CWE-94

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@pa

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafte

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variabl

The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xco

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Cont

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows

An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose e

Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas expose

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certa

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated u

IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mut

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker t

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with t

piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run()

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js en

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic As

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 20

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final na

In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `ja

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenti

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a g

NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection.

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile

Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker m

An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to

NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection. A

NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code inj

NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code i

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit

An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. A

An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java compo

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attack

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the