CVE-2026-71868 is a critical code injection vulnerability in orval-labs' orval tool prior to version 8.21.0. The vulnerability arises because unencoded ${...} expressions or backticks in enum default values are emitted directly into module-level template literals during zod schema generation, allowing attacker-controlled JavaScript code to be executed when the generated module is imported. This can lead to code execution in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.
CVE-2026-71865 is a critical code injection vulnerability in orval-labs' orval tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Versions prior to 8.21.0 improperly handle double quotes in query parameter names, embedding them unsafely into generated zod validation schemas. This flaw allows attacker-controlled JavaScript to be executed when the generated schema module is imported, leading to code execution in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.
CVE-2026-71869 is a critical code injection vulnerability in orval-labs' orval software prior to version 8.21.0. The issue arises from unsafe encoding of ${...} expressions or backticks in array item defaults during zod schema generation, allowing attacker-controlled JavaScript to be executed when the generated module is imported. This can lead to code execution in developer, CI, test, or application environments. The vulnerability is fixed in version 8.21.0.
CVE-2026-71864 is a critical code injection vulnerability in orval-labs orval prior to version 8.21.0. The issue arises because a double quote in a header parameter name is not safely encoded when generating the request-validation zod schema, allowing attacker-controlled JavaScript code to be executed when the generated module is imported. This can lead to code execution in developer, CI, test, or application environments. The vulnerability is fixed in version 8.21.0.
CVE-2026-71871 is a critical code injection vulnerability in orval-labs' orval tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Versions prior to 8.21.0 improperly handle default header parameter values containing ${...} expressions or backticks, embedding attacker-controlled JavaScript into generated zod schema modules. This leads to arbitrary code execution when the module is imported in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.
CVE-2026-62681 is a critical code injection vulnerability in orval versions prior to 8.21.0. The issue arises because unescaped backticks in OpenAPI paths are directly embedded into JavaScript template literals used for generating request URLs in clients like axios, fetch, react-query, and SWR. This flaw allows attacker-controlled JavaScript code to be executed in environments where the generated code runs, such as developer machines, CI pipelines, test environments, or applications. The vulnerability is fixed in version 8.21.0.
CVE-2026-72530 is a critical code injection vulnerability in TrueConf Server that allows a remote unauthorized attacker with network access to port 4307/TCP to execute arbitrary code on the host system. The vulnerability affects TrueConf Server versions prior to 5.3, versions from 5.3 up to but not including 5.3.9, versions from 5.4 up to but not including 5.4.9, and versions from 5.5 up to but not including 5.5.5. Exploitation requires a specially crafted script to break out of an isolated environment. The CVSS 4.0 base score is 9.5, indicating critical severity. No patch or remediation information is provided in the input data.
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.
CVE-2026-53451 is a critical path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to write arbitrary files outside the intended directory by exploiting improper pathname limitation in a Socket.IO command. This can lead to remote code execution with service privileges via crafted logging configuration files, and may cause persistent service crashes. The issue is fixed in version 0.4.13.
MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.
CVE-2026-18937 is a critical code injection vulnerability in the Broken Link Checker WordPress plugin before version 2.4.12. It allows unauthenticated users on sites using plain permalinks to overwrite arbitrary PHP global variables and execute arbitrary code on the server when a classic (non-block) editor is active.
CVE-2026-75077 is a cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The issue exists in the /BSCE2.php file where manipulation of the 'course' argument allows remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and requires user interaction to exploit. No official patch or remediation guidance is currently available.
CVE-2026-59894 is a code injection vulnerability in the Python sqlparse module prior to version 0.6.0. The issue occurs in sqlparse/filters/output.py where backslashes before quotes are not properly escaped when using output_format='python' or 'php'. This allows crafted SQL input to terminate the generated string and inject arbitrary Python or PHP code if the generated source is executed or imported downstream. The vulnerability is fixed in version 0.6.0.
CVE-2026-74253 is a critical vulnerability in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 15.0.0. It allows unauthenticated remote code execution (RCE) due to improper control of code generation. The extension processes {source} blocks in Joomla's final rendered HTML without reliably verifying the origin of the code, leading to execution of untrusted input.
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.
The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The partial mitigation introduced via strip_shortcodes() on [profile-first-name] and [profile-last-name] can be bypassed through the [profile-display-name format="first_last_names"] render path, the [profile-bio] render path (which re-fetches the raw description meta), and the double-bracket escape sequence [[tag]], all of which allow attacker-controlled shortcode text to reach the outer do_shortcode() call.
A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.
A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.