← Back to feed Search feed

CWE-94 Code Injection vulnerabilities

86 CVEs — updated 2026-11-03 · vulnfeed

CVE / IDTitleSeverityCVSSEPSSSourceDate
CVE-2026-61564AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.pCRITICAL10.045%ileNVD2026-10-28
CVE-2026-61991Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.CRITICAL10.055%ileNVD2026-10-29
CVE-2026-120338Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno CRITICAL10.056%ileNVD2026-11-01
CVE-2026-104351Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability tCRITICAL9.947%ileNVD2026-10-27
CVE-2026-107328IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improCRITICAL9.958%ileNVD2026-10-29
CVE-2026-107329IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improCRITICAL9.958%ileNVD2026-10-29
CVE-2026-62853ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-sCRITICAL9.935%ileNVD2026-10-30
CVE-2026-78845Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light BCRITICAL9.856%ileNVD2026-10-27
CVE-2026-116692MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.CRITICAL9.853%ileNVD2026-10-27
CVE-2026-104339IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralizaCRITICAL9.855%ileNVD2026-10-29
CVE-2026-110186IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control ofCRITICAL9.850%ileNVD2026-10-29
CVE-2026-86596The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927CRITICAL9.8—NVD2026-11-02
CVE-2026-35002Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`CRITICAL9.858%ileGitHub2026-10-27
CVE-2026-48360Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could resulCRITICAL9.639%ileNVD2026-10-27
CVE-2026-104383Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premiseCRITICAL9.430%ileNVD2026-10-28
CVE-2026-119716pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that alloCRITICAL9.331%ileNVD2026-10-30
CVE-2026-58256GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an adminisCRITICAL9.147%ileNVD2026-10-27
CVE-2026-67074HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the prCRITICAL9.140%ileNVD2026-10-28
CVE-2026-116852Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.CRITICAL9.148%ileNVD2026-10-30
CVE-2026-61707SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76,CRITICAL9.014%ileNVD2026-10-29
CVE-2026-102802Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles AHIGH8.9—NVD2026-11-02
CVE-2026-101288IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improHIGH8.853%ileNVD2026-10-29
CVE-2026-104328IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improHIGH8.853%ileNVD2026-10-29
CVE-2026-110193IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to causeHIGH8.856%ileNVD2026-10-29
CVE-2026-110309IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to iHIGH8.848%ileNVD2026-10-29
CVE-2026-63378TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural languageHIGH8.830%ileNVD2026-10-30
CVE-2026-116086A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information HIGH8.824%ileNVD2026-10-31
CVE-2026-14380DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced ProfileHIGH8.843%ileMicrosoft2026-07-14
CVE-2026-119028oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplHIGH8.736%ileNVD2026-10-29
CVE-2026-120203ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users HIGH8.729%ileNVD2026-10-31
CVE-2026-118683MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a HIGH8.642%ileNVD2026-10-28
CVE-2026-62284OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfiHIGH8.643%ileNVD2026-10-30
CVE-2026-63344Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in theHIGH8.629%ileNVD2026-10-30
CVE-2026-63345Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object kHIGH8.629%ileNVD2026-10-30
CVE-2026-63346Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter namHIGH8.629%ileNVD2026-10-30
CVE-2026-105600Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5HIGH8.6—NVD2026-11-02
CVE-2026-116964A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within theHIGH8.427%ileNVD2026-10-31
CVE-2026-118614Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attacHIGH7.810%ileNVD2026-10-28
CVE-2026-118616Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers tHIGH7.810%ileNVD2026-10-28
CVE-2026-118618Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers tHIGH7.813%ileNVD2026-10-28
CVE-2026-51831An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a HIGH7.85%ileNVD2026-10-29
CVE-2026-51832An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a HIGH7.85%ileNVD2026-10-29
CVE-2026-55895Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filenameHIGH7.813%ileMicrosoft2026-06-09
CVE-2026-119027oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplHIGH7.734%ileNVD2026-10-29
CVE-2026-106189Chromium CVE-2026-106189: Code injectionHIGH7.322%ileMicrosoft2026-10-13
CVE-2026-54453OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior tHIGH7.238%ileNVD2026-10-28
CVE-2026-115301The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its foHIGH7.236%ileNVD2026-10-29
CVE-2026-118905Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.HIGH7.13%ileNVD2026-10-29
CVE-2026-119714My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticateMEDIUM6.924%ileNVD2026-10-30
CVE-2026-90872Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FMEDIUM6.621%ileNVD2026-10-29
CVE-2026-18894IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component codeMEDIUM6.544%ileNVD2026-10-29
CVE-2026-102905The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in alMEDIUM6.536%ileNVD2026-10-30
CVE-2026-118635The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerableMEDIUM6.538%ileNVD2026-10-30
CVE-2026-100155The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress MEDIUM6.544%ileNVD2026-10-31
CVE-2026-120348A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_MEDIUM5.5—NVD2026-11-02
CVE-2026-120349A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace MEDIUM5.5—NVD2026-11-02
CVE-2026-107259Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code IMEDIUM5.48%ileNVD2026-10-30
CVE-2026-107264Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allMEDIUM5.48%ileNVD2026-10-30
CVE-2026-101326The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress MEDIUM5.431%ileNVD2026-10-31
CVE-2026-106416Chromium CVE-2026-106416: Code injectionMEDIUM5.48%ileMicrosoft2026-10-13
CVE-2026-116402Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureFormMEDIUM5.323%ileNVD2026-10-29
CVE-2026-25467Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User RegistratMEDIUM5.318%ileNVD2026-10-29
CVE-2026-48202Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-bMEDIUM5.321%ileNVD2026-10-29
CVE-2026-119479Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilderMEDIUM5.324%ileNVD2026-10-30
CVE-2026-52710Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT &#821MEDIUM5.323%ileNVD2026-10-30
CVE-2026-62057Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact FMEDIUM5.323%ileNVD2026-10-30
CVE-2026-120274A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of thMEDIUM5.116%ileNVD2026-11-01
CVE-2026-42694Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allowMEDIUM4.37%ileNVD2026-10-29
CVE-2026-91719Chromium CVE-2026-91719: Code injectionMEDIUM4.314%ileMicrosoft2026-09-08
CVE-2026-81472Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iMEDIUM4.26%ileNVD2026-10-28
CVE-2026-116583Seroval: Code injection through a typed array's own constructor propertyMEDIUM—19%ileGitHub2026-10-28
CVE-2026-120339A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code LOW2.1—NVD2026-11-02
CVE-2026-120343A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the filLOW2.1—NVD2026-11-02
CVE-2026-120597A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_LOW2.1—NVD2026-11-02
CVE-2026-116639A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd2LOW2.010%ileNVD2026-10-27
CVE-2026-116640A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8LOW2.010%ileNVD2026-10-27
CVE-2026-118585A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79adLOW2.010%ileNVD2026-10-29
CVE-2026-120190A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functioLOW2.033%ileNVD2026-11-01
CVE-2026-120218A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of thLOW2.017%ileNVD2026-11-01
CVE-2026-117526A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of LOW1.94%ileNVD2026-10-27
CVE-2026-120242A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1LOW1.910%ileNVD2026-11-01
CVE-2026-73453Security Advisory 0174UNKNOWN—53%ileArista2026-09-09
CVE-2026-73464Security Advisory 0166UNKNOWN—51%ileArista2026-09-09
CVE-2026-79249Chromium: CVE-2026-79249 Code injection in BisectionUNKNOWN—14%ileMicrosoft2026-08-11
CVE-2026-47162Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory nameUNKNOWN—20%ileMicrosoft2026-06-09
CVE-2026-47167Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regexUNKNOWN—3%ileMicrosoft2026-06-09