code-injection
1 live · 48 on record · last incident 5 days ago
Live1
- liveSignalWire FreeSwitch CVE-2026-116779: SignalWire FreeSwitch Code Injection Vulnerability
Patch now · Exploited · Partly patched · since 9 Nov 2026 · CVE-2026-116779
SignalWire FreeSwitch contains a code injection vulnerability allowing configuration disclosure and arbitrary command execution. The issue is actively exploited in the wild and has been added to CISA's KEV catalog.
Do:Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.
Earlier47
- closed6.3ComfyUI + custom nodes CVE-2026-108962: Code injection in comfyui_segment_anything
Patch now · Disclosed · since 13 Oct 2026 · CVE-2026-108962
AI - closed8.8Langflow CVE-2026-97679: IBM Langflow OSS code injection vulnerability
Patch now · Disclosed · since 7 Oct 2026 · CVE-2026-97679
AI - closed7.8NVIDIA NeMo CVE-2026-65111: NVIDIA NeMo Speech Code Injection Vulnerability
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-65111
AI - closed7.0NVIDIA NemoClaw CVE-2026-65082: Code injection vulnerability in NVIDIA NemoClaw migration command
Patch now · Disclosed · since 25 Aug 2026 · CVE-2026-65082
AI - closed9.0Flowise CVE-2026-73486: Code injection in Flowise CSV Agent node
Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73486
AI - closed9.0Flowise CVE-2026-73485: Code injection vulnerability in Flowise Airtable Agent node
Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73485
AI - closed8.5Langflow CVE-2026-17633: IBM Langflow OSS Authenticated Code Injection
Patch now · Disclosed · since 5 Aug 2026 · CVE-2026-17633
AI - closed8.8Langflow CVE-2026-8478: IBM Langflow OSS Code Injection Vulnerability
Patch now · Disclosed · since 5 Aug 2026 · CVE-2026-8478
AI - closed9.9Langflow CVE-2026-9135: IBM Langflow OSS code injection via ToolGuard dynamic fields
Patch now · Disclosed · since 17 Jul 2026 · CVE-2026-9135
AI - closed5.3Langflow CVE-2026-12822: Code injection vulnerability in Langflow URL loader
Patch now · Disclosed · since 22 Jun 2026 · CVE-2026-12822
AI - closed7.8NVIDIA NeMo CVE-2026-24155: NVIDIA NeMo Framework contains code injection vulnerability
Patch now · Disclosed · since 16 Jun 2026 · CVE-2026-24155
AI - closed10.0ChromaDB ChromaDB Python Project Contains Pre-Authentication Code Injection Vulnerability
Patch now · Disclosed · since 18 May 2026 · CVE-2026-45829
AI - closed9.8Guardrails AI CVE-2026-31233: Guardrails AI code injection in Hub installer
Supply chain · Disclosed · since 12 May 2026 · CVE-2026-31233
AI - closed8.8Langflow CVE-2026-7700: Langflow LambdaFilterComponent code injection vulnerability
Patch now · Disclosed · since 3 May 2026 · updated 5 Oct 2026 · CVE-2026-7700
AI - closedLangflow Langflow Smart Transform prompt injection and code execution vulnerability
Patch now · Disclosed · since 3 May 2026
AI - closed6.3SGLang CVE-2026-7669: Code injection vulnerability in sgl-project SGLang
Patch now · Disclosed · since 2 May 2026 · CVE-2026-7669
AI - closed9.4Flowise CVE-2026-41137: Flowise CSVAgent Code Injection RCE
Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41137
AI - closed7.8NVIDIA NeMo CVE-2025-33236: NVIDIA NeMo Framework Code Injection Vulnerability
Patch now · Disclosed · since 18 Feb 2026 · CVE-2025-33236
AI - closed7.8NVIDIA NeMo CVE-2025-33249: Code injection vulnerability in NVIDIA NeMo Framework
Patch now · Disclosed · since 18 Feb 2026 · CVE-2025-33249
AI - closed7.1Langflow CVE-2026-0771: Langflow PythonFunction Code Injection Vulnerability
Patch now · Disclosed · since 23 Jan 2026 · CVE-2026-0771
AI - closed9.8Langflow CVE-2026-0768: Langflow Validate Endpoint Code Injection Vulnerability
Patch now · Disclosed · since 23 Jan 2026 · CVE-2026-0768
AI - closed9.8Langflow CVE-2026-0769: Langflow eval_custom_component_code RCE Vulnerability
Patch now · Disclosed · since 23 Jan 2026 · CVE-2026-0769
