#cwe-94

共收录 1460 条相关情报。

漏洞预警2026-10-29 发布MEDIUM

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Wind...

CVE-2026-90872

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_F

来源摘录 · NVD

#cve #cwe-94 #cwe-95

漏洞预警2026-10-29 发布CRITICAL

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

CVE-2026-61991

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布CRITICAL

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner'...

CVE-2026-18894

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

CVE-2026-110309

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to i

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component co...

CVE-2026-110193

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布CRITICAL

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

CVE-2026-110186

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

CVE-2026-107329

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

CVE-2026-107328

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布CRITICAL

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVE-2026-104339

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutraliza

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS comm...

CVE-2026-104328

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

CVE-2026-101288

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or bool...

CVE-2026-119028

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by suppl

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescape...

CVE-2026-119027

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by suppl

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布HIGH

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions wit...

CVE-2026-118905

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.

来源摘录 · NVD

#cve #cwe-78 #cwe-94

漏洞预警2026-10-29 发布HIGH

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that e...

CVE-2026-115301

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its fo

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-29 发布LOW

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unk...

CVE-2026-118585

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #cwe-94 #severity:low

漏洞预警2026-10-28 发布CRITICAL

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.p

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-28 发布HIGH

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration ...

CVE-2026-54453

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t

来源摘录 · NVD

#cve #cwe-74 #cwe-94

安全公告2026-10-28 发布INFO

Seroval: Code injection through a typed array's own constructor property

CVE-2026-116583

### Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in th

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #cwe-94 #npm #severity:medium

漏洞预警2026-10-28 发布HIGH

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfi...

CVE-2026-118683

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a

来源摘录 · NVD

#cve #cwe-94