ROS-20260908-73-0086

The vulnerability of the Safe Browsing service in Google Chrome and Microsoft Edge is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a malicious file...

libtiff Process Command Code Execution

The vulnerability of the processcommandopts function in the libtiff library is related to improper code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Online Store Application Code Execution

The vulnerability of the application software interface of programming platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to the lack of measures taken to neutralize special elements in the template creation mechanism...

Palo Alto Networks GlobalProtect App PLAP Code Execution

The vulnerability of the Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect App, which enables secure remote access to data, is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with SYSTEM privilege...

Linux kernel BPF Tracing Buffer Overflow DoS

The vulnerability of the bpftracingprogattach function in the kernel/bpf/syscall.c module, which supports the BPF interpreter for Linux kernels, is related to incorrect code generation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

WatchMan-Site7 Plugin Code Execution

The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GHSA-FG9P-MRXR-HVQ7 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation

Retrieval-Augmented Code Generation RACG improves LLM-based software development by retrieving external code artifacts, documentation, and patches, and incorporating them into the generation context. This reliance on external knowledge introduces a critical trust boundary: poisoned artifacts can...

SPIP analyse_resultat_skel() Code Execution

The vulnerability of the analyseresultatskel function in the SPIP content management system is related to improper handling of code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Google Chrome V8 DoS

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to improper code generation. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to improper code generation. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

EUVD-2026-69130

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

PT-2026-84218

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

Headless web browsers DoS

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge is related to improper code generation. Exploiting this vulnerability can allow a malicious actor to trigger a service failure through a specially created HTML page...

Google Chrome Data Compromise

The vulnerability of the Accessibility component in Google Chrome and Microsoft Edge is related to improper code generation. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise data integrity...

EUVD-2026-67952

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-18729

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-18729

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

EUVD-2026-66418

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-18729 Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...