CVE-2026-77992 is a critical code injection vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. The flaw involves a heredoc terminator breakout in the calc element and the onUpdateComment endpoint lacking access checks, allowing improper control of code generation.
CVE-2026-76604 is a critical vulnerability in the Fabrik extension for Joomla, versions up to 4.7.3. It allows unauthenticated remote code execution via a PHP form element that improperly executes user-provided code. This vulnerability is classified as CWE-94, indicating improper control of code generation (code injection).
The kk Star Ratings – Rate Post & Collect User Feedbacks WordPress plugin is vulnerable to arbitrary shortcode execution in all versions up to and including 5.4.10.3. This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation of the 'payload' value before running do_shortcode. The issue is classified as CWE-94, indicating improper control of code generation (code injection).
CVE-2026-19221 is a high-severity vulnerability in the Forminator Forms WordPress plugin versions 1.40.0 and prior to 1.57.0.5. It allows any site administrator on a multisite network to execute arbitrary code across the entire network due to improper restriction of a network-wide setting. This vulnerability is classified as CWE-94, indicating improper control of code generation (code injection).
CVE-2026-77415 is a critical code injection vulnerability in the jsonata-js library, a JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 are affected. Crafted JSONata expressions could chain multiple object-integrity weaknesses to execute arbitrary code with the privileges of the host process. The vulnerability allows attackers to manipulate internal functions and access prototype and constructor properties, ultimately enabling code execution. This issue is fixed in versions 1.8.8 and 2.2.1.
CVE-2026-77414 is a critical code injection vulnerability in the jsonata-js library, a JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 contain a flaw in the environment.lookup function where a bypassable hasOwnProperty check allows crafted expressions to access the object prototype and execute arbitrary code via process.getBuiltinModule with child_process. This vulnerability enables attackers to execute code with the privileges of the host process. The issue is fixed in jsonata versions 1.8.8 and 2.2.1.
CVE-2026-77413 is a critical code injection vulnerability in the jsonata-js library, affecting versions prior to 1.8.8 and 2.2.0. The flaw arises from the lookup function in src/functions.js lacking a proper hasOwnProperty check, allowing crafted expressions to access inherited prototype members. This enables an attacker who can supply expressions to execute arbitrary code with the privileges of the host process. The vulnerability is fixed in jsonata versions 1.8.8 and 2.2.0.
CVE-2026-59989 is a critical code injection vulnerability in the Phalcon PHP framework's Volt template engine. In versions 5.15.0 and earlier, the resolveFilter function improperly inserts raw input into generated PHP code without proper sanitization, allowing an attacker who can control Volt template source to inject and execute arbitrary PHP code. This issue is fixed in version 5.16.0.
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.
CVE-2026-62674 is a critical code injection vulnerability in the omnigent-ai omnigent framework prior to version 0.3.0. It allows an authenticated user with edit access to a session to replace a shared agent bundle lacking a session ID and inject attacker-controlled commands. These commands execute with the permissions of the Omnigent runner process, potentially exposing sensitive files, credentials, workspace data, internal services, and affecting runner availability. The issue is fixed in version 0.3.0.
CVE-2026-18781 is a high severity vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before version 1.3.9.9. It allows unauthenticated users to bypass file type restrictions due to improper validation of uploaded file names after character stripping, potentially leading to arbitrary code execution on the server.
CVE-2026-77647 is a critical code injection vulnerability in SPIP before version 4.4.20. It allows unauthenticated remote attackers to execute arbitrary code due to improper handling of PHP code blocks and var_export function mishandling certain characters. This vulnerability has been exploited in the wild as of August 2026.
CVE-2026-18287 is a high-severity remote code execution vulnerability in the Aeon software, specifically in the load_time_series_segmentation_benchmark method. It arises from improper validation of user-supplied strings used in Python code execution, allowing attackers to execute arbitrary code. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability affects Aeon version 1.3.0.
CVE-2026-18286 is a high-severity code injection vulnerability in the aeon software, specifically in the load_human_activity_segmentation_datasets method. It allows remote attackers to execute arbitrary Python code by supplying malicious input that is not properly validated. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability can lead to full compromise of the affected process.
CVE-2026-73992 is a critical vulnerability in Jonathan Daggerhart's Query Wrangler product, affecting versions up to and including 1.5.57. It involves improper control of code generation (CWE-94), leading to a remote code execution (RCE) vulnerability. The flaw allows an attacker with limited privileges to execute arbitrary code remotely without user interaction. The vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No specific patch or remediation details are provided in the available data.
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
CVE-2026-63187 is a code injection vulnerability in logto-io's logto product affecting versions from 1.40.1 up to but not including 1.41.0. The issue arises from unsafe interpolation of the GitHub pull request title into a shell command within a GitHub Actions workflow, allowing an attacker to inject arbitrary shell commands. The vulnerability is mitigated by the use of a read-only GITHUB_TOKEN that does not expose repository secrets, limiting impact to disruption or alteration of the ephemeral workflow execution. This vulnerability is fixed in version 1.41.0.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
CVE-2026-72717 is a critical code injection vulnerability in orval-labs' orval tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Versions prior to 8.21.0 improperly handle ${...} expressions or backticks in schema defaults, allowing attacker-controlled JavaScript to be executed when the generated zod schema module is imported. This can lead to code execution in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.