CVE-2026-94169

CriticalCVSS 10.0/10Last modified Oct 16, 2026

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-94174.3A vulnerability was detected in code-projects Employee Management System 1.0. Affected is an unknown function of the file /myprofileup.php. CVE-2026-941707.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sas CVE-2026-941717.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency al CVE-2026-941735.4Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.CVE-2026-941747.6Administrator SQL Injection in Email Log <= 2.63 versions.CVE-2026-941767.1Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.CVE-2026-941778.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allow CVE-2026-941787.5Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.CVE-2026-941797.1Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.CVE-2026-94184.3A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the fil CVE-2026-941804.3Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This i CVE-2026-941817.4An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element th