CWE-94

Medium likelihood

Improper Control of Generation of Code ('Code Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

6,710 vulnerabilities with CWE-94
CVE-2026-14722 HIGH
tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection
CVSS 7.3
CVE-2026-14704 MEDIUM
stephen-kruger bluebox cross site scripting
CVSS 4.3
CVE-2026-14691 MEDIUM
SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection
CVSS 6.3
CVE-2026-14656 MEDIUM
code-projects Assessment Management remove-user.php cross site scripting
CVSS 4.3
CVE-2026-14655 LOW
code-projects Assessment Management view-users.php cross site scripting
CVSS 2.4
CVE-2026-14634 MEDIUM
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting
CVSS 4.3
CVE-2026-14633 MEDIUM
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting
CVSS 4.3
CVE-2026-12252 HIGH
Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk
CVSS 7.8
CVE-2026-11778 MEDIUM
CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
CVSS 5.4
CVE-2026-57624 CRITICAL
WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability
CVSS 10.0
CVE-2026-27436 CRITICAL
WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability
CVSS 9.1
CVE-2026-55794 HIGH
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
CVE-2026-14439 CRITICAL
Altium Git Service - Authenticated Path Traversal to Remote Code Execution
CVE-2026-14407 HIGH
Google Chrome - Arbitrary Code Execution
CVSS 8.8
CVE-2026-14383 HIGH
Google Chrome - Arbitrary Code Execution
CVSS 8.8
CVE-2026-54074 HIGH
@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
CVSS 7.8
CVE-2026-58454 HIGH
JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint
CVSS 7.5
CVE-2026-8857 HIGH
Wikimedia Foundation timeline - Full RCE Using EasyTimeline Extension
CVSS 8.8
CVE-2026-58025 CRITICAL
Remote Code Execution via Unsafe Deserialization in LogItem Import
CVSS 9.8
CVE-2026-24249 HIGH
Nvidia Megatron-Bridge - Improper Control of Generation of Code ('Code Injection')
CVSS 7.8
CVE-2026-24248 HIGH
Nvidia Megatron-Bridge - Improper Control of Generation of Code ('Code Injection')
CVSS 7.8
CVE-2026-56264 HIGH
Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint
CVSS 8.1
CVE-2026-58449 CRITICAL
txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter
CVSS 9.8
CVE-2026-7873 CRITICAL
IBM Langflow OSS 1.0.0-1.10.0 - Authenticated OS Command Execution
CVSS 9.9
CVE-2026-10134 CRITICAL
Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows
CVSS 10.0
Details
Vulnerabilities 6,710
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits