CVE-2026-45579 DIRAC: RCE in RequestManager due to eval on untrusted input

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

CVE-2026-45579 DIRAC: RCE in RequestManager due to eval on untrusted input

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

CVE-2026-45579 DIRAC: RCE in RequestManager due to eval on untrusted input

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

PT-2026-93192

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns wan list show.cgi caused by unsafe eval handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewe...

PT-2026-93198

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qos xianz add cgi, qos xianz show cgi, qos filter add cgi, and qos filter show cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stor...

Malicious code in get-power (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7 get-power impersonates ljharb's get-proto utility package.json declares author 'Jordan Harband ' and homepage github.com/ljharb/get-power while...

OESA-2026-3871 perl-Net-DNS security update

Net :: DNS is a collection of Perl's Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions. Security Fixes: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR...

Astra Linux – Vulnerability in libmodule-scandeps-perl

Qualys discovered that if unsanitized input was used with the Modules::ScanDeps library, before version 1.36, a local attacker could potentially execute arbitrary shell commands by opening a “pesky pipe” e.g., passing “commands|” as a filename or by passing arbitrary strings to the eval function...

Astra Linux – Vulnerability in libio-compress-perl

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. The parseOutputGlob function wraps the output glob string provided by the caller within double quotes and stores it in the parser state. Then, the getFiles function...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An Eval Injection vulnerability (improper neutralization of directives in dynamically evaluated code) exists in CONPROSYS HMI System (CHS) by CONTEC. A low-privilege attacker who can log in to the product may achieve arbitrary code execution , leading to high impact on confidentiality, integrity,...

EUVD-2026-77243

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

PT-2026-91093

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789: Improper Neutralization of Directives in Dynamically Evaluated Code

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-78571

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary code execution via an unguarded eval() call in the lfx CodeParser , which passes return-type annotation source directly to eval without sanitization (CWE-94). A remote authenticated attacker can exploit this to execute arb...

CVE-2026-78571 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

senaite.core Vulnerable to Eval Injection and Missing Authorization

SummaryAn unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

PYSEC-2026-3919 senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...