Remote code execution in Liferay Portal Community Edition (CE) versions prior to 7.2.1 CE GA2 allows unauthenticated remote attackers to run arbitrary Java code by abusing the JSON web services (JSONWS) interface. This flaw is confirmed actively exploited (CISA KEV) - it was leveraged by the 'FreakOut' botnet - with publicly available exploit code and an EPSS score of 99.78% (100th percentile), placing it among the most likely to be exploited vulnerabilities. It carries a CVSS 9.8, reflecting network-reachable, no-authentication, no-interaction exploitation with full confidentiality, integrity, and availability impact.
The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.