CWE-913

118 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 38High 34Medium 42Low 3Not scored 1

CVEs per yearBy the year they were published

CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
n8n-io · n8n
ExploitedCritical10.0

CVE-2026-121170
Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…
Google · Chrome
Not scored
CVE-2026-62848
Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
metalama · Metalama
High7.3
CVE-2026-118538
a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
a2ui-project · a2ui
Medium5.1
CVE-2026-116612
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect…
GStreamer project · gst-editing-services
High7.8
CVE-2026-102734
asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
lmfit · asteval
Medium5.5
CVE-2026-108948
code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
code-projects · Online Reviewer System
Medium5.3
CVE-2026-108819
agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
agno-agi · agno
Medium6.9
CVE-2026-103663
Path Traversal leading to Remote Code Execution in Ollama
Ollama · Ollama
Medium6.9
CVE-2026-105180
Jeebase UserService info updateUser dynamically-determined object attributes
Jeebase
Medium5.3
CVE-2026-92955
vm2 before 3.11.8 Sandbox Escape via NodeVM
patriksimek · vm2
Critical10.0