CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation ...

CVE-2026-92464

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92464 Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92464

Adobe Commerce is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to arbitrary code execution in the context of the current user. An attacker with high privileges can exploit this issue without user interaction. No specific affected versions, root cause components,...

CVE-2026-92909 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

EUVD-2026-99212

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-92909

Adobe Commerce is affected by an Incorrect Authorization vulnerability (CWE-863 ) that could lead to arbitrary code execution in the context of the current user. An attacker could exploit this issue without requiring any user interaction. While the vulnerability details are provided, no specific ...

rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

WordPress JTL-Connector for WooCommerce plugin <= 2.4.3 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Supakiad S. m3ez in WordPress Plugin JTL-Connector for WooCommerce versions = 2.4.3...

CVE-2026-108384 dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-108384

The dataclasses-avroschema library (versions 0.38.0 through 0.70.5 ) contains a code injection vulnerability in the BaseGenerator.parse_fixed function. The root cause is the direct interpolation of a fixed type's aliases value into a generated types.confixed annotation. While lists are correctly ...

CVE-2026-92892 Potential command execution on the host running JFrog CLI.

Potential arbitrary code execution, under specific configurations...

CVE-2026-92892

The JFrog CLI is vulnerable to potential arbitrary code execution on the host machine under specific configurations. The root cause is identified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command), leading to argument injection . The vulnerability has a CRITICAL CVSS v3.1 sco...

EUVD-2026-98979

Potential arbitrary code execution, under specific configurations...

CVE-2026-92892 Potential command execution on the host running JFrog CLI.

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later...

CVE-2026-92892

Potential arbitrary code execution, under specific configurations...

CVE-2026-108381

The dataclasses-avroschema library (versions 0.44.0 through 0.70.5 ) is vulnerable to code injection within its Pydantic and AvroDantic model generators. The vulnerability occurs because the library inserts a schema field's pydantic-class value into a generated field annotation without safely res...

CVE-2026-108380 dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.addfieldproperties inserts a schema field's doc value between the quotes of a...

CVE-2026-108380

The dataclasses-avroschema library (versions 0.65.9 through 0.70.5 ) is vulnerable to code injection via the PydanticFieldRepresentation.add_field_properties function. The root cause is the failure to escape a schema field's doc value when inserting it into a generated pydantic.Field description ...

CVE-2026-108379 dataclasses-avroschema fixed namespaces allow code injection in generated annotations

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed inserts a fixed type's namespace value between quotes inside a generated types.confix...