CVE-2026-101887

Elo prior to 1.0.1 allows plain strings passed to the parser to use the .constructor.constructor property to reach the JavaScript Function object. The resulting generated JavaScript executes attacker-selected code in the host runtime, enabling browser script execution and arbitrary Node.js code execution.

Elo prior to 1.0.1 has a Ruby backend that embeds attacker-controlled text in double-quoted Ruby strings without escaping #. Ruby interpolation forms in the string-literal emitter or labelled subtype-constraint branch become executable Ruby, allowing Ruby code and shell command execution.

SolarWinds Dameware is affected by a command injection vulnerability that could lead to compromise of the remotely controlled host. Authentication is required.

An unauthenticated attacker with network access to SonicWall GMS 9.5.2 and earlier may be able to read internal GMS files, potentially exposing sensitive information.

Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 contains a flaw in the loadstring function of usr/lib/lua/luci/controller/api/zrUsb.lua (Lua Handler component). The manipulation causes code injection and can be exploited remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.

In Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0, an unauthenticated attacker could exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.

Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.