EUVD-2026-84857

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

PT-2026-96764

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $ CMS'site' results in code injection. The attack may be performed fr...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firefox (UTSA-2026-090056)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090056 advisory. By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow...

CVE-2026-88418

CMSimple 5.24 is vulnerable to persistent remote code execution because it ships with CSRF protection disabled by default. This flaw causes csrfProtection() to become a no-op on state-changing admin requests and omits the csrf_token hidden field in admin forms. An unauthenticated attacker can tri...

CVE-2026-88418

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

CVE-2026-95501: Improper Control of Generation of Code

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $CMS'site' results in code injection. The attack may be performed fro...

CVE-2026-78847

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

CVE-2026-94103

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/sitepagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been...

EUVD-2026-83815

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/sitepagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been...

CVE-2026-94103 RooCMS Frontend Rendering site_pagePHP.php eval code injection

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/sitepagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been...

CVE-2026-94103

RooCMS (up to versions 1.2.2 , 1.3.4 , and 1.4RC2 ) is affected by a code injection vulnerability in the eval function within roocms/site_pagePHP.php (Frontend Rendering component). Manipulation of the content argument allows an authenticated remote attacker to inject arbitrary code. The CVSS 3.1...

EulerOS Virtualization 2.10.1 : perl-IO-Compress (EulerOS-SA-2026-3847)

According to the versions of the perl-IO-Compress packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled...

EulerOS Virtualization 2.10.0 : perl-IO-Compress (EulerOS-SA-2026-3881)

According to the versions of the perl-IO-Compress packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled...

PT-2026-96022

Name of the Vulnerable Software and Affected Versions RooCMS versions 1.2.2 and earlier RooCMS versions 1.3.4 and earlier RooCMS versions 1.4RC2 and earlier Description A code injection issue exists in the Frontend Rendering component within the eval function of the roocms/site pagePHP.php file. ...

CVE-2026-94103: Improper Control of Generation of Code

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/sitepagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been...

CVE-2026-78847

All versions of gray-matter (verified on version 4.0.3 ) are vulnerable to arbitrary code execution. The flaw exists in the JavaScript engine located in lib/engines.js , where the application uses eval() to parse front matter when the language is set to js/javascript . While the documents do not ...

VulnCheck KEV: CVE-2026-54569

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

PT-2026-96304

Name of the Vulnerable Software and Affected Versions gray-matter affected versions not specified Description An issue in the JavaScript engine located in lib/engines.js uses the eval function to parse front matter when the language is set to js/javascript, which can lead to arbitrary code...

CVE-2026-78847: Improper Neutralization of Directives in Dynamically Evaluated Code

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

CVE-2026-78847

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...