CWE-94: Code Injection vulnerabilities

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value.

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.

Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.

Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.

CVE-2026-47722 is a high-severity code injection vulnerability in juev's nebula-mesh, a self-hosted control plane for the Slack Nebula mesh VPN. Versions prior to 0.3.2 improperly interpolate user-supplied ListenHost and TunDevice fields into a text/template without sufficient validation, allowing potential code injection. The issue is fixed in version 0.3.2.

A critical code execution vulnerability (CWE-94) exists in JetBrains TeamCity versions prior to 2026.1.2 and 2025.11.6. This vulnerability affects Git VCS roots and allows for remote code execution. The CVSS score is 9.1, indicating a high severity with significant impact on confidentiality, integrity, and availability.

A high-severity vulnerability (CWE-94) in JetBrains TeamCity before versions 2026.1.2 and 2025.11.6 allows code execution via escape from the Kotlin DSL sandbox. This vulnerability enables an attacker with limited privileges to execute arbitrary code without user interaction. No official patch or remediation guidance has been confirmed yet.

A high-severity vulnerability (CVE-2026-64815) exists in JetBrains IntelliJ IDEA before version 2026.2 that allows arbitrary code injection via UI Designer form files. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code). It has a CVSS 3.1 score of 8.1, indicating a high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided by the vendor. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

A high-severity vulnerability (CWE-94) in JetBrains GoLand before version 2026.2 allows arbitrary code execution via the configured Go SDK before project trust is granted. This issue affects local users and requires user interaction. The vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability.

A high-severity vulnerability (CWE-94) in JetBrains GoLand before version 2026.2 allows arbitrary code execution prior to granting project trust in the Go Modules integration. This issue could enable an attacker to execute code with the privileges of the user running the IDE. The vulnerability has a CVSS 3.1 score of 7.8, indicating a significant risk. No official patch or remediation level has been explicitly stated in the provided data. There are no known exploits in the wild at this time.

Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The vulnerability was partially patched in version 5.0.4.

FUXA versions 1.2.11 through 1.3.0 contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code as root. This vulnerability persists even when the software is configured with its most secure settings enabled. The issue is resolved in version 1.3.1.

Autel Maxi Charger Single firmware up to version V1.03.51 contains a critical vulnerability (CVE-2026-8984) that allows unauthenticated remote code execution. The vulnerability exists in a service listening on TCP port 9002, where a crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges. This flaw is categorized under CWE-94 (Improper Control of Generation of Code). The CVSS v4.0 base score is 10.0, indicating a critical severity level.

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 fixes the issue.

An authenticated code injection vulnerability exists in themexpert.com Quix Page Builder Pro extension for Joomla versions 1.0 through 6.2.0. Authenticated users with core.create or core.edit permissions can inject PHP code into element content, which is executed via the view-cache include() mechanism when caching is enabled (default setting). This allows execution of arbitrary PHP code on the server.

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

CVE-2026-16151 is a vulnerability in CartoDB carto-api-client version 0.5.29 affecting the addFilter function in src/filters.ts. The flaw allows remote attackers to manipulate the 'column' argument, leading to improper modification of object prototype attributes. The issue was reported early to the project, but no response or fix has been provided yet. The vulnerability is classified as medium severity.