EUVD-2026-74069

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code...

CVE-2026-76190 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of...

CVE-2026-48273 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code...

Malicious code in punypump (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...

CVE-2026-76190: Improper Neutralization of Directives in Dynamically Evaluated Code

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of...

PT-2026-88296

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code...

EulerOS 2.0 SP12 : perl-IO-Compress (EulerOS-SA-2026-3370)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

CVE-2026-48273: Improper Neutralization of Directives in Dynamically Evaluated Code

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code...

PT-2026-88311

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of...

PT-2026-88427

Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description The management console passes user-supplied input to the eval function without proper sanitization during an authenticated administrator SSH session. This allows the unsanitized...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

DEBIAN-CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678 Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

EUVD-2026-72357

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw in FreeIPA 's idp-add command allows insufficiently validated --organization/--base-url input to reach a constrained eval() call before the corresponding LDAP access control check is enforced. Any authenticated IPA principal, regardless of privilege level, can enumerate and read environmen...

CVE-2026-79678 Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

Linux Distros Unpatched Vulnerability : CVE-2026-79678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the...

OESA-2026-3628 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

CVE-2026-85694

LaVague 0.2.35 is vulnerable to remote code execution via its PythonFromMarkdownExtractor.extract_as_object function, which uses eval on untrusted language model output derived from web page content. An attacker can perform indirect prompt injection through a web page to inject malicious Python c...