#cwe-94

共收录 1468 条相关情报。

漏洞预警2026-07-31 发布INFO

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection....

CVE-2026-17561

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Cons

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-31 发布INFO

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written...

CVE-2026-13392

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-30 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

CVE-2026-12946

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the i

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-30 发布INFO

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} bl...

CVE-2026-61536

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool J

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-470

漏洞预警2026-07-30 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.

CVE-2026-13435

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox impl

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

安全公告2026-07-30 发布INFO

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

CVE-2026-61536

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool J

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-470 #cwe-94

安全公告2026-07-29 发布INFO

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

CVE-2026-11393

### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-94 #severity:high

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys thro...

CVE-2026-54666

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94 #cwe-1336

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components....

CVE-2026-54664

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94 #cwe-1336

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94 #cwe-1336

漏洞预警2026-07-29 发布INFO

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates s...

CVE-2026-54661

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templat

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94 #cwe-1336

安全公告2026-07-29 发布INFO

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

CVE-2026-54666

### Summary `swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{i

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-74 #cwe-94 #cwe-1336 #severity:high

安全公告2026-07-29 发布INFO

swagger-typescript-api vulnerable to code injection via unescaped enum string values

CVE-2026-54664

### Summary `swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generat

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-74 #cwe-94 #cwe-1336 #severity:high

漏洞预警2026-07-29 发布INFO

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due t...

CVE-2026-14900

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and i

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-29 发布INFO

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied...

CVE-2026-13423

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-28 发布INFO

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV....

CVE-2026-55415

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-95

漏洞预警2026-07-28 发布INFO

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV....

CVE-2026-54656

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-28 发布INFO

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsons...

CVE-2026-54655

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type v

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-07-28 发布INFO

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments...

CVE-2026-54654

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-tem

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1336

漏洞预警2026-07-28 发布INFO

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV....

CVE-2026-54653

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1336