MAL-2026-2406 Malicious code in @ceeferenderer/fe-renderer-sdk (npm)

Multiple evidences suggest malicious intent: code obfuscation, dynamic code execution, process access, install script, and suspicious email. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feee20bafab758bb648bbe425a100a13e6d21799552a2b5566fe6029faef6ce4 Package...

The vulnerability in the web-based application system for customer support services, technical support, and IT service management, Znuny, arises from the failure to implement measures to neutralize instructions in dynamically executed code. This allows attackers to enhance their privileges and execute arbitrary commands.

The vulnerability in the web-based application system for customer support services, technical support, and IT service management involves a failure to implement measures to neutralize instructions within the dynamically executed code. Exploiting this vulnerability allows an attacker to enhance...

EUVD-2022-45960

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2019-11201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor al...

The vulnerability of the Migration Page Template component of the XWiki Confluence Migrator Pro tool allows a perpetrator to execute arbitrary code.

The vulnerability of the Migration Page Template component of the XWiki Confluence Migrator Pro tool is related to the failure to implement measures to neutralize instructions in the dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remote...

CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-6101

CVE-2025-6101 affects the letta-ai letta project up to version 0.4.1. The vulnerable component is the function_message logic in the file letta/letta/interface.py, where manipulation of the arguments function_name/function_args enables improper neutralization of directives in dynamically evaluated...

CVE-2022-42902

In Linaro Automated Validation Architecture LAVA before 2022.10, there is dynamic code execution in lavaserver/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server...

Dynamic Variable Evaluation

Overview composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Dynamic Variable Evaluation through the eval function in the mathematicalcalculator endpoint. An attacker can execute arbitrary code by...

PT-2024-8549

Name of the Vulnerable Software and Affected Versions Chamilo LMS affected versions not specified Description The issue is related to the lack of measures to neutralize instructions in dynamically executed code in the Chamilo LMS electronic learning and content management system. Exploitation of...

The vulnerability of the Node.js software library OpenVPN Connect allows a hacker to execute arbitrary code.

The vulnerability of the Node.js software product OpenVPN Connect relates to the lack of measures to neutralize instructions in the dynamically executed code. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the OpenVPN Connect software lies in its inability to properly execute instructions in the dynamically executed code, allowing a violator to execute arbitrary code.

The vulnerability of the OpenVPN Connect software is related to the failure to implement measures to neutralize the instructions in the dynamically executed code. Exploiting this vulnerability can allow an attacker to execute arbitrary code using the DYILDINSERTLIBRARIES environment variable...

PT-2024-1066 · Openvpn · Openvpn Connect

Name of the Vulnerable Software and Affected Versions: OpenVPN Connect versions 3.0 through 3.4.6 Description: The issue is related to the failure to neutralize instructions in dynamically executed code. Exploitation of this issue may allow an attacker to execute arbitrary code using the DYLD...

The vulnerability of the XWikiSkins class in the XWiki Platform, a platform for creating collaborative web applications, allows attackers to gain access to read, modify, or delete data.

The vulnerability of the SkinsCode.XWikiSkinsSheet method implemented in the XWikiSkins class of the XWiki Platform for creating collaborative web applications is related to the failure to neutralize instructions in the dynamically executed code when processing documents from the /SkinsCode...

PT-2023-4812

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 12.9-rc-1 through 14.4.7 XWiki Platform versions 14.10.0 through 14.10.5 XWiki Platform versions 15.0.0 through 15.0.x Description The issue is related to the XWiki Platform's failure to neutralize instructions in...

Debian dla-3192 : lava - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3192 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3192-1 [email protected] https://www.debian.org/lts/security/...

Debian DSA-5260-1 : lava - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5260 advisory. - In Linaro Automated Validation Architecture LAVA before 2022.10, there is dynamic code execution in lavaserver/lavatable.py. Due to improper input sanitization, an...

CVE-2022-42902

In Linaro Automated Validation Architecture LAVA before 2022.10, there is dynamic code execution in lavaserver/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server...

Input validation

In Linaro Automated Validation Architecture LAVA before 2022.10, there is dynamic code execution in lavaserver/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server...

CVE-2022-42902

CVE-2022-42902 affects Linaro Automated Validation Architecture (LAVA); in versions prior to 2022.10, lava_server/lavatable.py allows remote code execution due to improper input sanitization, enabling an anonymous user to cause lava-server-gunicorn to run user-provided code. Debian advisories (DL...