CWE-94
CVEs classified under CWE-94, newest first.
1379 CVEsRSS
CVE-2026-63146Critical· 9.8Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and Db…
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and Db…
CVE-2026-96220High· 7.8Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.
Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.
CVE-2026-85359High· 7.8Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
CVE-2026-83759High· 8.8Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.
Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.
CVE-2026-103572High· 8.8Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-102870High· 8.8Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-102863High· 8.8Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-108385High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.re…
CVE-2026-108384High· 8.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed typ…
CVE-2026-108383High· 8.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a sc…
CVE-2026-108382High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates eac…
CVE-2026-108381High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators inser…
CVE-2026-108380High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties i…
CVE-2026-108379High· 8.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's n…
CVE-2026-108378High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a sche…
CVE-2026-108377High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a sch…
CVE-2026-108376High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a sc…
CVE-2026-108375High· 8.8PoCdataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts sche…
CVE-2026-104126Medium· 6.0JumpServer is an open source bastion host and an operation and maintenance security audit system
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who …
CVE-2026-78802Critical· 9.8An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
CVE-2026-55695Critical· 9.1PoCFearlessCMS is a flat-file content management system centered on simplicity and open source
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perf…
CVE-2026-55675Critical· 10.0PoCThe Salty documentation repository builds and deploys the docs.saltbox.dev website
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact…
CVE-2026-55376High· 8.8PoCHeym builds and runs agentic systems and business-process automations on self-hosted infrastructure
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based…
CVE-2026-103965Medium· 5.4An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in …
CVE-2026-108962Medium· 6.3PoCA vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93
A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the compo…
CVE-2026-108961Medium· 6.3A flaw has been found in PaddlePaddle PaddleX up to 3.7.2
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manip…
CVE-2026-108957Medium· 6.3PoCA security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b
A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the compo…
CVE-2026-89107Critical· 9.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privi…
CVE-2026-108945Medium· 5.3PoCA vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2
A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing…
CVE-2026-108944Medium· 4.8A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041
A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of the file src/utils/model_utils.py of the component Config-Dri…