CVE-2025-71408

A flaw was found in NLTK Natural Language Toolkit. This eval injection vulnerability in the nltk.collocations module allows a local attacker to execute arbitrary Python code. By manipulating command-line arguments when collocations.py is invoked directly, an attacker can bypass validation and...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

EUVD-2026-68922

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65643

cPanel & WHM versions prior to 11.138.0.2 (and older branches 11.110, 11.134, 11.136) contain an eval injection in the domain parking and addon domain functionality. An authenticated user with permission to add parked or addon domains can create arbitrary files on the server, escalating to code e...

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

EUVD-2026-69416

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-51974

CVE-2026-51974 is an eval() injection vulnerability in the get_list function of modules/meta_parser.py in lllyasviel Fooocus versions 2.1.854 through 2.5.5 . A remote attacker with low privileges can craft a "styles" payload in the EXIF metadata of an uploaded image file, causing the application ...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-82244

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...

VulnCheck KEV: CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

GHSA-JRW6-7X4Q-W25J senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

CVE-2026-54569 SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

EUVD-2026-66596

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-54569 SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-54569

SENAITE.CORE (versions 2.0.0–2.6.0), the core framework for the SENAITE laboratory information management system, permits unauthenticated remote code execution through a two-request chain. State-changing JSON API routes in update.py fail to enforce the senaite.core: Access JSON API permission bef...

CVE-2026-75062

Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...

CVE-2026-75062 Eval Injection in google/langfun via default lf.query protocol

Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...