CWE-94: Code Injection vulnerabilities

A vulnerability in Sentry Seer allows attacker-controlled input submitted via a public telemetry endpoint to be executed in a privileged coding-agent environment. This occurs when Seer is configured to automatically hand off issues to a coding agent for remediation. Malicious event data can propagate through Seer's analysis pipeline and cause the coding agent to execute attacker-controlled code before any human review. No vendor patch is currently available.

CVE-2026-73170 is a high-severity vulnerability in Advantech EKI-1242IEIMS firmware version V1.06.01. It involves improper control of code generation (CWE-94) in the Modbus CSV import workflow, allowing a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.

CVE-2026-73166 is a high-severity code injection vulnerability (CWE-94) in the web management interface of the Advantech EKI-1242IEIMS device. It affects firmware version V1.06.01 and earlier. A remote authenticated attacker can exploit this flaw to execute arbitrary code, including OS commands with root privileges on the device.

CVE-2026-73453 is a critical vulnerability in Arista Networks EOS involving improper control of code generation (CWE-94). An unauthenticated attacker can exploit the P4Runtime feature, if enabled, to execute arbitrary code and gain full administrative control of the affected switch. P4Runtime is disabled by default. No known exploitation in the wild has been reported. The vulnerability affects multiple versions of Arista EOS from before 4.29.2F up to 4.36.1F.

CVE-2026-73464 is a high-severity vulnerability in Arista Networks EOS affecting versions from 4.29.0F up to and including 4.36.0.1F. It involves improper control of code generation (CWE-94) in the gRPC Network Management Interface (gNMI). An authenticated client with gNMI access could send a specially crafted request to execute arbitrary code with root privileges on the switch.

CVE-2026-76551 is a high-severity vulnerability in the WP Import Export Lite WordPress plugin before version 3.9.33. It allows users with export permissions to invoke arbitrary PHP functions on exported field values, leading to remote code execution. This occurs because the plugin does not restrict which PHP functions can be applied to exported data. The vulnerability requires high privileges and no user interaction. No official patch information is provided in the input data.

CVE-2026-76550 is a vulnerability in the WP Import Export Lite WordPress plugin versions before 3.9.34. It allows users with export permissions to write files with arbitrary names to arbitrary locations on the server due to improper validation of user-supplied output paths. This can lead to remote code execution on the affected server.

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

OpenAM versions prior to 16.1.2 contain a critical code injection vulnerability in the pre-authentication /authservice PLL endpoint. This endpoint accepts a CustomCallback XML element with a className parameter that allows loading and instantiating arbitrary Java classes without verifying interface implementation. The default configuration exposes this endpoint without authentication, enabling attackers to execute arbitrary code on the server. The vulnerability is fixed in version 16.1.2.

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - Conditional Content Pro accepts inline PHP Condition Rules in article syntax. In affected versions, the PHP is passed to the Conditions evaluator without checking who authored the article. Joomla's normal Author text filter preserves the syntax, so publishing the article causes the code to run as the web-server process.

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.