UBUNTU-CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531

The Smarty template engine, in versions prior to 4.5.8 and 5.x before 5.8.5 , is vulnerable to a PHP Code Injection flaw. The root cause is that the top-level nocache_hash is not restored during extends:/ multi-component template inheritance, leaving it null. This allows an attacker to provide as...

EUVD-2026-93376

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

PT-2026-106762

Name of the Vulnerable Software and Affected Versions openapi-python-client versions prior to 0.29.1 Description The generator fails to safely neutralize malicious content from OpenAPI documents before rendering string, docstring, and f-string contexts in the generated Python code. This allows an...

PT-2026-106721

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CVE-2026-106416: Improper Control of Generation of Code

Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Medium...

PT-2026-106753

Name of the Vulnerable Software and Affected Versions Kiota versions 0.5.0 through 1.34.1 Description Kiota is an OpenAPI based HTTP Client code generator. The Java and PHP documentation-comment sanitizers delete block-comment terminators instead of neutralizing them. This allows overlapping...

PT-2026-107330

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Remote authenticated attackers can execute arbitrary OS commands due to improper neutralization of special elements used in an OS command, a condition known as code injection. This...

CVE-2025-15591: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

Cisco ASA Code Injection (CVE-2024-20485)

A vulnerability in the VPN web server of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this...

CVE-2026-82531: Improper Control of Generation of Code

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

PT-2026-106715

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.8 Smarty versions 5.x prior to 5.8.5 Description A code injection flaw exists during multi-component template inheritance where the top-level nocache hash is not restored and remains null. This allows an attacker t...

PT-2026-107088

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Code injection in Extensions allows a remote attacker to spoof UI elements through the use of a crafted Chrome extension, typically leveraging social engineering to execute the attack...

CVE-2026-106189: Improper Control of Generation of Code

Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

VulnCheck KEV: CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...