CWE-94

Medium likelihood

Improper Control of Generation of Code ('Code Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

6,714 vulnerabilities with CWE-94
CVE-2026-42238 CRITICAL
Unauthenticated Remote Code Execution via Backup Restore in nginx-ui
CVSS 9.8
CVE-2026-42234 HIGH
n8n: Python Task Runner Sandbox Escape
CVSS 8.8
CVE-2026-42090 CRITICAL
Notesnook: RCE via stored XSS in note export rendering
CVSS 9.6
CVE-2026-26332 CRITICAL
vm2: Sandbox Escape
CVSS 9.8
CVE-2026-24781 CRITICAL
vm2: Sandbox Breakout Through Inspect
CVSS 9.8
CVE-2026-24120 CRITICAL
vm2: Sandbox Breakout Through Promise Species
CVSS 9.8
CVE-2026-24118 CRITICAL
VM2 Sandbox Breakout Through __lookupGetter__
CVSS 9.8
CVE-2026-40563 HIGH
Apache Atlas: Script injection allows access to unintended data
CVSS 8.1
CVE-2026-36365 HIGH
Lymphatus caesium-image-compressor - Code Injection
CVSS 7.8
CVE-2026-3120 HIGH
RCE in Profelis Informatics' SambaBox
CVSS 7.2
CVE-2026-7703 HIGH
AV Stumpfl Pixera Two Media Server Websocket API code injection
CVSS 7.3
CVE-2026-7700 MEDIUM
langflow-ai langflow LambdaFilterComponent lambda_filter.p eval code injection
CVSS 6.3
CVE-2026-7677 LOW
kerwincui FastBee System Notice SysNoticeController.java add cross site scripting
CVSS 3.5
CVE-2026-7669 MEDIUM
sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer deserialization
CVSS 5.6
CVE-2026-2052 HIGH
Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic
CVSS 8.8
CVE-2026-7596 MEDIUM
nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scripting
CVSS 4.3
CVE-2026-7595 MEDIUM
nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injection
CVSS 6.3
CVE-2026-7580 MEDIUM
Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injection
CVSS 5.3
CVE-2026-42994 CRITICAL
Bitwarden CLI 2026.4.0 - Supply Chain Attack
CVSS 9.8
CVE-2026-7508 MEDIUM
Bootstrap CMS Page Creation show.blade.php code injection
CVSS 6.3
CVE-2026-6543 HIGH
IBM Langflow Desktop Code Validation Endpoint - Authenticated RCE
CVSS 8.8
CVE-2026-7501 LOW
LinkStackOrg LinkStack UserController.php editPage cross site scripting
CVSS 3.5
CVE-2026-36340 HIGH
Krayin CRM 2.1.5 - Remote Code Execution
CVSS 8.1
CVE-2026-7401 MEDIUM
SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting
CVSS 4.3
CVE-2026-34965 HIGH
Cockpit CMS Authenticated Remote Code Execution via Collections
CVSS 8.8
Details
Vulnerabilities 6,714
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits