Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is required to exploit this vulnerability. The specific flaw exists within the run method of the CSVAgents class. The issue results from the lack of proper validation of a...

Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run method of the AirtableAgents class. The issue results from the lack of proper validation...

Joomla Fabrik 4.6.6 Remote Code Execution

A proof of concept exploit for an unauthenticated remote code execution vulnerability in Fabrik version 4.6.6. The vulnerability exists in the Joomla Fabrik component's calc element, where attacker-controlled request values can be substituted directly into a site-defined formula that is...

Langflow < 1.3.0 Unauthenticated Code Injection RCE (CVE-2025-3248) (Direct Check)

Binary data langflowvalidatecodercecve20253248.nbin...

CVE-2026-18942

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18942 Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18942

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

EUVD-2026-55816

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18942

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

Exploit for Code Injection in Pgadmin Pgadmin_4

No d...

Exploit for Code Injection in Pgadmin Pgadmin_4

No d...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

UBUNTU-CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP prior to 4.4.18 on SQLite-backed installations contains a code injection vulnerability in the navigation endpoint. The endpoint mishandles array-typed user input, bypasses input sanitization, and can break out of a PHP-quoted string context, enabling an authenticated attacker (minimum editor...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

EUVD-2026-55655

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...