CVE-2026-44959: Improper Control of Generation of Code

A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery...

CVE-2026-54271: Improper Control of Generation of Code

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static outp...

Exploit for Improper Control of Dynamically-Managed Code Resources in N8N

No d...

CVE-2026-5366: Improper Control of Generation of Code

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commitsha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git...

CVE-2026-46851: Improper Control of Generation of Code

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

CVE-2025-69174: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Etude = 1.6 versions...

CVE-2026-39549: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Aperitif = 1.5 versions...

CVE-2025-49403: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress = 3.0.2 versions...

CVE-2025-69167: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Eros = 1.3 versions...

CVE-2026-39590: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Atomlab = 2.4.5 versions...

CVE-2025-69160: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Gita = 1.11 versions...

CVE-2026-40721: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...

CVE-2025-69150: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Medeus = 1.14 versions...

CVE-2026-22338: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in EcoBlue = 1.15 versions...

CVE-2025-69149: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Top Dog = 1.0.5 versions...

CVE-2026-34895: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Softlab Core 1.2.11 versions...

PT-2026-49640

Improper Control of Generation of Code 'Code Injection' vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0...

CVE-2026-5233: Improper Control of Interaction Frequency

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250...

CVE-2026-12207: Improper Control of Resource Identifiers

A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID...

CVE-2026-48017: Improper Control of Generation of Code

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...