Unauthenticated root-level OS command injection in Lantronix EDS5000 serial device servers (EDS5032/EDS5008/EDS5016, firmware 2.1.0.0R3) lets remote attackers run arbitrary commands by embedding shell metacharacters in the HTTP RPC login username. When authentication fails, the RPC module builds a shell command to write a log entry and concatenates the attacker-supplied username without sanitization, so the injected payload executes as root. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though the EPSS probability is only 0.02%, indicating targeted rather than mass exploitation.
RCE in NetGain EM Plus 10.1.68. PoC available.
Arbitrary file upload in FileThingie 2.5.7 via ZIP archives. PoC available.
Command execution in SAPIDO RB-1732 V2.0.43 router. PoC available.
OGNL injection in Epross AVCON6 management platform. PoC available.
Path traversal in Vociferous speech-to-text tool before 4.4.2. CVSS 10.0.
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Insecure access control in Asseco SEE Live 2.0. Remote access to attachments.
Access control bypass in Winter CMS before 1.0.477/1.1.12/1.2.12. CVSS 9.9.
OS command injection in Cloud CLI (Claude Code UI) before 1.25.0. EPSS 0.39%.
LFI to RCE in IFTOP by WellChoose.
Unauthenticated REST endpoint in Datalogics Ecommerce Delivery WordPress plugin before 2.6.60.
Auth bypass in AdGuard Home before 0.107.73.
Missing auth in Taskosaur project management 1.0.0.
RCE in OpenClaw Agent Platform v2026.2.6 via prompt injection.
Auth bypass in HPE Aruba AOS-CX switch web management.
SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
SQL injection in Frappe framework before 15.84.0/14.99.0.
SQL injection in WeGIA before 3.6.6.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
Hardcoded password in ThermaKube Kubernetes monitoring.
SQL injection in generatedata 4.0.14.
File path control in Zoom Workplace for Windows Mail feature before 6.6.0.
Sandbox escape via Web Speech in Chrome before 146.0.7680.71. Patch available.
Remote attackers can completely bypass authentication on MR-GM5L-S1 and MR-GM5A-L1 devices to arbitrarily modify device configurations. The vulnerability requires no authentication, no user interaction, and low attack complexity (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), scoring 9.3 critical. EPSS exploitation probability is low (0.10%, 28th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis, suggesting limited real-world targeting to date despite the severe access control failure.
embedded SwiFTP FTP server component contains a vulnerability that allows attackers to log in without valid credentials.
Hard-coded credentials in MR-GM5L-S1 and MR-GM5A-L1 enable remote unauthenticated attackers to gain administrative access with critical CVSS 9.3 score. The CWE-798 flaw allows complete system compromise through embedded default credentials that cannot be changed by users. EPSS score of 0.04% (14th percentile) suggests low observed exploitation probability despite the critical severity, though authentication bypass capabilities make this a priority for affected deployments.
SSRF in Plunk email platform before 0.7.0.
Authentication bypass in Lantronix EDS3000PS device servers (firmware 3.1.0.0R2, EDS3016PS1NS and EDS3008PS1NS variants) lets a remote unauthenticated attacker reach protected management pages by appending a specific suffix to the request URL and supplying an Authorization header that uses 'admin' as the username. Successful bypass yields full administrative control of the serial-to-Ethernet device server without valid credentials. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3.
Blind SSRF in 2FAuth 2FA manager before 6.1.0.
Command injection in Cloud CLI (Claude Code UI) Git operations before 1.24.0.
Auth bypass in Unity Catalog 0.4.0 and earlier.
Default credentials in netbox-docker before 2.5.0.