CWE-94
CVEs classified under CWE-94, newest first.
661 CVEsRSS
CVE-2026-61536High· 7.5Banks generates meaningful LLM prompts using a simple template language
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through impo…
CVE-2026-11393High· 9.0AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping
AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping
CVE-2026-54662High· 8.3swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
CVE-2026-54661High· 8.3swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
CVE-2026-54664High· 8.3swagger-typescript-api vulnerable to code injection via unescaped enum string values
swagger-typescript-api vulnerable to code injection via unescaped enum string values
CVE-2026-54666High· 8.3swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
CVE-2026-66748High· 8.8PoCCamaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the…
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the…
CVE-2026-55415High· 7.5datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
CVE-2026-54656High· 7.8`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
CVE-2026-54653High· 8.8`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
CVE-2026-54654High· 7.8`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
CVE-2026-54655High· 7.8`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
CVE-2026-54621High· 7.8`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
CVE-2026-55771High· 8.8Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities
Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities
CVE-2026-63720High· 7.5PoCdatamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded n…
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded n…
CVE-2025-71408High· 7.0nltk: NLTK: Arbitrary Code Execution via Eval Injection in Collocations Module (CVE-2025-71408)
A flaw was found in NLTK (Natural Language Toolkit). This eval injection vulnerability in the `nltk.collocations` module allows a local attacker to execute arbitrary Python code. By manipulating command-line arguments when `collocations.py…
GHSA-6xj8-qv9j-xcjqHigh· 7.8Oh My Posh: Arbitrary command execution via template injection in the path segment
Oh My Posh: Arbitrary command execution via template injection in the path segment
CVE-2026-59860HighMicrosoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
CVE-2026-59861High· 7.5Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
CVE-2026-59862High· 7.5Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
CVE-2026-59859HighMicrosoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
CVE-2026-59865CriticalMicrosoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
CVE-2026-59866HighMicrosoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
GHSA-7gfh-x38p-prh3Critical· 9.8Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
GHSA-w28w-gp39-m4p6Critical· 10.0Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
CVE-2025-13146Medium· 6.5The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7
The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the software allowing users to execute an action that does no…
GHSA-gv7g-jm28-cr3mHighn8n: Expression sandbox escape via arrow-function bodies enabling command execution
n8n: Expression sandbox escape via arrow-function bodies enabling command execution
GHSA-2rp8-mm9q-fp49Medium· 5.7TypeORM: migration:generate template-literal code injection
TypeORM: migration:generate template-literal code injection
CVE-2026-16229Medium· 4.3A flaw has been found in itsourcecode Courier Management System up to 1.0
A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting.…
CVE-2026-16220Medium· 4.3A vulnerability has been found in code-projects Online Examination System 1.0
A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack c…