CWE-94

Medium likelihood

Improper Control of Generation of Code ('Code Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

6,714 vulnerabilities with CWE-94
CVE-2026-44698 HIGH
Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
CVSS 8.3
CVE-2026-9976 HIGH
Google Chrome - Arbitrary Code Execution
CVSS 8.8
CVE-2026-9938 HIGH
Google Chrome - Arbitrary Code Execution
CVSS 8.8
CVE-2026-45374 CRITICAL
CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files
CVSS 9.6
CVE-2026-45353 HIGH
electerm: Local code through electerm's single-instance socket
CVSS 7.8
CVE-2026-45311 CRITICAL
CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval
CVSS 9.6
CVE-2026-45058 CRITICAL
electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark
CVE-2026-43898 CRITICAL
SandboxJS: Sandbox escape via Function.caller leakage of internal call op
CVSS 10.0
CVE-2026-45261 CRITICAL
GitButler: Link injection via forge integration enables arbitrary script execution
CVE-2026-44672 CRITICAL
mapfish-print: Remote Code Injection (RCE) in Dynamic table
CVE-2026-32999 CRITICAL
Webpros Comet Backup - Improper Control of Generation of Code ('Code Injection')
CVSS 9.0
CVE-2026-45136 HIGH
claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh
CVSS 7.8
CVE-2026-44888 CRITICAL
Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)
CVSS 9.8
CVE-2026-44887 CRITICAL
Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)
CVSS 9.8
CVE-2026-42879 MEDIUM
FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
CVSS 6.3
CVE-2026-45719 MEDIUM
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
CVSS 6.5
CVE-2026-44346 HIGH
BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml
CVSS 8.8
CVE-2026-37713 HIGH
Dolibarr ERP/CRM 22.0.0-22.0.4 and 24.0.0-alpha - Remote Code Execution via commonobject.class.php
CVSS 7.3
CVE-2026-37712 HIGH
Dolibarr ERP/CRM 22.0.0-22.0.4 and 24.0.0-alpha - Remote Code Execution via cronjob.class.php call_user_func_array()
CVSS 7.3
CVE-2026-37711 HIGH
Dolibarr ERP/CRM 22.0.0-22.0.4 and 24.0.0-alpha - Remote Code Execution via htdocs/core/actions_addupdatedelete.inc.php
CVSS 7.3
CVE-2026-8832 HIGH
WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost
CVSS 8.8
CVE-2026-6169 HIGH
affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
CVSS 7.2
CVE-2026-48962 HIGH
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob
CVSS 7.3
CVE-2026-9608 LOW
QianFox FoxCMS Administrator Backend edit cross site scripting
CVSS 2.4
CVE-2026-9568 MEDIUM
ThingsBoard YAML provision getGatewayDockerComposeFile code injection
CVSS 5.0
Details
Vulnerabilities 6,714
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits