CWE-95

224 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.

Critical 106High 84Medium 29Low 5Not scored 0

CVEs per yearBy the year they were published

CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
langflow-ai · langflow
ExploitedCritical9.3
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
xwiki · xwiki-platform
ExploitedCritical9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
geoserver · geoserver
ExploitedCritical9.8
CVE-2023-7101
Arbitrary Code Execution (ACE) Vulnerability
Douglas Wilson · Spreadsheet::ParseExcel
ExploitedHigh7.8

CVE-2026-120859
PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files
PyMoDAQ · PyMoDAQ
High8.5
CVE-2026-120499
h5io before 0.2.6 Arbitrary Code Execution via read_hdf5
h5io · h5io
High8.5
CVE-2026-114424
Code execution through double evaluation in address replacement rules
SEPPmail AG · SEPPmail Secure Email Gateway (SEG)
Critical9.2
CVE-2026-44344
Chamilo LMS: Conditional PHP execution through vendored QuickForm eval
chamilo · chamilo-lms
Medium6.6
CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt
Spreadsheet-XLSX
Critical9.8
CVE-2026-119121
Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for
unclecode · crawl4ai
Medium5.3
CVE-2026-90872
Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
Progress Software · WS_FTP Server
Medium6.6
CVE-2026-44179
XWiki Pro Macros: excerpt-include title and content injection executes code
xwikisas · xwiki-pro-macros
Critical9.9
CVE-2026-78497
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
JQ-Lite
High8.4
CVE-2026-111865
THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection
THU-MIG · yoloe
Medium4.8