Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell through to ImageMagick, where attacker-controlled <image href> values reached unrestricted MSL and VIDEO coder operations. By storing one crafted asset and referencing its path from a second delayed-marker SVG, an attacker could execute code in the immich-server container when thumbnail processing ran. This issue is fixed in version 3.2.4.
CVE-2026-105677 is a path traversal vulnerability in TryGhost Ghost that allows an authenticated Administrator to execute arbitrary code on the server via a crafted theme. The issue affects Ghost versions from 6.10.3 up to but not including 6.64.0. The vulnerability is fixed in version 6.64.0. This flaw arises from improper limitation of pathname to a restricted directory when loading theme translation files.
A code injection vulnerability exists in the image processing library used by Ghost for SVG handling. This flaw allows any staff user, including Contributors, to create a bookmark card for a malicious website, which can lead to arbitrary command execution on the Ghost server. The vulnerability affects Ghost versions from 6.56.0 up to but not including 6.67.0. A fix is available in version 6.67.0.
auto-changelog versions before 2.6.1 merge configuration from inside the target repository, including untrusted files, into their options. This allows execution of attacker-controlled code via the handlebarsSetup option, loading malicious modules via plugins, git argument injection, arbitrary file writes, and outbound requests to attacker-chosen URLs. Version 2.6.1 mitigates this by treating in-repository configuration as untrusted and refusing to run if unsafe options are set unless overridden by a specific flag.
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability.
The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system.
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.
The WP Ultimate Review plugin for WordPress versions up to and including 2.4.3 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin improperly validates input before calling do_shortcode, and the nonce required for the action is publicly accessible via the review form. Submitted shortcode payloads are auto-published without admin approval by default, enabling exploitation without any user account or privileges.
The WP Ultimate Review WordPress plugin versions up to 2.4.3 contain a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin improperly validates input before calling do_shortcode, enabling code injection via shortcode execution. The vulnerability exploits WordPress's strip_shortcodes() function behavior, which unwraps double-bracket shortcode escapes, allowing malicious shortcodes to be stored and executed when the xs_review post type content is rendered.
The All in One SEO – AI SEO Plugin for WordPress (up to version 5.0.2) contains a code injection vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin fails to properly validate input before passing it to the do_shortcode function. Exploitation requires the AIOSEO breadcrumb to be rendered on the search results page via block, widget, shortcode, or template tag.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.
CVE-2026-104851 is a high-severity code injection vulnerability in the fsspec filesystem_spec Python library. Versions from 0.9.0 up to but not including 2026.6.0 allow attacker-controlled Kerchunk reference JSON documents to execute arbitrary Python code via unsafe jinja2 template rendering when opening the reference filesystem. This can occur before any referenced data is read and affects multiple code paths depending on document content and options. The issue is fixed in version 2026.6.0.
Tinypool versions prior to 2.1.2 contain a code injection vulnerability due to improper handling of the filename property in the options object passed to pool.run(). An attacker who can pollute Object.prototype.filename can cause the worker pool to load malicious JavaScript code, potentially leading to arbitrary code execution with the host process's privileges. This vulnerability is fixed in version 2.1.2.
CVE-2026-104612 is a cross-site scripting (XSS) vulnerability in SourceCodester Student Result Management System version 1.0, specifically in the Announcement Module. The issue is due to improper sanitization of the title/announcement parameter in the script/academic/core/new_announcement.php file. This allows remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and an exploit has been publicly disclosed. No official patch or remediation guidance is currently provided by the vendor.
CTX Feed Pro WordPress plugin versions up to and including 7.6.12 contain a code injection vulnerability due to improper input validation on the 'Feed Config' field. This field is passed directly to the eval() function, allowing authenticated users with Administrator-level privileges or higher to execute arbitrary PHP code on the server. The vulnerability has a high severity rating with a CVSS score of 7.2.
CVE-2026-55251 is a code injection vulnerability in the netbox-community devicetype-library repository. The issue arises because the continuous integration (CI) workflow executed code from pull requests before any maintainer review, allowing an unprivileged contributor to run arbitrary code on the CI runner by modifying certain configuration files. This vulnerability has been patched by commit f41fc1e.
A critical vulnerability (CVE-2026-96658) in Foreman allows an authenticated attacker with low-level permissions to bypass the safemode sandbox in the templating engine, enabling remote code execution on the hosting server. This occurs due to improper handling of delegated methods, allowing unauthorized functions to be appended to the allowed execution list. The flaw affects Foreman versions 6.19.0 through 6.19.4. A security update is available in Red Hat Satellite 6.19.5 that addresses this issue.
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
CVE-2026-102130 is a high-severity vulnerability in Kiteworks Email Protection Gateway where insufficient validation of uploaded backup content allows an authenticated administrator to influence the application's loading process. This flaw could enable arbitrary code execution on the gateway under the service account's privileges.
CVE-2026-102131 is a high-severity vulnerability in Kiteworks Email Protection Gateway that allows an authenticated administrator to bypass input validation and execute arbitrary code. The gateway improperly controls code generation by failing to recognize all forms of certain configuration settings, enabling code injection. This can lead to execution of attacker-controlled files with the gateway service account privileges.