By weakness (CWE)

CWE-94: related vulnerabilities

CVEs classified under CWE-94. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

51 published vulnerabilities

• CVE-2026-10904HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in the V8 JavaScript engine that allows attackers to break out of the browser sandbox and run malicious code with full privileges. An attacker can exploit this by tricking a user into visiting a specially crafted website. Once triggered, the vulnerability bypasses Chrome's security boundary—the sandbox that normally isolates web content from the rest of the system—giving an attacker direct access to execute arbitrary code on the victim's machine.

• CVE-2026-10928HIGH 8.8

  A script injection vulnerability in Google Chrome's Headless mode allows attackers to execute arbitrary code on a user's system through a malicious HTML page. The flaw requires user interaction—specifically, the victim must open a crafted webpage in an affected Chrome version—but once triggered, an attacker gains the same privileges as the user running the browser, including the ability to read files, modify data, or install malware.

• CVE-2026-11688HIGH 8.8

  Google Chrome versions prior to 149.0.7827.103 contain a flaw in how the browser handles SVG (Scalable Vector Graphics) content. An attacker can craft a malicious HTML page that, when visited by a user, executes arbitrary code within Chrome's sandbox environment. While the sandbox is designed to limit damage, this vulnerability allows an attacker to breach that boundary, potentially compromising user data and system integrity.

• CVE-2026-1829HIGH 8.8

  The Content Visibility for Divi Builder plugin for WordPress contains a critical flaw that allows attackers with basic WordPress user access to run arbitrary code on affected servers. The vulnerability exists in how the plugin processes a specific shortcode parameter without proper validation, creating a direct path to server compromise. Any WordPress installation using this plugin up to version 4.02 is at risk if it has users with Contributor access or higher privileges.

• CVE-2026-25856HIGH 8.8

  OpenBullet2 through version 0.3.2 allows authenticated users to execute arbitrary code on the hosting server. An attacker with valid credentials can modify job configurations to inject and run C# code, gaining the ability to read files, launch programs, and call any .NET function available to the application process. This is a post-authentication vulnerability, meaning the attacker must already have login access.

• CVE-2026-45505HIGH 8.8

  Apache ActiveMQ contains a code injection vulnerability that allows authenticated attackers to execute arbitrary code on the broker. The issue stems from improper validation of discovery wrapper URLs—specifically non-parenthesized formats like `masterslave:vm://...` and `static:vm://`—which bypass a previous security fix. An attacker with valid credentials can exploit the Jolokia JMX-HTTP bridge to load malicious Spring XML configurations, leading to remote code execution with broker privileges.

• CVE-2026-49143HIGH 8.8

  BrowserStack Runner versions up to 0.9.5 contain a critical remote code execution flaw in its /_log HTTP handler. An unauthenticated attacker on the local network can send specially crafted JSON requests to execute arbitrary code on the server without providing credentials. The vulnerability stems from unsafe use of Node.js sandbox features combined with eval(), which allows attackers to break out of the sandbox and gain full system access.

• CVE-2026-49493HIGH 8.8

  Markdown Preview Enhanced versions before 0.8.28 contain a critical flaw in how they process bitfield code blocks embedded in markdown documents. When a user opens or exports a markdown file containing a malicious bitfield block, the application executes arbitrary code with the privileges of the user running the preview. An attacker can craft a seemingly innocent markdown document that, when rendered, runs malicious commands on the victim's system. This is a code injection vulnerability triggered by user interaction with a document.

• CVE-2026-9938HIGH 8.8

  A flaw in Google Chrome's V8 JavaScript engine allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction (clicking a link or visiting a crafted site). While the code runs in a sandboxed environment, successful exploitation could allow an attacker to break out of Chrome's security boundaries and potentially access system resources or steal sensitive data.

• CVE-2026-9976HIGH 8.8

  Google Chrome versions before 148.0.7778.216 contain a flaw in how the browser handles USB device interactions. An attacker can craft a malicious HTML page that, when visited by a user, exploits this flaw to run arbitrary code on the victim's computer with the same privileges as the Chrome process. The vulnerability requires user interaction (visiting the page) but does not require the attacker to have special privileges or be on the same network—it can be delivered remotely via the internet.

• CVE-2026-44698HIGH 8.3

  Home Assistant Companion apps for iOS and Android contain a vulnerability that allows malicious websites viewed in the app to steal a user's access token and run code as if they were logged into Home Assistant. The flaw stems from improper protection of a JavaScript bridge that connects web content to native app functionality. An attacker can craft a webpage with hidden content that tricks the bridge into executing arbitrary commands with the victim's credentials, effectively compromising their Home Assistant account.

• CVE-2026-41249HIGH 8.2

  CoreShop, a Pimcore-based eCommerce platform, contains a critical flaw in its GitHub Actions workflow configuration that allows attackers to execute arbitrary code on build infrastructure. The vulnerability stems from a workflow that accepts pull requests from untrusted sources but then executes scripts using code from those unverified pull requests. An attacker can simply submit a malicious pull request to trigger code execution on CoreShop's CI/CD runners, potentially compromising the build pipeline, stealing credentials, or injecting malicious code into releases.

• CVE-2026-11231HIGH 8.1

  Google Chrome on macOS contains a flaw in its Safe Browsing feature that could allow an attacker to run malicious code on a user's computer. The vulnerability requires user interaction—specifically, the user must open or interact with a malicious file. While Chromium's security team classified the underlying issue as low severity, the CVSS score of 8.1 reflects the real-world impact: an attacker gaining code execution on the system. This affects Chrome versions prior to 149.0.7827.53 on macOS.

• CVE-2026-42588HIGH 8.1

  Apache ActiveMQ's web console exposes a remote interface (Jolokia) that allows authenticated users to interact with the message broker's management functions. An attacker who has legitimate access credentials can craft a specially formed network connector request that tricks the broker into loading and executing arbitrary code hidden in a Spring XML configuration file. The vulnerability exists because the broker doesn't properly validate the input before processing it, and Spring automatically instantiates code within those XML files before any security checks occur.

• CVE-2026-45353HIGH 7.8

  Electerm, an open-source multi-protocol terminal and remote access client supporting SSH, SFTP, Telnet, serial ports, RDP, VNC, Spice, and FTP, contains a high-severity vulnerability affecting versions 3.0.6 through 3.8.8. The issue stems from improper file permissions and unsafe code execution patterns that allow a local attacker with standard user privileges to gain full control over system resources—reading sensitive data, modifying files, and disrupting availability. The vulnerability is resolved in version 3.9.0.

• CVE-2026-45555HIGH 7.8

  Roslyn CodeLens MCP Server, a tool that provides intelligent code analysis for .NET projects, contains a critical flaw in how it handles diagnostic analyzers. When you open a .NET solution, the server automatically loads and runs all diagnostic analyzer assemblies referenced in the project files without checking whether they're legitimate. An attacker can exploit this by crafting a malicious project file that references a malicious DLL. When a developer opens that project with the MCP server, the attacker's code runs with the same privileges as the server process, potentially compromising the entire development environment.

• CVE-2026-47292HIGH 7.8

  Visual Studio Code contains a flaw that allows an attacker with local access to run malicious code with elevated privileges. The vulnerability stems from the application loading or executing functionality from untrusted sources, which an attacker can exploit if they can trick a user into interacting with a malicious file or extension. This is a local privilege escalation risk that requires user interaction but poses a significant threat to developers and organizations relying on VS Code for secure development workflows.

• CVE-2026-8795HIGH 7.8

  Rapid7 Velociraptor contains a vulnerability where specially crafted evidence collections can inject malicious code into YAML configuration files. When a security analyst processes a compromised collection using Velociraptor's remapping feature, arbitrary commands execute on their workstation with full permissions. The attack requires an attacker to control a collection ZIP file (obtained through network compromise or social engineering) and a user to run a specific analysis command. This is a local privilege escalation risk for incident response teams.

• CVE-2026-45583HIGH 7.5

  Microsoft Exchange Server contains a code injection vulnerability that allows an attacker to execute arbitrary code on affected systems over the network. The vulnerability requires user interaction and moderately complex attack conditions, but successful exploitation could give an attacker complete control over the Exchange server and the email infrastructure it supports. This is a HIGH severity issue affecting multiple versions of Exchange Server and Exchange Server Subscription Edition.

• CVE-2026-11218MEDIUM 6.8

  A flaw in Google Chrome's platform integration layer on Windows allows attackers to trick users into running malicious files that execute arbitrary code on their system. The vulnerability requires specific user interaction—the attacker must convince the victim to perform particular UI gestures when opening a crafted file. While Chrome's vendor assessment rates this as low severity, the combination of remote reach and code execution capability elevates the practical risk for organizations with large user populations.

• CVE-2026-10175MEDIUM 6.3

  A code injection vulnerability exists in Aider-AI Aider version 0.86.3 within the Architect Mode feature. An authenticated user can manipulate the editor_coder.run function in auth.py to inject and execute arbitrary code on the system. The flaw requires valid credentials to exploit but no additional user interaction, making it a direct threat to organizations using this development assistance tool. Public exploit code is already available.

• CVE-2026-44287MEDIUM 6.3

  FastGPT, an AI Agent building platform, contains a sandbox escape vulnerability in versions before 4.15.0-beta1. The issue stems from an incomplete regex filter designed to block dynamic imports in a JavaScript sandbox environment. An attacker with valid platform access can craft a specially formatted import statement using block comments to bypass the filter, gaining the ability to execute arbitrary system commands within the sandbox container. This allows an authenticated user to break out of the intended sandbox isolation and run code with the permissions of the sandbox process.

• CVE-2026-10688MEDIUM 5.5

  A code injection vulnerability exists in ahujasid blender-mcp, a tool used for integrating Blender with model context protocol systems. An authenticated attacker can inject and execute arbitrary code by manipulating the 'code' parameter passed to the execute_blender_code function in the server. The vulnerability has been publicly disclosed and exploit code is available. The project uses rolling releases, making it difficult to identify fixed versions; however, the maintainers have been notified but have not yet responded with a patch or mitigation guidance.

• CVE-2026-11157MEDIUM 5.4

  A script injection vulnerability in Google Chrome's accessibility features allows attackers to inject arbitrary scripts and HTML into web pages if a user installs a malicious extension. The vulnerability, tracked as CVE-2026-11157, requires user interaction (installing an extension) to exploit, making it a social engineering vector rather than a network-based attack. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-41159MEDIUM 5.3

  Mermaid, a popular JavaScript library for creating diagrams from text, contains a CSS injection vulnerability in its configuration options. Attackers can inject malicious CSS through the fontFamily, themeCSS, and altFontFamily settings that breaks out of the intended diagram sandbox and affects the entire web page. This could enable page defacement or extraction of sensitive information through CSS selectors. The vulnerability affects versions before 10.9.6 and 11.15.0, and has been patched in those releases.

• CVE-2026-0414MEDIUM 4.5

  NETGEAR has a vulnerability in certain router models that allows authenticated administrators on the local network to bypass input validation controls and modify the router's software and core functionality without proper authorization checks. While the attacker must already have administrative credentials and be connected locally, the lack of proper validation on modification requests means an insider threat or compromised admin account could alter router behavior in ways the organization doesn't intend or expect.

• CVE-2026-10153MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability has been identified in westboy CicadasCMS. The flaw exists in the Search function and can be exploited by manipulating a specific argument to inject malicious scripts. An attacker can send a crafted request to a vulnerable instance to execute arbitrary JavaScript in the context of other users' browsers, potentially stealing session data, credentials, or performing actions on their behalf. Exploitation requires user interaction (such as clicking a malicious link) but does not require authentication. A proof-of-concept has already been published, increasing practical risk.

• CVE-2026-10173MEDIUM 4.3

  Orthanc Explorer 2 versions up to 1.12.0 contain a reflected cross-site scripting (XSS) vulnerability in the StudyList component. An attacker can craft a malicious URL with a specially crafted 'remote-source' parameter that, when visited by a user, executes arbitrary JavaScript in their browser within the context of the Orthanc application. This allows theft of session tokens, modification of data, or unauthorized actions performed on behalf of the victim. The vulnerability requires user interaction—a victim must click a malicious link—but can be exploited remotely without authentication.

• CVE-2026-10289MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in Hotel and Tourism Reservation System version 1.0. An attacker can inject malicious scripts by manipulating parameters in the reservation form—specifically the name, email, people count, or booking number fields in the /ht/tour.php file. When a victim visits a crafted link or page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or defacement. Public exploits are available, increasing active exploitation risk.

• CVE-2026-10301MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0. An attacker can craft a malicious URL containing JavaScript code in the 'page' parameter of index.php. When a user visits this link, the script executes in their browser, potentially allowing theft of session cookies, credential capture, or malware redirection. The vulnerability requires user interaction (clicking a link) but poses a meaningful risk to organizations running this system, especially those handling sensitive fee or financial data.

• CVE-2026-10810MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0 and earlier. The flaw is located in the /navbar.php file, where unsanitized input in the 'page' parameter allows an attacker to inject malicious scripts. An attacker can craft a malicious URL and trick a user into clicking it, causing the injected script to execute in the victim's browser. This could lead to session hijacking, credential theft, or malware distribution. Public exploit code is available, increasing the risk of opportunistic attacks.

• CVE-2026-11337MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in tittuvarghese CollegeManagementSystem affecting the fetch.php endpoint. An attacker can inject malicious scripts through the department_name parameter, which are then executed in a victim's browser when they interact with a crafted link. The attack requires user interaction but no authentication, making it a practical threat in educational environments where students and staff may click on shared links. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-11436MEDIUM 4.3

  Mage AI versions up to 0.9.79 contain a reflected cross-site scripting (XSS) vulnerability in the sign-in flow. An attacker can craft a malicious URL with a manipulated redirect parameter that, when clicked by a user, executes JavaScript in the victim's browser within the context of the Mage AI application. The vulnerability requires user interaction—someone must click the malicious link—but no authentication is needed to trigger it. Public exploit details are now available.

• CVE-2026-11512MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability has been discovered in itsourcecode Hospital Management System version 1.0. The flaw exists in the billing module (/billing.php) and can be triggered by manipulating the patientid parameter. An attacker can craft a malicious link or form that, when clicked by a hospital staff member or administrator, injects arbitrary JavaScript into their browser session. This could allow the attacker to steal session credentials, modify billing records, or perform unauthorized actions on behalf of the logged-in user. The vulnerability requires user interaction (a victim must click a malicious link) but needs no authentication to set up the attack. Public exploit details are available, increasing real-world risk.

• CVE-2026-11518MEDIUM 4.3

  SourceCodester Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in its user management functionality. An attacker can inject malicious code through the fullname or username fields in the /users.php file, which is then reflected back to users viewing that data. While the vulnerability requires user interaction (such as clicking a malicious link), it could be exploited remotely to steal session cookies, redirect users, or perform actions on their behalf within the application.

• CVE-2026-10228LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in the raisulislamg4 student_management_system_by_php project. The flaw resides in the admission_form_check.php file, where user input passed through the Message parameter is not properly sanitized before being reflected in the web response. An authenticated attacker can craft malicious input that, when viewed by another user, executes arbitrary JavaScript in their browser. The vulnerability requires user interaction (clicking a malicious link) and affects only the integrity of data, not confidentiality or availability. Public exploit details are available, though the CVSS 3.5 score reflects the relatively constrained attack scenario requiring authentication and browser-based execution.

• CVE-2026-10234LOW 3.5

  Mettle sendportal versions up to 3.0.1 contain a cross-site scripting (XSS) vulnerability in the Campaign Handler component. An authenticated attacker can inject malicious scripts through the content parameter in the /webview/ endpoint, potentially allowing them to steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. The vulnerability requires user interaction to be effective and does not grant direct administrative access. Exploit code is publicly available, elevating practical risk despite the low CVSS score.

• CVE-2026-10244LOW 3.5

  SourceCodester Pharmacy Sales and Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in the medicine name creation function. An authenticated user can inject malicious script code through the medicine_name parameter, which executes in the context of other users' browsers. The vulnerability requires user interaction (clicking a link or visiting a page) to trigger, and an attacker must have valid login credentials to exploit it. Public exploits are now available.

• CVE-2026-10245LOW 3.5

  SourceCodester Pharmacy Sales and Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in its supplier creation functionality. An authenticated user can inject malicious code through the company name field when creating a supplier record. This code executes in the browsers of other users who view the supplier information, potentially allowing attackers to steal session tokens, redirect users to malicious sites, or perform unauthorized actions on their behalf. Public exploits for this vulnerability are already available.

• CVE-2026-10246LOW 3.5

  A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System version 1.0. An authenticated user can inject malicious scripts through the medicine presentation creation function, which are then executed in the browsers of other users who view that data. The attack requires user interaction and does not grant elevated privileges, but can be used to steal session tokens, redirect users, or perform actions on their behalf within the application.

• CVE-2026-10247LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System version 1.0. An authenticated attacker can inject malicious scripts through the generic_name parameter in the create_generic_name function, which the application will then execute in users' browsers. This could allow the attacker to steal session cookies, hijack user accounts, or manipulate pharmacy data. The vulnerability requires user interaction to trigger and an authenticated account to exploit, limiting its immediate impact, but public exploit code is now available.

• CVE-2026-10567LOW 3.5

  A stored cross-site scripting (XSS) vulnerability exists in 1Panel-dev CordysCRM versions up to 1.4.1. An authenticated attacker can inject malicious JavaScript into the Description field of the ModuleFormController, which will execute in the browsers of other users who view the affected module form. The vulnerability requires user interaction (viewing the crafted form) to trigger, and does not grant the attacker direct access to sensitive data or system functions. Upgrading to version 1.7.0 resolves the issue.

• CVE-2026-11520LOW 3.5

  SourceCodester Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in the header.php file that allows authenticated users to inject malicious scripts through multiple parameters. An attacker with valid credentials can craft a specially crafted request to inject JavaScript that executes in the browsers of other users, potentially stealing session data or performing unauthorized actions on their behalf. Public exploit code is available, increasing the practical risk despite the low CVSS score.

• CVE-2026-11534LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in imvks786's student_management_system application. The flaw allows attackers to inject malicious scripts through the name, address, or fname parameters in the /add.php file. An attacker with authenticated access can craft a malicious request that, when clicked by another user, executes arbitrary JavaScript in that user's browser. The vulnerability is publicly known, and the development team has been notified but has not yet responded with a patch.

• CVE-2026-10112LOW 2.4

  CVE-2026-10112 is a stored or reflected cross-site scripting (XSS) vulnerability in the Dashboard Page component of STUDENT-MANAGEMENT-SYSTEM version 1.0. An attacker with high privileges can inject malicious scripts through the Name parameter, which are then executed in the browsers of users who view the affected page. The vulnerability requires user interaction and has a low CVSS score of 2.4, but exploitation has already been disclosed publicly.

• CVE-2026-10514LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in CordysCRM versions up to 1.6.2. The flaw is located in a request parameter handling component and allows attackers with administrative privileges to inject malicious scripts that execute in users' browsers. While public exploit code is available, the attack requires both high-level credentials and user interaction (such as clicking a malicious link), significantly limiting real-world risk. Upgrading to version 1.7.0 resolves the issue.

• CVE-2026-10529LOW 2.4

  A cross-site scripting (XSS) vulnerability has been discovered in westboy CicadasCMS affecting the Task Scheduling Management Module. The flaw exists in the ScheduleJobController component and can be triggered by an authenticated user with elevated privileges through a specially crafted request. While the vulnerability requires administrative or high-privilege access to exploit, the presence of user interaction (rendering) combined with public availability of exploit details elevates attention. The CMS uses a rolling release model, making definitive version tracking difficult, though the affected commit hash has been identified.

• CVE-2026-11338LOW 2.4

  A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Ship Ferry Ticket Reservation System version 1.0. An authenticated administrative user with high privileges can inject malicious JavaScript into the Username parameter on the user management page, which executes in the browsers of other users who view the manipulated content. The vulnerability requires user interaction and administrative access to trigger, limiting its immediate exposure but potentially enabling unauthorized account manipulation or credential theft within administrative workflows.

• CVE-2026-11434LOW 2.4

  FluentCMS version 0.0.5 contains a cross-site scripting (XSS) vulnerability in its Blocks Plugin, specifically within the /admin/blocks file. An authenticated administrator with high privileges can inject malicious scripts that execute in the browsers of other users viewing the affected page. The vulnerability requires user interaction (such as clicking a link) to trigger. Public exploit code is available, though the low CVSS score reflects the requirement for high-privilege authentication and user interaction to succeed.

• CVE-2026-11468LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in SourceCodester Hospitals Patient Records Management System version 1.0. An authenticated administrator with high privileges can inject malicious scripts through the room_types page by manipulating the room parameter. When another user visits the affected page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or malware distribution. The vulnerability requires both administrative access to initiate the attack and user interaction (clicking a link or visiting a crafted URL) for the payload to execute. While the CVSS score is low, the healthcare context and potential for patient data exposure warrant careful attention.

• CVE-2026-11491LOW 2.4

  CodeAstro Human Resource Management System version 1.0 contains a stored cross-site scripting (XSS) vulnerability in its Notice Board Management feature. An attacker with high privileges can inject malicious JavaScript into the Notice Title field, which is then executed in the browsers of other users viewing that notice. The vulnerability requires user interaction (a victim must view the affected notice) and has already been disclosed publicly with exploit code available.