CVE-2026-16881: Undefined Security Weakness

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profi...

PT-2026-67667

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

PT-2026-67806

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description The CSVAgent component interpolates a segment of the csvFile data URI directly into a Python source-code template executed by Pyodide. Because Pyodide is loaded with a default JavaScript bridge to...

PT-2026-67718

Name of the Vulnerable Software and Affected Versions vibesurf-ai VibeSurf versions up to cd6e519d507cdd4d63061300bf60fb176e1f57e0 Description A code injection flaw exists within the Python Validation Handler component, specifically affecting an unknown function in the /code file. This issue allo...

CVE-2026-18770: Improper Control of Generation of Code

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This produc...

CVE-2026-69253: Improper Neutralization of Directives in Dynamically Evaluated Code

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

IBM Langflow Code Injection Vulnerability

Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments...

CVE-2026-65804

Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-61523

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

EUVD-2026-52397

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

CVE-2026-61523

WebsiteBaker CMS before 2.13.10 has a code injection vulnerability in the Droplets editor. Authenticated administrators can submit malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no sanitization. An attacker can save a PHP webshel...

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Blueprint::isSafeDynamicCall process. An attacker can execute arbitrary public static PHP methods with...

Exploit for CVE-2026-63720

CVE-2026-63720: Code Injection in datamodel-code-generator via...

CVE-2026-65804: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

PT-2026-67556

Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-61523: Improper Control of Generation of Code

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

Arbitrary Code Injection

Overview sentence-transformers is a State-of-the-Art Text Embeddings Affected versions of this package are vulnerable to Arbitrary Code Injection through the importmoduleclass function in sentencetransformers/util/misc.py due to a logic flaw that allows the security guard to be bypassed if a loca...

Savon::Model evaluates WSDL operation names as Ruby source

Impact Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to moduleeval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .alloperations class method...