AI - closed7.8Hugging Face libraries Hugging Face Transformers SEW-D convert_config Code Injection RCE
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14927
AI - closed7.8Hugging Face libraries Hugging Face Transformers HuBERT convert_config Code Injection RCE
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14928
AI - closed7.8NVIDIA NeMo CVE-2025-33226: NVIDIA NeMo Framework Code Injection Vulnerability
Patch now · Disclosed · since 16 Dec 2025 · CVE-2025-33226
AI - closed7.8NVIDIA NeMo CVE-2025-33204: NVIDIA NeMo Framework Code Injection Vulnerability
Patch now · Disclosed · since 25 Nov 2025 · CVE-2025-33204
AI - closed7.8NVIDIA NeMo CVE-2025-33178: Code injection vulnerability in NVIDIA NeMo bert services
Patch now · Disclosed · since 11 Nov 2025 · CVE-2025-33178
AI - closed7.3Open WebUI CVE-2025-64496: Open WebUI code injection via SSE events
Patch now · Disclosed · since 7 Nov 2025 · updated 8 Nov 2025 · CVE-2025-64496
AI - closed8.7Claude Code + SDKs CVE-2025-59536: Claude Code startup trust dialog code injection vulnerability
Patch now · Disclosed · since 3 Oct 2025 · CVE-2025-59536
AI - closed7.8NVIDIA NeMo CVE-2025-23307: NVIDIA NeMo Curator code injection vulnerability
Patch now · Disclosed · since 26 Aug 2025 · CVE-2025-23307
AI - closed7.8NVIDIA NeMo CVE-2025-23314: NVIDIA NeMo Framework code injection vulnerability
Patch now · Disclosed · since 26 Aug 2025 · CVE-2025-23314
AI - closed7.8NVIDIA NeMo CVE-2025-23313: NVIDIA NeMo Framework code injection vulnerability
Patch now · Disclosed · since 26 Aug 2025 · CVE-2025-23313
AI - closed7.8NVIDIA NeMo CVE-2025-23312: NVIDIA NeMo Framework Retrieval Services Code Injection
Patch now · Disclosed · since 26 Aug 2025 · CVE-2025-23312
AI - closed7.8NVIDIA NeMo CVE-2025-23315: NVIDIA NeMo Framework Export Component Code Injection
Patch now · Disclosed · since 26 Aug 2025 · CVE-2025-23315
AI - closed7.8NVIDIA NeMo CVE-2025-23304: NVIDIA NeMo Model Loading Code Injection Vulnerability
Patch now · Disclosed · since 13 Aug 2025 · CVE-2025-23304
AI - closedAmazon Q Malicious Wiping Command Found in Amazon Q AI Assistant Release
Supply chain · Exploited · since 17 Jul 2025
AI - closed9.8Langflow Langflow Vulnerable to Code Injection via Validate Code Endpoint
Patch now · Disclosed · since 7 Apr 2025 · CVE-2025-32375
AI - closed9.3Langflow CVE-2025-3248: Langflow Code Injection Vulnerability
Patch now · Exploited · since 7 Apr 2025 · updated 17 Jun 2025 · CVE-2025-3248
AI - closed8.8Dify CVE-2024-10252: Code injection vulnerability in Dify sandbox service
Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-10252
AI - closed10.0ComfyUI + custom nodes CVE-2024-21577: Code injection vulnerability in ComfyUI-Ace-Nodes
Patch now · Disclosed · since 13 Dec 2024 · CVE-2024-21577
AI - closed10.0ComfyUI + custom nodes CVE-2024-21576: Code injection vulnerability in ComfyUI-Bmad-Nodes
Patch now · Disclosed · since 13 Dec 2024 · CVE-2024-21576
AI - closed9.8LangChain family CVE-2024-46946: LangChain Experimental Eval Injection vulnerability
Patch now · Disclosed · since 19 Sep 2024 · CVE-2024-46946
AI - closed9.8Gradio CVE-2024-39236: Code injection vulnerability in Gradio component_meta.py
Patch now · Disclosed · since 1 Jul 2024 · CVE-2024-39236
AI - closed7.2LiteLLM CVE-2024-4264: LiteLLM Unsafe Eval Remote Code Execution
Patch now · Disclosed · since 18 May 2024 · CVE-2024-4264
AI - closed7.6Flowise Flowise Remote Code Injection Vulnerability
Patch now · Disclosed · since 29 Apr 2024 · CVE-2024-31621
AI - closed9.8LangChain family CVE-2023-36095: langchain Code Injection vulnerability
Patch now · Disclosed · since 5 Aug 2023 · CVE-2023-36095
AI - closed9.8LangChain family CVE-2023-29374: LangChain code injection via LLMMathChain
Patch now · Disclosed · since 5 Apr 2023 · CVE-2023-29374
AI