CVE-2024-42002: Improper Neutralization of Directives in Dynamically Evaluated Code

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

CVE-2024-42002

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

PT-2026-102382

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

CVE-2026-93348: Improper Control of Generation of Code

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-90926: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117...

PT-2026-99916

Name of the Vulnerable Software and Affected Versions Unsloth Zoo versions 2025.9.9 through 2026.8.13 Unsloth versions 2025.9.9 through 2026.8.19 Description A code injection issue exists in the model-loading compile path. The get transformers model type function in hf utils.py collects model typ...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the ConfigWriter::cleanUpString process. An attacker can execute arbitrary shell commands by injecting specially crafted Liquidsoap string interpolation sequences into playlist URLs or station metadata field...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the remote relay password field due to incomplete migration from the cleanUpString method to toRawString. An attacker can execute arbitrary code in the Liquidsoap process, disclose internal API keys, or...

CVE-2026-100856

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

CVE-2026-100857

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

CVE-2026-100857 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

EUVD-2026-87822

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

CVE-2026-100857

AzuraCast versions prior to 0.23.4 are vulnerable to Remote Code Execution due to a code injection flaw in the ConfigWriter::cleanUpString() method. The root cause is a failure to sanitize Liquidsoap string interpolation sequences. This allows authenticated users with Media or Profile permissions...

CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

CVE-2026-100856

AzuraCast versions prior to 0.23.6 are vulnerable to a code injection vulnerability within the remote relay password field. The root cause is an incomplete migration from the vulnerable cleanUpString method to toRawString. An attacker with RemoteRelays station permission can inject nested Liquids...

EUVD-2026-87821

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

CVE-2026-100857: Improper Control of Generation of Code

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

CVE-2026-100856: Improper Control of Generation of Code

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...