Total
7605 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-51911 | 2026-10-05 | N/A | 9.8 CRITICAL | ||
| vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution. | |||||
| CVE-2025-63665 | 1 Gtedge | 1 Gt Edge Ai | 2026-10-05 | N/A | 9.8 CRITICAL |
| An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON payload into the Prompt window. | |||||
| CVE-2026-97233 | 2026-10-05 | 4.0 MEDIUM | 3.5 LOW | ||
| A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument file_path leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-1011 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. | |||||
| CVE-2025-8030 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.1 HIGH |
| Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. | |||||
| CVE-2025-60206 | 2026-10-05 | N/A | 10.0 CRITICAL | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through <= 7.8.3. | |||||
| CVE-2026-10026 | 2026-10-03 | N/A | 7.2 HIGH | ||
| The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server. | |||||
| CVE-2026-51858 | 2026-10-02 | N/A | 9.8 CRITICAL | ||
| In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary. | |||||
| CVE-2026-58572 | 1 Dell | 13 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 10 more | 2026-10-02 | N/A | 8.8 HIGH |
| Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges. | |||||
| CVE-2026-93985 | 2026-10-02 | N/A | 9.9 CRITICAL | ||
| OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process. | |||||
| CVE-2018-7602 | 2 Debian, Drupal | 2 Debian Linux, Drupal | 2026-10-02 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild. | |||||
| CVE-2026-51872 | 2026-10-02 | N/A | 9.8 CRITICAL | ||
| Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py. | |||||
| CVE-2026-51861 | 2026-10-02 | N/A | 9.8 CRITICAL | ||
| bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. | |||||
| CVE-2026-51857 | 2026-10-02 | N/A | 9.8 CRITICAL | ||
| In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary. | |||||
| CVE-2026-102264 | 2026-10-02 | 4.0 MEDIUM | 3.5 LOW | ||
| A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argument Name/Address/City results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2022-37009 | 1 Jetbrains | 1 Intellij Idea | 2026-10-02 | N/A | 3.9 LOW |
| In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible | |||||
| CVE-2026-51871 | 2026-10-01 | N/A | 9.8 CRITICAL | ||
| Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content. | |||||
| CVE-2026-51866 | 2026-10-01 | N/A | 9.8 CRITICAL | ||
| In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow. | |||||
| CVE-2026-51856 | 2026-10-01 | N/A | 9.8 CRITICAL | ||
| In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path. | |||||
| CVE-2026-92966 | 2026-10-01 | N/A | 9.1 CRITICAL | ||
| The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it. | |||||