Fortinet FortiManager Improper control of generation of code (FG-IR-26-230)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-230 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Fortinet FortiAnalyzer Improper control of generation of code (FG-IR-26-230)

The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-230 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Fortinet FortiManager Improper control of generation of code in GUI (FG-IR-26-227)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-227 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

PT-2026-144896

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 8.0.0 through 8.0.1 FortiAnalyzer versions 7.6.0 through 7.6.7 FortiAnalyzer versions 7.4.0 through 7.4.11 FortiAnalyzer version 7.2 FortiAnalyzer Cloud version 8.0.1 FortiAnalyzer Cloud versions 7.6.0 through 7.6.7...

CVE-2026-17359

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution...

CVE-2026-17342

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-17140

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution...

EUVD-2026-118744

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution...

CVE-2026-17359

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities that allow a remote authenticated attacker to achieve arbitrary code execution . The root cause is identified as improper control of generation of code , where a user-supplie...

CVE-2026-17359 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution...

EUVD-2026-118733

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-17342 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-17140 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution...

EUVD-2026-118640

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution...

CVE-2026-17140

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to arbitrary code execution. The root cause is improper control of generation of code (CWE-94), where user-supplied input can influence the code generated by the product. This allows a remote authenti...

PT-2026-139105

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 10.0.8.0 through 10.0.8.12 IBM API Connect versions 12.1.0.0 through 12.1.1.2 Description A remote authenticated attacker can execute arbitrary code due to improper control of code generation. This occurs because a...

PT-2026-139001

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 10.0.8.0 through 10.0.8.12 IBM API Connect versions 12.1.0.0 through 12.1.1.2 Description A remote authenticated attacker can execute arbitrary code due to improper control of code generation. This occurs because...

PT-2026-139094

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 10.0.8.0 through 10.0.8.12 IBM API Connect versions 12.1.0.0 through 12.1.1.2 Description Remote authenticated attackers can execute arbitrary code due to improper control of code generation. This allows authenticated...

CVE-2026-103965: Improper Control of Generation of Code

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...

CVE-2026-55675: Improper Control of Generation of Code

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...