CVE-2026-102863: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-102870: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

CVE-2026-105903: Improper Control of Generation of Code

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...

PT-2026-111275

Name of the Vulnerable Software and Affected Versions storyicon comfyui segment anything versions up to ab6395596399d5048639cdab7e44ec9fae857a93 Description Code injection is possible via remote attack in the GroundingDINO Model Loading component. The issue exists within the SLConfig. file2dict...

PT-2026-111954

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Components.WebAssembly.Server versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.Components.WebAssembly.Server versions 11.0.0-preview.1 through 11.0.0-rc.1 Description Improper control of code generation in ASP.NET Core...

Microsoft Windows: CVE-2026-96220: Windows Assigned Access Elevation of Privilege Vulnerability

Improper control of generation of code 'code injection' in Windows Assigned Access allows an authorized attacker to elevate privileges locally...

PT-2026-111948

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper control of code generation leads to a code injection issue, allowing an authorized attacker to elevate privileges over a network. Recommendations At the moment,...

UBUNTU-CVE-2026-102870

Improper control of generation of code 'code injection' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

CVE-2026-108961: Improper Control of Generation of Code

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.init of the file paddlex/inference/models/textdetection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possib...

CVE-2026-108941 Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-108941

The Linketic CityGaussian software (versions up to 2.0 ) contains a code injection vulnerability within the Sidecar Parsing component. Specifically, the parse_cfg_args function in the internal/utils/common.py file is susceptible to exploitation because the manipulation of the cfg_args argument al...

CVE-2026-108941 Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-82108 DataStage on Cloud Pak for Data Code Injection

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-82108

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a code injection vulnerability (CWE-94). A remote authenticated attacker can execute arbitrary code because the software fails to properly neutralize special elements used in OS commands . This vulnerability carries a High base severity...

CVE-2026-90920 Maximo AI Service Code Injection

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation...

CVE-2026-90920

The IBM Maximo AI Service versions 9.1.0 and 9.2.0 are vulnerable to a Code Injection vulnerability (CWE-94). A remote attacker can execute arbitrary code because of improper control over code generation. The vulnerability has a CRITICAL severity score of 9.8, allowing for high impact on confiden...

Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by a vulnerability

Summary The apnotify utility was used by IBM Sterling Connect:Direct for UNIX in asset protection and may be seen in some IBM Connect:Direct for UNIX installation locations that have been upgraded in place since 2017 or earlier. IBM Sterling Connect:Direct for UNIX is impacted by a vulnerability ...

CVE-2026-109275

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path...

DEBIAN-CVE-2026-109275

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path...

UBUNTU-CVE-2026-109275

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path...