CVE-2026-46633

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string does not escape single quotes when a template name from a % use % tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the...

CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string does not escape single quotes when a template name from a % use % tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the...

CVE-2026-48322

Technical details (affected product/version, root cause specifics, impact, mitigations) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-48322

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...

EUVD-2026-44545

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-48322 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...

CVE-2026-48322 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...

CVE-2026-50650

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

CVE-2026-50650

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

CVE-2026-15410

Post-authentication improper control of generation of code 'Code Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands...

CVE-2026-15410

CVE-2026-15410 affects SonicWall SMA1000 Appliance Management Console (AMC). It is a post-authentication code-injection vulnerability that, under certain conditions, could allow a remote authenticated administrator to execute arbitrary OS commands. Root cause: improper control of generation of co...

CVE-2026-15410

Post-authentication improper control of generation of code 'Code Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands...

CVE-2026-50650

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

MGASA-2026-0252 Updated imagemagick packages fix security vulnerabilities

The updated packages fix numerous security vulnerabilities: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797. CVE-2026-25797 Heap Buffer Underwrite in Floyd-Steinberg depth dithering. CVE-2026-48724 Infinite Loop in subimage-search with crafted image. CVE-2026-48733 Stack...

Updated imagemagick packages fix security vulnerabilities

The updated packages fix numerous security vulnerabilities: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797. CVE-2026-25797 Heap Buffer Underwrite in Floyd-Steinberg depth dithering. CVE-2026-48724 Infinite Loop in subimage-search with crafted image. CVE-2026-48733 Stack...

Security Bulletin: Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Summary The Python Interpreter component and legacy Python REPL Tool component provided flow and agent authors the ability to execute Python code within a scoped globals environment restricted to an operator-configured import allow-list and curated safe builtins. An attacker who could provide inp...

.NET Framework Elevation of Privilege Vulnerability

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

Ivanti EPM Cloud Services Appliance Code Injection

Ivanti EPM Cloud Services Appliance CSA before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions nobody. id: CVE-2021-44529 info: name: Ivanti EPM Cloud Services Appliance Code Injection...

PT-2026-58719

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description Improper control of code generation, known as code injection, allows an unauthorized attacker to elevate privileges locally. This issue enables an attacker who has already established ...

Oracle Linux 9 : vim (ELSA-2026-38511)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38511 advisory. - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete ...