Topic
10 articles
CyberSecureToday covers CWE-94 across 10 articles published between 27 Sep 2026 and 13 Oct 2026.
The coverage includes 10 vulnerability advisories. 10 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.
Stories on CWE-94 most often intersect with Remote Code Execution, Model Context Protocol and MCP, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Apache Struts 2 Dynamic Method Invocation Flaw Weaponized for Remote Code Execution”, was published 13 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
Threat IntelApache Struts resolves critical vulnerability S2-032 (CVE-2016-3081) where dynamic method invocation enables arbitrary remote command execution via OGNL payloads.
Threat IntelAnthropic and open-source MCP maintainers resolve CVE-2026-49110, an indirect prompt injection vulnerability allowing unauthorized tool execution in agentic pipelines.
MicrosoftMicrosoft MSRC advisory documents a critical model-context-protocol tool injection flaw in Azure AI Foundry enabling indirect agentic tool hijacking.
Threat IntelMetaMCP CVE-2026-79538 (9.8) and CVE-2026-79537 (9.1) enable container code execution and cross-tenant MCP tool hijacking. No patch exists; mitigations inside.
LinuxA critical vulnerability in Foreman allows authenticated users to escape the safemode Ruby templating sandbox via delegated method manipulation, executing commands as root.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.
Threat IntelA critical template injection flaw in Next.js next/og (CVE-2026-94545) allows unauthenticated remote attackers to execute arbitrary code via Satori SVG parsing.
Threat IntelA critical CVSS 9.8 remote code execution vulnerability in Code Runner Model Context Protocol servers permits arbitrary host code execution via untrusted AI agent tool calls.
Threat IntelA critical vulnerability in Langflow AI orchestration frameworks allows unauthenticated attackers to execute arbitrary code via insecure component endpoints.