CVE-2026-108816 agno-agi agno PythonTools python.py run_python_code code injection

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function runpythoncode of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made...

CVE-2026-108827: Improper Control of Generation of Code

A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zencallfunction of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument usefunction can lead to code injection. The attack can be...

CVE-2026-108816: Improper Control of Generation of Code

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function runpythoncode of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made...

CVE-2026-103535: Improper Control of Generation of Code

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The itemname parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This...

PT-2026-110616

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.1 Description The translation editor contains path traversal and PHP code injection flaws that can be chained to achieve remote code execution. The item name parameter, used to construct the translation file's write path,...

Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Issue Correction: Run dnf update libXrender --releasever 2023.12.20261012 or dnf update...

Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Amazon Linux 2 : libXrender (ALAS-2026-3983)

The version of libXrender installed on the remote host is prior to 0.9.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3983 advisory. A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into...

Amazon Linux 2023 : libXrender, libXrender-devel (ALAS2023-2026-3178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3178 advisory. A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Tenable has extracted the preceding...

CVE-2026-109275: Improper Neutralization of Special Elements in Output Used by a Downstream Component

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path...

PT-2026-110692

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description A code injection issue exists in the MVG decoder when utilizing a PostScript renderer. An attacker can provide a specially crafted MVG file that, during...

PT-2026-110511

Name of the Vulnerable Software and Affected Versions agno-agi agno versions prior to 3.0.7 Description Remote code injection is possible within the PythonTools component in the file python.py. The issue occurs when the code argument passed to the run python code function is manipulated, allowing...

PT-2026-110539

Name of the Vulnerable Software and Affected Versions Zen Cart versions prior to 2.2.3 Description Code injection is possible via the Administrative Module Management component. The issue exists in the zen call function function within the admin/includes/functions/general.php file. A remote...

CVE-2026-109199: Improper Control of Generation of Code

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing t...

TencentOS Server 4: libXrender (TSSA-2026:1085)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1085 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

EulerOS 2.0 SP13 : vim (EulerOS-SA-2026-4204)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt04! or VimCrypt05! method...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2026-4295)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context...

pe_to_shellcode

petoshellcode Convierte un PE para que pueda ser inyectado como un shellcode normal. Al mismo tiempo, el archivo de salida sigue siendo un PE válido. Soporta tanto PEs de 32 como de 64 bits Autores:@hasherezade y @hh86 Objetivo El objetivo de este proyecto es proporcionar la posibilidad de genera...

tplmap

Tplmap Este proyecto ya no recibe mantenimiento. Estaré encantado de fusionar nuevos PRs siempre que no rompan el conjunto de pruebas. Tplmap ayuda en la explotación de vulnerabilidades de Inyección de Código e Inyección de Plantillas del Lado del Servidor SSTI mediante diversas técnicas de escap...

php-jpeg-injector

php-jpeg-injector Inyecta cargas útiles de php en imágenes jpeg. Relacionado con esta publicación. Caso de Uso Tienes una aplicación web que procesa una imagen jpeg a través de la librería gráfica GD de PHP. Descripción Este script inyecta código PHP en una imagen jpeg especificada. La aplicación...