

PT-2026-115584

Name of the Vulnerable Software and Affected Versions SGLang versions 0.5.10 through 0.5.22 Description A code injection issue exists in the evaluate filter function. Remote attackers can execute Python code by escaping the eval sandbox using re.search globals . This is possible by sending a...

helge17 tuxguitar code injection vulnerability

Helge17 tuxguitar versions prior to 2.1.0 have a code injection vulnerability. This vulnerability stems from an untrusted.tg file that can set the gervil.soundbank.path parameter to reference a disk archive. Additionally, unvalidated class loaders are used to load classes provided by attackers,...

Astra Linux – Vulnerability in Chromium

Injection of code via CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in libio-compress-perl

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. The parseOutputGlob function wraps the output glob string provided by the caller within double quotes and stores it in the parser state. Then, the getFiles function...

CVE-2026-102389

Improper Control of Generation of Code 'Code Injection' vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1...

CVE-2026-102389 WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1...

EUVD-2026-102050

Improper Control of Generation of Code 'Code Injection' vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1...

CVE-2026-102389

The WPMU DEV Broken Link Checker plugin (versions ≤ 2.4.14.1 ) is vulnerable to a Code Injection (CWE-94) vulnerability. This flaw allows for Content Injection because of the Improper Control of Generation of Code . While the base severity is rated as MEDIUM (6.5) with a HIGH confidentiality impa...

PYSEC-2026-4256 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Summary The deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...

PYSEC-2026-4231 Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

Summary Langflow's built-in Python interpreter components — PythonREPLComponent Python Interpreter and the legacy PythonREPLToolComponent Python REPL Tool — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the...

CVE-2026-39991

A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later...

CVE-2026-47790

A cross-site scripting XSS vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP...