By weakness (CWE)

CWE-95: related vulnerabilities

CVEs classified under CWE-95. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

6 published vulnerabilities

• CVE-2026-14380HIGH 8.8

  DBI, a Perl database interface module, has a critical vulnerability in how it handles the Profile attribute. When this attribute receives untrusted input—from environment variables, direct code assignment, or database connection strings—DBI evaluates it as Perl code without proper validation. An attacker who controls any of these inputs can execute arbitrary commands on the affected system. The risk is particularly acute for exposed database brokers (DBI::Gofer or DBI::ProxyServer) where remote clients can inject malicious code through connection parameters.

• CVE-2026-50733HIGH 8.8

  Markdown Preview Enhanced, a popular markdown editor extension, contains a critical flaw in how it renders WaveDrom diagrams—a type of digital waveform visualization. Versions before 0.8.28 use JavaScript's eval() function to process diagram code, which means maliciously crafted markdown files can trick the software into executing arbitrary code on your machine. An attacker only needs to get you to open or export a booby-trapped markdown document; no interaction beyond that is required. The vulnerability works across all rendering modes: live preview, presentation slides, and HTML export. A patch is available that replaces the unsafe eval() with proper JSON parsing, eliminating the risk.

• CVE-2025-71361HIGH 8.1

  CVE-2025-71361 is a remote code execution vulnerability in picklescan, a library designed to detect malicious code in Python pickle files. Versions before 0.0.29 fail to catch a specific attack technique using idlelib.calltip.Calltip.fetch_tip calls. An attacker can craft a pickle file containing this hidden payload that executes arbitrary code when a victim loads it with pickle.load(), bypassing picklescan's safety checks entirely.

• CVE-2026-52858HIGH 7.8

  Vim's Python omni-completion feature contains a local code execution vulnerability. When you open a hostile Python file alongside a malicious Python package and trigger code completion, Vim automatically executes that package's initialization code with your user privileges. This happens because the editor adds the buffer's working directory to Python's module search path, allowing arbitrary code to run during the import process. The vulnerability requires local access and user interaction (invoking omni-completion), but once triggered, an attacker can run commands as the editing user.

• CVE-2026-11422HIGH 7.1

  Markdown Preview Enhanced, a popular VS Code extension that renders Markdown with enhanced visualization features, contains a critical flaw in how it processes WaveDrom diagrams. An attacker can craft a malicious Markdown file containing specially crafted WaveDrom code that, when previewed in VS Code, executes arbitrary JavaScript with the privileges of the extension. This JavaScript can then read files from your computer and write new files to your filesystem, potentially installing malware or stealing sensitive data. The vulnerability affects version 0.8.x when used with crossnote engine 0.9.28.

• CVE-2026-47167MEDIUM 5.3

  Vim, a widely-used command-line text editor, contains a code injection flaw in its Cucumber filetype plugin when Ruby support is enabled. The vulnerability arises from unsafe handling of step-definition patterns extracted from Ruby files in a repository's features or stories directories. When a user attempts to jump to a step definition using Vim's step-jump mapping, malicious patterns can execute arbitrary Ruby code and shell commands. This requires local access and user interaction—the attacker must first get the user to open a repository containing a crafted .rb file, then the user must trigger the vulnerable mapping. The issue is resolved in Vim version 9.2.0496.