MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration...
CVE-2026-100840
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _tar
#cwe-95
共收录 104 条相关情报。
← 返回所有主题MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that...
CVE-2026-100842
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. Th
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an ...
CVE-2026-100840
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _tar
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 an...
CVE-2026-57149
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of po
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
CVE-2026-57149
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of po
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated...
CVE-2026-76974
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craf
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This al...
CVE-2026-78847
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 ...
CVE-2025-53837
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) int
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
CVE-2025-53837
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) int
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py c...
CVE-2026-61667
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandle...
CVE-2026-45579
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authenticat...
CVE-2026-19780
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamicall...
CVE-2026-80351
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K.
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP acc...
CVE-2026-79678
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve a...
CVE-2026-85165
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed
n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
CVE-2026-85165
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute...
CVE-2026-65643
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
CVE-2026-65643
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary...
CVE-2026-19295
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type ...
CVE-2026-19295
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in