EUVD-2026-49567

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

The vulnerability of the SVG component in Google Chrome browser allows attackers to execute arbitrary code.

The vulnerability of the SVG component in Google Chrome browser is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

The vulnerability of the approvalLevelForDomainInternal method in the DomainVerificationService.java class of the Android operating system framework allows a hacker to increase their privileges.

The vulnerability of the approvalLevelForDomainInternal method in the DomainVerificationService.java class of the Android operating system framework component is related to incorrect code generation management. Exploiting this vulnerability could allow an attacker to enhance their privileges...

CVE-2026-42898

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

The vulnerability of the VoIP gateway software Telecom MG, related to improper code generation, allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the VoIP gateway software of Telecom MG is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

The vulnerability of the corporate messaging system Squadus, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the corporate messaging system Squadus is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Gardener-extension-provider extension controller, related to improper code generation, allows a malicious actor to execute arbitrary code.

The vulnerability of the Gardener-extension-provider extension controller is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

MiracleLinux 9 : firefox-102.9.0-3.el9.ML.1 (AXSA:2023-5234:12)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5234:12 advisory. Mozilla: Incorrect code generation during JIT compilation CVE-2023-25751 Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9...

CVE-2025-11837 Malware Remover

An improper control of generation of code vulnerability has been reported to affect Malware Remover. The remote attackers can then exploit the vulnerability to bypass protection mechanism. We have already fixed the vulnerability in the following version: Malware Remover 6.6.8.20251023 and later...

The vulnerability of the has_metacommands() function in the pgAdmin 4 database management tool allows a hacker to bypass existing security mechanisms.

The vulnerability of the hasmetacommands function in the pgAdmin 4 database management tool is related to improper code generation. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms by introducing specially crafted SQL files...

The vulnerability of the astra-safepolicy security configuration software, related to improper code generation, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the astra-safepolicy security configuration software is related to improper code generation management. Exploiting this vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the Longwatch video surveillance and monitoring system lies in improper code generation. This allows intruders to enhance their privileges and execute arbitrary codes.

The vulnerability of the Longwatch video surveillance and monitoring system is related to incorrect code generation. Exploiting this vulnerability can allow a remote attacker to enhance their privileges and execute arbitrary code by sending specially crafted GET requests...

The vulnerability of the NVIDIA Isaac GR00T development platform for universal humanoid robots, related to improper code generation management, allows attackers to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the NVIDIA Isaac GR00T platform for developing universal humanoid robots is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, enhance their privileges, and gain unauthorized access to protected...

The vulnerability of the pgAdmin 4 database management tool, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the pgAdmin 4 database management tool is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code during data restoration from PLAIN files...

PT-2025-43243

Name of the Vulnerable Software and Affected Versions WP Last Modified Info versions through 1.9.2 Description A flaw exists in WP Last Modified Info that allows for Remote Code Inclusion due to improper control of code generation. This issue allows an attacker to inject code remotely...

The vulnerability of Websoft HCM’s automation software for HR processes allows a perpetrator to execute arbitrary code.

The vulnerability of Websoft HCM’s automation software for HR processes is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EUVD-2025-26057

Malicious code in bioql PyPI...

The vulnerability of the Fresh Framework plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the Fresh Framework plugin for WordPress content management systems is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the sys_exec() function in the MariaDB database management system allows a attacker to execute arbitrary commands with elevated privileges.

The vulnerability of the sysexec function in the MariaDB database management system is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary commands with elevated privileges...

The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory allows a hacker to inject arbitrary PHP code.

The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...