IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.
CVE-2026-88062 is a critical code injection vulnerability in diegosouzapw OmniRoute versions prior to 3.8.49. The vulnerability exists in the POST /api/acp/agents endpoint, which accepts attacker-controlled inputs that can lead to arbitrary code execution in the server container. Authentication controls can be bypassed when requireLogin is false or during initial bootstrap, allowing remote anonymous exploitation. No fixed version is currently available.
CVE-2026-80352 is a critical code injection vulnerability in Apache Camel K affecting versions from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2. It allows an authorized custom resource author to inject arbitrary Kubernetes objects via YAML injection in custom resource configuration, potentially enabling unauthorized resource creation with operator privileges. The issue is fixed in versions 2.9.3, 2.10.2, and 2.11.0.
CVE-2026-19584 is a vulnerability in Rapid7 Velociraptor affecting versions from 0 up to but not including 0.77.2. It involves improper neutralization of special elements in a template engine used during notebook backup restoration. A user with NOTEBOOK_EDITOR permission can inject a VQL query into notebook cell content, which is then evaluated with elevated permissions upon backup restoration.
CVE-2026-41870 is a high severity vulnerability in Apache Nutch versions 1.11 through 1.22 affecting the Nutch REST API. It involves missing authorization controls, leading to risks such as code injection, unsafe reflection, and improper control of dynamically managed code resources. The vulnerability allows unauthorized users with limited privileges to potentially execute harmful actions. Apache Nutch 1.23 removes the vulnerable Nutch Server component, mitigating this issue. Users unable to upgrade should restrict access to trusted users only.
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
CVE-2026-69806 is a high-severity vulnerability in Microsoft .NET 10.0 runtime that allows exposure of sensitive information to unauthorized actors. This flaw enables an authorized attacker with local access to elevate their privileges. The issue affects multiple versions of the .NET runtime prior to fixed releases. Official patches are available to remediate this vulnerability.
Adobe Animate 2023 contains a code injection vulnerability (CWE-94) that allows an attacker with low privileges to execute arbitrary code in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 23.0.16 and 24.0.14. The scope of impact is changed, indicating potential privilege or security boundary changes during exploitation.
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
CVE-2026-78463 is a high-severity code injection vulnerability in the Microsoft Remote Desktop client for Windows Desktop. It allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability affects versions from 1.2.0.0 up to but not including 1.2.7279.0. An official fix is available in version 1.2.7279.0.
CVE-2026-77908 is a code injection vulnerability in Microsoft Dynamics 365 Customer Engagement V9.1 that allows an authorized attacker to execute arbitrary code over a network. The flaw exists due to improper control of code generation. A fix is available in version 9.1.0048.0004.
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization.
The Email Subscribers & Newsletters plugin for WordPress versions up to and including 5.9.27 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before passing it to the do_shortcode function, leading to improper control of code generation (CWE-94). The vulnerability has a medium severity rating with a CVSS score of 6.5.