Total
7601 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-108381 | 2026-10-16 | N/A | 8.8 HIGH | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments. | |||||
| CVE-2026-108376 | 2026-10-16 | N/A | 8.8 HIGH | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar. | |||||
| CVE-2026-104126 | 2026-10-16 | N/A | 6.0 MEDIUM | ||
| JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation tasks. Crafted content can invoke sensitive Ansible lookup behavior, including file, pipe, env, and password lookups, within the Ansible execution context, which can disclose files or environment values and may permit limited command execution under the privileges of the automation process. The issue does not provide unauthenticated access or direct access to unrelated JumpServer assets. This issue is fixed in version 4.10.17-lts. | |||||
| CVE-2026-55376 | 2026-10-16 | N/A | 8.8 HIGH | ||
| Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40. | |||||
| CVE-2026-105903 | 1 Adobe | 1 Coldfusion | 2026-10-16 | N/A | 9.9 CRITICAL |
| ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-108380 | 2026-10-16 | N/A | 8.8 HIGH | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it. | |||||
| CVE-2026-108259 | 2026-10-16 | N/A | 8.2 HIGH | ||
| Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0. | |||||
| CVE-2026-108385 | 2026-10-16 | N/A | 8.8 HIGH | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name. | |||||
| CVE-2026-108379 | 2026-10-16 | N/A | 8.8 HIGH | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names. | |||||
| CVE-2026-108384 | 2026-10-16 | N/A | 8.8 HIGH | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists. | |||||
| CVE-2026-108390 | 2026-10-16 | N/A | 9.9 CRITICAL | ||
| Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5. | |||||
| CVE-2026-55695 | 2026-10-16 | N/A | 9.1 CRITICAL | ||
| FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b. | |||||
| CVE-2026-78802 | 2026-10-16 | N/A | 9.8 CRITICAL | ||
| An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. | |||||
| CVE-2026-108551 | 2026-10-16 | N/A | 9.8 CRITICAL | ||
| openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called. | |||||
| CVE-2026-111212 | 2026-10-16 | 4.3 MEDIUM | 4.8 MEDIUM | ||
| A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_metadata_map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-108598 | 2026-10-16 | N/A | 9.8 CRITICAL | ||
| Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM. | |||||
| CVE-2026-109308 | 2026-10-16 | N/A | 8.8 HIGH | ||
| Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code. | |||||
| CVE-2026-54708 | 1 Sangoma | 1 Freepbx | 2026-10-16 | N/A | 8.8 HIGH |
| FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7. | |||||
| CVE-2026-108933 | 2026-10-16 | 3.3 LOW | 2.4 LOW | ||
| A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-54710 | 1 Sangoma | 1 Freepbx | 2026-10-16 | N/A | 8.8 HIGH |
| FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7. | |||||