CVE-2026-85040: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

Fedora 45 : dracut (2026-5bf73fe397)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5bf73fe397 advisory. - fixdevicetree-firmware: include soc specific firmwares in installgeneric - fixdevicetree-firmware: include Qualcomm X2 laptop model specific firmwares -...

Exploit for Eval Injection in Langflow

Description Usage python3 poc.py -u -c Without...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65643

cPanel & WHM versions prior to 11.138.0.2 (and older branches 11.110, 11.134, 11.136) contain an eval injection in the domain parking and addon domain functionality. An authenticated user with permission to add parked or addon domains can create arbitrary files on the server, escalating to code e...

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

EUVD-2026-68922

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-51974

The lllyasviel Fooocus software (versions 2.1.854 through 2.5.5) is vulnerable to an eval() injection vulnerability within the get_list function located in modules/meta_parser.py. A remote attacker can exploit this by providing a crafted styles payload embedded in the EXIF metadata of an uploaded...

EUVD-2026-69416

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

PT-2026-84361

An eval injection vulnerability in the get list function in modules/meta parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-51974: Improper Control of Generation of Code

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-65643: Improper Neutralization of Directives in Dynamically Evaluated Code

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

Malicious code in tailwind-minanimated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2 src/index.js appends a hidden payload after 9KB of whitespace padding that decodes and runs via evalatob... whenever the package is required the READ...

MAL-2026-15634 Malicious code in tailwind-minanimated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2 src/index.js appends a hidden payload after 9KB of whitespace padding that decodes and runs via evalatob... whenever the package is required the READ...

MAL-2026-15635 Malicious code in tailwind-modernanimation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin...