Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:94"
641 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-113776 |
high | 7.8 | 0.0027 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, | |
CVE-2026-118614 |
high | 7.8 | 0.0020 | 2026-10-28 | Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability | |
CVE-2026-118616 |
high | 7.8 | 0.0020 | 2026-10-28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allow | |
CVE-2026-118618 |
high | 7.8 | 0.0022 | 2026-10-28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allow | |
CVE-2026-70338 |
high | 7.8 | 0.0036 | 2026-08-11 | Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthor | |
CVE-2026-96220 |
high | 7.8 | 0.0030 | 2026-10-13 | Improper control of generation of code ('code injection') in Windows Assigned Access allows an autho | |
CVE-2026-40156 |
high | 7.8 | 0.0021 | 2026-04-10 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file name | |
CVE-2026-40158 |
high | 7.8 | 0.0024 | 2026-04-10 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can | |
CVE-2026-42214 |
high | 7.8 | 0.0024 | 2026-05-07 | Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext' | |
CVE-2026-42851 |
high | 7.8 | 0.0016 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write b | |
CVE-2026-24155 |
high | 7.8 | 0.0019 | 2026-06-16 | NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploi | |
CVE-2026-24248 |
high | 7.8 | 0.0024 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper con | |
CVE-2026-24249 |
high | 7.8 | 0.0023 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat | |
CVE-2026-12252 |
high | 7.8 | 0.0019 | 2026-07-04 | In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, Stanfor | |
CVE-2026-9762 |
high | 7.8 | 0.0024 | 2026-07-17 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when | |
CVE-2026-64802 |
high | 7.8 | 0.0021 | 2026-07-23 | In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trus | |
CVE-2026-64803 |
high | 7.8 | 0.0021 | 2026-07-23 | In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trus | |
CVE-2026-54621 |
high | 7.8 | 0.0021 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, Grap | |
CVE-2026-54654 |
high | 7.8 | 0.0021 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.6 | |
CVE-2026-54655 |
high | 7.8 | 0.0021 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.6 | |
CVE-2026-54656 |
high | 7.8 | 0.0025 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-55522 |
high | 7.8 | 0.0022 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 | |
CVE-2026-66149 |
high | 7.8 | 0.0026 | 2026-08-11 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Secur | |
CVE-2026-66150 |
high | 7.8 | 0.0026 | 2026-08-11 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Secur | |
CVE-2026-13094 |
high | 7.8 | 0.0020 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on | |
CVE-2026-73505 |
high | 7.8 | 0.0021 | 2026-08-13 | Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 2 | |
CVE-2026-67961 |
high | 7.8 | 0.0019 | 2026-08-17 | An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mech | |
CVE-2026-18286 |
high | 7.8 | 0.0034 | 2026-08-20 | Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability. T | |
CVE-2026-18287 |
high | 7.8 | 0.0034 | 2026-08-20 | Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability. Thi | |
CVE-2026-76494 |
high | 7.8 | 0.0021 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa | |
CVE-2026-57142 |
high | 7.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI rec | |
CVE-2026-107091 |
high | 7.8 | 0.0018 | 2026-10-26 | An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execu | |
CVE-2026-7466 |
high | 7.7 | 0.0034 | 2026-04-29 | AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local | |
CVE-2026-6902 |
high | 7.7 | 0.0046 | 2026-05-18 | A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the | |
CVE-2026-58454 |
high | 7.7 | 0.0083 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution | |
CVE-2026-51401 |
high | 7.7 | 0.0020 | 2026-08-04 | An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via | |
CVE-2026-119027 |
high | 7.7 | — | 2026-10-29 | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inj | |
CVE-2026-106764 |
high | 7.5 | 0.0052 | 2026-10-23 | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the re | |
CVE-2026-41282 |
high | 7.5 | 0.0025 | 2026-04-20 | ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-var | |
CVE-2026-54816 |
high | 7.5 | 0.0033 | 2026-06-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads | |
CVE-2026-59861 |
high | 7.5 | 0.0205 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby gener | |
CVE-2026-59862 |
high | 7.5 | 0.0138 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python gen | |
CVE-2026-63720 |
high | 7.5 | 0.0074 | 2026-07-26 | datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows | |
CVE-2026-66745 |
high | 7.5 | 0.0055 | 2026-07-28 | Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixa | |
CVE-2026-55415 |
high | 7.5 | 0.0049 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-61536 |
high | 7.5 | 0.0038 | 2026-07-30 | Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, | |
CVE-2026-46581 |
high | 7.5 | 0.0056 | 2026-08-05 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not prope | |
CVE-2026-39421 |
high | 7.4 | 0.0026 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox esca | |
CVE-2026-41414 |
high | 7.4 | 0.0028 | 2026-04-24 | Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .gi | |
CVE-2024-46507 |
high | 7.3 | 0.0392 | 2026-05-08 | A SSTI (server side template injection) vulnerability in the custom template export function in yeti |