FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
CVE-2026-55376 is a high-severity OS command injection vulnerability in heymrun's heym product prior to version 0.0.40. Authenticated users with permissions to create or edit workflows using an Agent custom Python tool can bypass sandbox restrictions due to improper validation of imported standard-library modules. This allows execution of arbitrary OS commands and file operations with the backend application user's privileges. The issue is fixed in version 0.0.40.
CVE-2026-89107 is a critical vulnerability in SAP S/4HANA's Manage Substitution/Validation Rules component. It arises from insufficient validation of input processed by a domain-specific scripting language used in rule definitions. An authenticated attacker with specific business privileges can submit crafted input that is executed as arbitrary ABAP code. Successful exploitation can lead to full system compromise, impacting confidentiality, integrity, and availability.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a critical vulnerability (CVE-2026-96119) in the HTTP Server Administration web application. This flaw involves improper data sanitization that could allow a remote authenticated attacker to execute arbitrary code or obtain sensitive information on the affected system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code, also known as Code Injection).
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a critical vulnerability (CVE-2026-90920) involving improper control of code generation, which could allow a remote attacker to execute arbitrary code without authentication.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a vulnerability related to improper input validation. This is due to an unsanitised container image configuration in a Kubernetes operator template, which can lead to code injection. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. There is no information on available patches or vendor advisories specifying remediation. No known exploits are reported in the wild.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a vulnerability due to improper input validation of a container image reference in a Kubernetes operator template. This unsanitized input can lead to code injection issues.
CVE-2026-62098 is a medium severity vulnerability in kutethemes Boutique versions up to 2.3.3 that allows unauthenticated content injection due to improper control of code generation (CWE-94). This vulnerability could lead to limited confidentiality and integrity impacts without affecting availability. No patch or remediation information is currently provided.
CVE-2026-42696 is a critical vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning that allows remote code inclusion due to improper control of code generation. This vulnerability affects versions from the initial release up to 1.5.19. It has a maximum CVSS score of 10.0, indicating it can be exploited remotely without privileges or user interaction, potentially leading to full system compromise.
CVE-2026-39802 is a high-severity vulnerability in Everest Backup versions up to and including 2.3.13. It allows unauthenticated remote code execution due to improper control of code generation (CWE-94). This flaw could enable an attacker to execute arbitrary code on the affected system without any authentication.
A code injection vulnerability (CWE-94) exists in VillaTheme Thank You Page Customizer for WooCommerce versions up to 1.2.3. This vulnerability allows an attacker to inject code remotely without authentication or user interaction, potentially leading to high confidentiality impact. The vulnerability has a CVSS v3.1 score of 7.5, indicating high severity. No patch or remediation information is currently provided.
The Avada (Fusion) Builder WordPress plugin is vulnerable to an authorization bypass vulnerability in all versions up to and including 7.16.1. This flaw allows unauthenticated attackers to invoke arbitrary WordPress action hooks via a crafted form submission, potentially causing severe impacts such as permanent deletion of site content and denial of service. Exploitation requires a published Avada form with AJAX submission and a notification email template including specific placeholders. The vulnerability also allows a blind arbitrary read of user/post meta data, but this information is only delivered to the site owner and cannot be exfiltrated by the attacker. The CVSS score is 9.1, indicating critical severity.
Fastcache by Host.it WordPress plugin versions up to 1.7.4 contain a code injection vulnerability via the cache_cookie_exclude parameter. Authenticated administrators can inject arbitrary Apache directives into the .htaccess file, enabling server-level configuration changes and potential remote code execution. The vulnerability arises from improper sanitization of user input before writing to .htaccess.
A critical code injection vulnerability (CWE-94) exists in 0xJacky's nginx-ui versions from 2.3.8 up to but not including 2.5.0. An authenticated administrator with an active secure session can submit malicious backup key material and manifest to the restore API endpoint, which leads to replacement of the live configuration file including protected command settings. This allows execution of attacker-controlled commands in the Nginx UI runtime context, impacting confidentiality, integrity, and availability. The issue is fixed in version 2.5.0.
SumatraPDF versions 3.6.1 and earlier contain a code injection vulnerability where untrusted document paths and PDF link targets are improperly handled in notification text. This allows an attacker to inject commands that execute a local program when a user clicks a crafted link. No fixed version is currently available.
CVE-2026-11888 is a medium severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability involves improper control of code generation, classified as CWE-94, which can lead to information disclosure. The CVSS 3.1 base score is 6.4, indicating a moderate risk with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.
PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. Version 4.6.78 patches the issue.