#CWE-94
All CosmicBytez Labs articles tagged #CWE-94, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-12866: expr-eval npm Package Enables Arbitrary Code Execution via toJSFunction()
All versions of the expr-eval JavaScript package are vulnerable to remote code execution through the toJSFunction() API. Crafted expressions escape the...
- Security
CVE-2026-49774: RD Station WordPress Plugin Remote Code Injection (CVSS 9.9)
A critical code injection vulnerability in the RD Station WordPress plugin allows unauthenticated remote code execution through Remote File Inclusion,...
- Security
CVE-2026-7465: RCE in Spectra Gutenberg Blocks WordPress Plugin (CVSS 8.8)
A high-severity remote code execution vulnerability in the Spectra Gutenberg Blocks plugin for WordPress allows authenticated Contributor-level attackers...
- Security
CVE-2026-6279: Avada Builder Unauthenticated RCE via PHP
A critical CVSS 9.8 vulnerability in the Avada Builder (fusion-builder) WordPress plugin allows unauthenticated attackers to execute arbitrary PHP...
- Security
CVE-2026-22679: Weaver E-cology 10.0 Unauthenticated Remote
A critical unauthenticated RCE vulnerability in Weaver (Fanwei) E-cology 10.0 allows attackers to execute arbitrary commands by abusing an exposed Dubbo...
- Security
CVE-2026-1540: Spam Protect CF7 WordPress Plugin PHP Log RCE
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows an editor-level attacker to achieve Remote Code Execution by logging a crafted...
- Security
CVE-2026-27876 — Grafana Critical RCE via SQL Expression
A chained attack exploiting SQL Expressions combined with a Grafana Enterprise plugin can lead to remote arbitrary code execution. All Grafana users...