PT-2026-104374

Name of the Vulnerable Software and Affected Versions AgentScope version 1.0.20 Description Code injection exists in the execute shell command function located in src/agentscope/tool/ coding/ shell.py. Depending on the exposed entry, an attacker can trigger the execution of attacker-controlled co...

CVE-2026-51918

FinRobot 1.0.0 contains code injection in CodingUtils.createfilewithcode...

CVE-2026-51917

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modifycode...

CVE-2026-51911

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

PT-2026-104368

vanna v2.0.2 contains a code injection vulnerability in VannaBase.get plotly figure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51922

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51911

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-10026: Improper Control of Generation of Code

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

PT-2026-104372

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify code...

CVE-2026-51898

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...

EUVD-2026-91705

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...

CVE-2026-51898

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...

PT-2026-104362

Name of the Vulnerable Software and Affected Versions pandas-ai version 3.0.0 Description The software is subject to code injection within the CodeExecutor.execute function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2026-51898: Improper Control of Generation of Code

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...

CVE-2026-51911

The vanna library version v2.0.2 is affected by a code injection vulnerability (CWE-94) located in the VannaBase.get_plotly_figure function within the file src/vanna/legacy/base/base.py. Due to this flaw, an attacker can trigger attacker-controlled code or command execution depending on the expos...

CVE-2026-51918

The software FinRobot 1.0.0 is vulnerable to a code injection flaw within the CodingUtils.create_file_with_code() function. This vulnerability is associated with CWE-94 (Improper Control of Generation of Code). The impact is classified as CRITICAL with a CVSS 3.1 score of 9.8 , indicating high se...

CVE-2026-51917

FinRobot v1.0.0 is vulnerable to a Code Injection vulnerability within the CodingUtils.modify_code component. The vulnerability is associated with CWE-94 (Improper Control of Generation of Code). The base severity is rated as HIGH (7.3) with an attack vector of NETWORK and low attack complexity. ...

PT-2026-104075

Name of the Vulnerable Software and Affected Versions CTX Feed Pro versions prior to 7.6.13 Description Insufficient input validation on the 'Feed Config' field allows authenticated attackers with Administrator-level access and above to execute arbitrary PHP code on the server. This occurs becaus...

CVE-2026-51918: Improper Control of Generation of Code

FinRobot 1.0.0 contains code injection in CodingUtils.createfilewithcode...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...