Kiteworks Email Protection Gateway versions before 9.5.0 contain a vulnerability that allows an authenticated administrator to import configuration files without sufficient validation. This flaw can lead to remote code execution on the affected gateway by processing crafted submissions. The vulnerability is identified as CWE-22 (Path Traversal) and CWE-94 (Improper Control of Generation of Code).
Kobako is a Ruby gem embedding a Wasm-isolated mruby interpreter to safely execute untrusted Ruby scripts. Versions from 0.1.0 up to but not including 0.9.1 contain a vulnerability allowing guest scripts to escape the sandbox and execute arbitrary Ruby code in the host process. This vulnerability is identified as CVE-2026-55107 and has been patched in version 0.9.1.
CVE-2026-86131 is a critical code injection vulnerability in WatchGuard Fireware OS affecting the BOVPN Over TLS client configuration. An attacker controlling the remote VPN server can exploit this flaw to execute arbitrary commands with root privileges on the connecting Firebox device. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high-severity CVSS score of 9.2 reflects the potential impact of remote, unauthenticated exploitation without user interaction. Fixed versions have been released by WatchGuard.
CVE-2026-102425 is a critical remote code execution vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The vulnerability arises from improper control of code generation (CWE-94) due to the way administrator-defined PHP code executes after public form submissions. Specifically, the extension replaces form-field shortcodes with user-submitted values inside a double-quoted PHP string before calling eval(), enabling attackers to inject and execute arbitrary PHP code. Exploitation requires the use of the optional PHP-after-submission feature with an attacker-controlled shortcode. The vulnerability has a CVSS 4.0 score of 9.5, indicating critical severity. No official patch or vendor advisory is provided in the data, and no known exploits in the wild have been reported.
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
CVE-2024-42002 is a code injection vulnerability in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool. It affects all ROS 2 distributions from Crystal Clemmys through Lyrical Luth and Rolling Ridley. The flaw exists in the 'hz' verb, which uses the --filter option to accept a user-supplied Python expression that is passed unsanitized to the eval() function. This allows a local user to execute arbitrary code. The vulnerability has a high severity score of 8.6 (CVSS 4.0). No patch or official remediation information is provided in the available data.
FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7.
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection.
This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.
CVE-2026-81655 is a high-severity vulnerability in the Ad Inserter WordPress plugin versions 2.8.12 through 2.8.18. It allows users with as low a privilege as subscriber to access a settings page and inject code that can be executed as PHP or served unescaped to visitors. This occurs due to improper access control and lack of content filtering on the affected settings page.
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). ACPI tables containing AML bytecode are passed from the untrusted host (QEMU) to the guest firmware (OVMF) and on to the Linux kernel, whose AML interpreter executes them. An attacker controlling the host — an assumed adversary in Contrast's threat model — can craft a table with malicious, Turing-complete AML bytecode that the guest kernel interprets with access to the full guest memory, including private pages, resulting in arbitrary code execution and disclosure or modification of confidential guest data. The issue affects the AMD SEV-SNP platforms Metal-QEMU-SNP and Metal-QEMU-SNP-GPU; Metal-QEMU-TDX is not affected because ACPI table contents are measured into RTMR 0 by OVMF on Intel TDX. Version v1.18.0 mitigates the attack by sandboxing the kernel AML interpreter so that it cannot read or write private memory pages. This weakness is not specific to Contrast but is generic to Confidential Computing setups that expose the ACPI interface to the host.
CVE-2026-97160 is a critical code injection vulnerability in the lomart.fr UP plugin for Joomla. It allows authenticated users with high privileges to inject and execute arbitrary PHP code. The flaw affects versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29 of the plugin. The vulnerability is classified as CWE-94 and has a CVSS 4.0 score of 9.4, indicating a severe security risk.
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.
Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.
CVE-2026-100174 is a stored cross-site scripting (XSS) vulnerability in the AIL Framework's tag selector component. An authenticated user with permission to create custom tags can embed malicious JavaScript in a tag name. When another authenticated user views a page with the malicious tag, the script executes in their browser. This occurs because the tag name is inserted as raw HTML via jQuery's html property without proper sanitization. Exploitation can lead to arbitrary script execution within the application's origin, risking session hijacking and unauthorized data access.
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.