CWE-95

CVEs classified under CWE-95, newest first.

95 CVEsRSS

CVE-2025-65530High· 8.8

10mo ago

An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanning a crafted file.

▾ Twilightcloudlinux · ai-bolitEPSS 0.30%via NVD

CVE-2025-66474High· 8.8

11mo ago

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc)

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 …

▾ Twilightxwiki · xwiki-renderingEPSS 1.0%via NVD

CVE-2025-48868High· 7.2PoC

1y ago

Horilla is a free and open source Human Resource Management System (HRMS)

Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query pa…

▾ Midnighthorilla · horillaEPSS 2.5%via NVD

CVE-2025-4318None

1y ago

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitra…

▾ SunlitEPSS 0.98%via NVD

CVE-2024-46946Critical· 9.8

2y ago

LangChain Experimental Eval Injection vulnerability

▾ Midnightlangchain-experimental · langchain-experimentalEPSS 1.4%via OSV