Arbitrary file upload in Cadmium CMS 0.4.9 through /admin/content/filemanager/uploads allows an attacker who can reach the back-office content file manager to place a server-side executable file, potentially achieving code execution with high confidentiality, integrity and availability impact. The supplied CVSS score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment uses PR:L because the /admin/ path indicates an authenticated backend session is likely required; the exact role and whether uploads are web-executable are not stated in the available sources. A public PoC reference exists in the vendor GitHub issue but is not verified as working exploit code; active exploitation is not confirmed in CISA KEV data, EPSS is 0.38% (32nd percentile), and the vuln.today priority is act_now.
Remote code execution in 5ire 0.15.2 and earlier arises because the desktop AI assistant renders Mermaid diagrams with securityLevel set to 'loose', allowing attacker-supplied HTML/JavaScript embedded in Markdown to execute inside the Electron renderer and potentially reach the host OS. An unauthenticated network attacker can deliver the malicious Markdown through model responses or shared conversations, but exploitation requires the victim to render the content (UI:R). Publicly available exploit code exists; there is no confirmed active exploitation (not in CISA KEV).
Authenticated command injection in Coolify's PostgreSQL initialization-script filename handling allows users with application or service management permissions to execute arbitrary commands as root on managed servers. All Coolify 4.0.0 beta builds prior to beta.451 are affected, publicly available exploit code exists, and the upstream fix also covers database names used in backup configuration. EPSS is low at 0.41% (61st percentile), but the impact is severe for multi-user or multi-tenant deployments where lower-trust operators hold management rights.
Coolify versions prior to 4.0.0-beta.451 pass user-supplied database names unsanitized into shell commands executed via docker exec on managed servers, allowing an authenticated user with application/service management permissions to run arbitrary commands as root. Exploitation is remote but requires a valid management-capable account (PR:L), so the realistic exposure is multi-user, multi-tenant, or credential-compromise scenarios rather than anonymous mass exploitation. Publicly available exploit code exists and EPSS is modest at 0.41% (61st percentile); no confirmed active exploitation (CISA KEV) at time of analysis.
Authenticated Coolify users who hold application or service management permissions can execute arbitrary commands as root on managed servers by supplying a crafted file_storage_directory_source value in the File Storage Directory Mount Path feature. The parameter reaches shell command construction without sanitization, so shell metacharacters enable full host compromise; no victim interaction is required, but the attacker must already be authenticated with management rights. Publicly available exploit code exists, the vendor fixed the flaw in 4.0.0-beta.451, and EPSS is low at 0.20%, suggesting limited observed exploitation at time of analysis.
Authenticated command injection in Coolify before 4.0.0-beta.451 lets users with application or service management permissions execute arbitrary commands as root on managed servers by supplying a Dynamic Proxy Configuration filename containing shell metacharacters. Exploitation requires a valid low-privilege Coolify account and no user interaction; unauthenticated or read-only users cannot trigger it directly. Publicly available exploit code exists, but EPSS is only 0.20% (41st percentile), and risk is concentrated in multi-user or shared deployments where service-management roles are broadly granted or an operator account is compromised.
Unsafe pickle deserialization in Hugging Face smolagents' remote Python executor allows remote, unauthenticated attackers to execute arbitrary code in the context of the service account running the library (CVSS 10.0 with scope change). Exploitation is conditional: the deployment must expose the remote Python executor such that attacker-controlled data reaches the pickle parsing path, but once that path is reachable the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials or user interaction are needed. No public exploit code identified at time of analysis and EPSS is modest at 1.09% (65th percentile), so the practical risk is driven almost entirely by whether an organization has exposed the executor to untrusted input.
Certificate-validation bypass in Eclipse Cyclone DDS before 0.10.5 lets unauthenticated network attackers defeat the DDS Security authentication plugin's certificate checks, and per the advisory execute commands with System privileges. The flaw stems from improper verification of certificate time/expiration (CWE-298), meaning expired or otherwise time-invalid certificates can be accepted as valid, enabling impersonation of trusted DDS participants. The EPSS score is low (0.30%, 22nd percentile) and there is no CISA KEV listing, so despite the maximal 10.0 CVSS there is no confirmed active exploitation at time of analysis.
Improper validation of permissions/ticket revocation in eProsima Fast-DDS 3.3.0 allows revoked or no-longer-valid security credentials to be accepted, permitting unauthorized participants to join a secured DDS domain and exchange data over connections that should have been refused. The flaw sits in the DDS Security access-control layer (Permissions handling) and undermines the confidentiality and integrity guarantees of an otherwise authenticated domain. Rated CVSS 10.0 with a scope change, but EPSS is low (0.30%, 22th percentile) and there is no public exploit identified at time of analysis, so real-world risk is narrower than the base score implies.
Command injection in the Linksys E5600's ddnsStatus handler exposes firmware 1.1.0.26 to remote OS command execution through the router's web management interface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 because no privileges or user interaction are required, although the sources do not specify the vulnerable parameter or confirm whether an existing admin session is needed. No CISA KEV entry is supplied; EPSS is 1.27% (70th percentile), a public GitHub reference documents the ddnsStatus issue but working exploit code is not confirmed here, and the vuln.today decision label is act_now.
Command injection in the Netgear EX8000 Wi-Fi range extender running firmware 1.0.0.126 lets remote attackers pass unsanitized input through the switch_status function into a system command, potentially yielding arbitrary command execution with high confidentiality, integrity and availability impact (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The CVSS vector claims no privileges are required, though the available sources do not confirm the exact parameter, endpoint, or whether prior authentication is needed; in practice the affected administrative functionality is typically reachable only from the local or trusted network, which constrains real-world exposure. Exploitation is not confirmed in CISA KEV, but a public proof-of-concept reference exists (a detailed PDF and a demonstration video published by a third-party researcher); EPSS is 1.18% (67th percentile) and the vuln.today decision label is act_now, so signals are mixed but lean toward elevated priority.
NVIDIA Isaac Launchable 1.0 runs components with more privileges than their function requires (CWE-250), so an attacker who can reach or drive those privileged execution paths could obtain code execution, escalate privileges, cause denial of service, or tamper with and disclose data. Only environments that actually deploy Isaac Launchable - a specialized NVIDIA robotics/AI developer component - are exposed, which sharply limits the affected population, and no public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 0.81% (56th percentile), consistent with low observed exploitation activity. Note a scoring divergence: NVIDIA/NVD publishes 9.8 with AV:N/AC:L/PR:N/UI:N, while our assessment scopes the realistic attack vector to local access with low privileges (AV:L/AC:L/PR:L/UI:N), since the privilege-scoping weakness most plausibly requires an existing foothold or the ability to feed input to the over-privileged launchable rather than anonymous remote reach.
NVIDIA Isaac Launchable 1.0 executes launch operations with unnecessary privileges (CWE-250), allowing an attacker who can influence the launch path to inherit the component's elevated rights and potentially achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. NVIDIA's advisory assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), but independent analysis assesses local, low-privileged exploitation (AV:L/AC:L/PR:L/UI:N) as the more realistic precondition pending confirmation of exposure requirements from NVIDIA advisory 5749. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 0.69%.
Unauthenticated remote attackers can bypass authentication in NVIDIA Isaac Launchable 1.0 by using an embedded hard-coded credential (CWE-798), potentially achieving code execution, privilege escalation, denial of service, or data tampering. The issue is rated CVSS 9.8 critical with a PR:N/UI:N vector, meaning no legitimate account or user interaction is required. No CISA KEV listing or public exploit code is identified in the provided data; EPSS is 0.62% (49th percentile).
Unauthenticated remote attackers can coerce Conduit-derived Matrix homeservers into cryptographically signing arbitrary membership events, because the federating homeserver never checks that a signing request actually originated from the domain of the event's sender. Affected deployments are Conduit before 0.10.10, continuwuity before 0.5.0, tuwunel before 1.4.8, and Grapevine before commit 9a50c244; exploitation requires only that the server be reachable over open federation. Attackers can forge 'leave' events to eject any local user (including admins and bots) from rooms, forge 'invite' events to pull themselves into private or invite-only rooms when they control an account with invite power, and forge 'ban' events against users who share a server with the impersonated victim - yielding denial of service, removal of room policy protections, and disclosure of confidential room history and state. No public exploit code was identified at time of analysis, but the flaw is trivially reachable by anyone who can send federation traffic to the endpoint.
Unauthenticated arbitrary file read in the PhastPress WordPress plugin through 3.7 allows remote attackers to retrieve files from the site's webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) plus an allowed extension such as .txt to a requested path. The defect is a path-validation mismatch: getExtensionForURL() checks the URL-decoded path, while appendNormalized() truncates at the null byte before building the filesystem path, so the extension check passes for a different file than the one opened. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, a confidentiality-only impact despite NVD's 9.8 score; EPSS is 0.48% (40th percentile), and no public exploit identified at time of analysis or CISA KEV entry was provided.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Unauthenticated remote code execution in IceWarp 14 allows any network attacker who can reach the mail server's HTTP interface to run arbitrary OS commands as SYSTEM by sending a crafted X-File-Operation header. The flaw is a textbook OS command injection (CWE-78) rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that no credentials, user interaction, or special preconditions are needed beyond network reachability, and that the injected command inherits the privileges of the IceWarp service. Reported through Trend Micro ZDI as ZDI-CAN-27394 / ZDI-25-1072, at time of analysis there is no public exploit code identified and no indication of active exploitation in CISA KEV, though internet-exposed installs should be considered critically at risk until patched.
Serialization injection in LangChain JS affects @langchain/core before 0.3.80 and 1.0.0 through 1.1.7, plus langchain before 0.3.37 and 1.0.0 through 1.2.2, where Serializable.toJSON() fails to escape user-controlled objects containing an 'lc' key inside kwargs such as metadata, additional_kwargs, or response_metadata. If an application later deserializes that JSON with load(), injected data can be treated as legitimate LangChain objects, enabling secret extraction when pre-patch secretsFromEnv behavior is in effect or instantiation of classes already exposed through configured import maps. NVD rates this 9.1, but the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because meaningful exploitation requires the specific serialize-then-load workflow and, for the most damaging outcomes, permissive secret or import-map configuration; no public exploit was identified at time of analysis.