CVE-2024-1490 is a high-severity vulnerability in the WAGO CC100 (0751-9x01) PLC that allows an authenticated remote attacker with high privileges to execute arbitrary shell commands via the OpenVPN configuration accessible through the device's web-based management interface. This occurs if user-defined scripts are permitted, enabling code injection through improper control of code generation. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-39891 is a high-severity code injection vulnerability in MervinPraison's PraisonAI versions prior to 4.5.115. The vulnerability arises because the create_agent_centric_tools() function returns tools that process file content using template rendering without properly escaping user input from agent.start(). This allows template expressions in the input to be executed as code rather than treated as literal text. The issue is fixed in version 4.5.115. No known exploits are reported in the wild, and the product is not a cloud service.
CVE-2026-39846 is a critical stored cross-site scripting (XSS) vulnerability in SiYuan personal knowledge management system versions prior to 3.6.4. The flaw arises from unsafe handling of table caption content, which is stored without proper escaping and later rendered as unescaped HTML. Because the SiYuan Electron desktop client runs with nodeIntegration enabled and contextIsolation disabled, this allows attacker-controlled JavaScript to execute with full access to Node.js APIs, effectively enabling remote code execution. An attacker can exploit this by syncing a crafted malicious note to a victim's workspace, triggering code execution when the victim opens the note. This vulnerability is fixed in version 3.6.4.
ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.
Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
CVE-2026-35197 is a code injection vulnerability in the dye color library for shell scripts prior to version 1.1.1. Certain dye template expressions could lead to arbitrary code execution. The issue was discovered and fixed by the author in version 1.1.1. There are no known exploits in the wild. The vulnerability has a CVSS score of 6.6, indicating medium severity.
Kedro versions prior to 1.3.0 contain a critical remote code execution vulnerability due to unsafe loading of a logging configuration file specified by the KEDRO_LOGGING_CONFIG environment variable. The logging configuration supports a special key that allows arbitrary callable instantiation, enabling attackers to execute system commands during application startup. This vulnerability is fixed in Kedro version 1.3.0.
CVE-2026-26026 is a critical vulnerability in the GLPI IT management software versions 11.0.0 up to but not including 11.0.6. It involves improper control of code generation (CWE-94) allowing an administrator to perform template injection that leads to remote code execution (RCE). This vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. The issue is fixed in version 11.0.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template strings that are subsequently processed without proper sanitization of shortcode syntax. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting crafted billing field values during the checkout process.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.
CVE-2026-2701 is a critical vulnerability in Progress ShareFile Storage Zones Controller that allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution. The vulnerability arises from unrestricted upload of files with dangerous types. It has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided. The vulnerability affects the product version indicated as '0', with no known exploits in the wild at this time.
CVE-2026-1540 is a high-severity vulnerability in the Spam Protect for Contact Form 7 WordPress plugin versions before 1.2.10. It allows an attacker with editor-level access to achieve remote code execution by exploiting improper control over code generation through logging to a PHP file using a crafted header. The vulnerability is classified as CWE-94, indicating code injection issues. No official patch or vendor advisory information is provided in the data. The CVSS score is 7.2, reflecting high impact on confidentiality, integrity, and availability.
This update for go1.25-openssl fixes the following issues
- Update to version go1.25.12 (bsc#1244485).
- CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling (bsc#1257692).
- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain (bsc#1256818).
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
- CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
- CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
- CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
- CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
- CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
- CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
- CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
- CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
- CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
- CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock (bsc#1261659).
- CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
- CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
- CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
- CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1264506).
- CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths (bsc#1264505).
- CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames (bsc#1264504).
- CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
- CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
- CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
- CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters (bsc#1264500).
- CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
- CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
- CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
- CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).
- CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
- CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
- CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping (bsc#1267444).
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document, package it as a .sy.zip, and have the victim import it through the normal Import -> SiYuan .sy.zip workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored XSS. In the Electron desktop client, this XSS reaches remote code execution because injected JavaScript runs with access to Node/Electron APIs. This issue has been patched in version 3.6.2.
SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset Field” enabled. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src="..."> attribute without escaping. In the Electron desktop client, the injected JavaScript executes with nodeIntegration enabled and contextIsolation disabled, so the XSS reaches arbitrary OS command execution under the victim’s account. This issue has been patched in version 3.6.2.
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.
Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.
The Everest Forms Pro WordPress plugin up to version 1.9.12 contains a critical remote code execution vulnerability due to improper handling of user input in the Calculation Addon's process_filter() function. User-submitted form field values are concatenated into PHP code and evaluated without proper escaping, allowing unauthenticated attackers to inject and execute arbitrary PHP code via the "Complex Calculation" feature. This vulnerability has a CVSS score of 9.8, indicating a critical severity level. No official patch or remediation information is currently provided.
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's `registerUndefinedFilterCallback()` method to register arbitrary PHP callbacks.