CVE-2026-38812

RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information...

The vulnerability of the Safe Browsing service in Google Chrome and Microsoft Edge allows a hacker to execute arbitrary code.

The vulnerability of the Safe Browsing service in Google Chrome and Microsoft Edge is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a malicious file...

PT-2026-49586

Name of the Vulnerable Software and Affected Versions protobufjs-cli versions prior to 1.3.2 protobufjs-cli versions prior to 2.5.0 Description An incomplete fix for unsafe name handling in pbjs static and static-module code generation allows the emission of unsafe JavaScript references when...

CVE-2026-38812

RuoYi v4.8.2 is vulnerable to SQL Injection within the code generation module , specifically via the /tool/gen/createTable endpoint. This vulnerability allows an authenticated attacker with administrative privileges to potentially access sensitive database information . No information regarding a...

Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Code

Large Language Models LLMs are increasingly used for code generation, raising concerns that they may be misused to produce malicious code. Meanwhile, Grammar-Constrained Decoding GCD has been widely adopted to improve the reliability of LLM-generated code by enforcing syntactic validity. In this...

The vulnerability of QStar Archive Solutions’ software for working with archives lies in improper code generation management, allowing attackers to execute arbitrary code.

The vulnerability of the software for working with QStar Archive Solutions is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the administrative interface of the Java Lucee virtual machine allows a perpetrator to execute arbitrary code.

The vulnerability of the administrative interface of the Java Lucee virtual machine’s scripting language is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260609-73-0008

The vulnerability of the SQL Expressions function on the Grafana monitoring and observation platform is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to the platform by sending speciall...

PT-2026-47432

Name of the Vulnerable Software and Affected Versions AgentCore CLI versions prior to 0.14.2 Description Improper neutralization of triple-quote characters during Python code generation allows an authenticated remote actor to execute arbitrary code. This occurs when a crafted...

CVE-2026-11393: Improper Control of Generation of Code

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of anothe...

CVE-2026-3120

Improper Control of Generation of Code 'Code Injection' vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection. This issue affects SambaBox: from 5.1 before 5.3...

CVE-2026-44295

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum,...

RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks

Reasoning-capable large language models can be induced to spend their generation budget on injected decoy tasks rather than answering the user's question, causing denial of service when no final answer is produced and denial of wallet when excess output tokens are billed. Input-side safety...

The vulnerability in the KeyguardViewMediator.java class of Android operating systems allows a hacker to disclose protected information.

The vulnerability in the KeyguardViewMediator.java class of Android operating systems is related to incorrect code generation management. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by the system’s security measures...

CVE-2026-10176

A weakness has been identified in Aider-AI Aider 0.86.3. Affected by this issue is some unknown functionality of the component Code Generation Workflow. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and...

Learn from Your Mistakes: Tree-Like Self-Play for Secure Code LLMs

While Large Language Models LLMs excel in code generation, they remain prone to replicating subtle yet critical vulnerabilities endemic to their training data. Current alignment techniques, such as Supervised Fine-Tuning SFT and Reinforcement Learning RL, typically apply coarse-grained optimizati...

The vulnerability of the approvalLevelForDomainInternal method in the DomainVerificationService.java class of the Android operating system framework allows a hacker to increase their privileges.

The vulnerability of the approvalLevelForDomainInternal method in the DomainVerificationService.java class of the Android operating system framework component is related to incorrect code generation management. Exploiting this vulnerability could allow an attacker to enhance their privileges...

The vulnerability of Android operating systems, related to improper handling of code generation, allows attackers to increase their privileges.

The vulnerability of Android operating systems is related to improper handling of code generation. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the bta_jv_rfcomm_connect() function in the bta_jv_act.cc scenario of Android operating systems allows a hacker to increase their privileges.

The vulnerability of the btajvrfcommconnect function in the btajvact.cc scenario of Android operating systems is related to incorrect code generation. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Framework component in Android operating systems, which allows a hacker to increase their privileges

The vulnerability of the Framework component in Android operating systems is related to incorrect code generation management. Exploiting this vulnerability can allow attackers to enhance their privileges...