Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-33017, CVSS 9.3) in the public flow build API that allows attackers to execute arbitrary Python code by supplying malicious flow data. KEV-listed with public PoC, this vulnerability enables anyone with network access to a Langflow instance to achieve server compromise through the API that builds public flows without authentication.
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achieve remote code execution with root privileges on the master node. The vulnerability affects Wazuh versions 4.0.0 through 4.14.2 and poses severe risk to organizations using Wazuh in distributed deployments, as compromise of any single worker node can lead to full cluster takeover. While no active exploitation has been reported (not in KEV), proof-of-concept materials are publicly available via the Google Drive link in the advisory.
This is a critical unauthenticated remote code execution vulnerability in Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit version 0.3.0. An attacker with network access via HTTP can completely take over the affected system without any authentication, privileges, or user interaction required. The CVSS score of 9.8 reflects maximum impact across confidentiality, integrity, and availability. There is no evidence of active exploitation (not in CISA KEV), and no proof-of-concept code has been publicly identified in the available intelligence.
Unauthenticated administrative account creation in DrangSoft GCB/FCB Audit Software (versions prior to 20260108) allows remote attackers to invoke exposed APIs without authentication and provision new admin users, granting full control of the audit platform. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. Despite the trivial attack path, EPSS is currently low (0.13%, 32nd percentile) and no public exploit identified at time of analysis.
JetKVM versions prior to 0.5.4 contain an authentication vulnerability that allows unlimited login attempts without rate limiting, enabling attackers to conduct brute-force attacks against user credentials. This affects KVM (Keyboard, Video, Mouse) over IP devices used for remote server management, potentially granting attackers administrative access to critical infrastructure. The vulnerability has been reported by CISA-CG and analyzed by security researchers at Eclypsium in their research on KVM device security risks.
Unrestricted authentication brute-forcing in GL-iNet Comet (GL-RM1) KVM web interface allows remote unauthenticated attackers to compromise device credentials and potentially pivot to connected systems. The web interface lacks rate limiting or account lockout mechanisms on login attempts, enabling dictionary and credential stuffing attacks against the network-accessible management console. EPSS score of 0.03% indicates low observed exploitation probability, though the 9.3 CVSS v4.0 reflects severe potential impact with cross-scope confidentiality and integrity compromise to subsequent systems. Vendor patch version 1.7.2 addresses the vulnerability per CISA advisory VA-26-076-01.
The Angeet ES3 KVM device contains an arbitrary file write vulnerability allowing remote, unauthenticated attackers to modify system files including configuration files and binaries, potentially leading to complete system compromise. All versions of the ES3 KVM appear to be affected based on EUVD version data (ES3 KVM 0 <*). This vulnerability has been reported by CISA and documented in their CSAF advisory VA-26-076-01, though no active exploitation (KEV) status has been indicated at this time.
Edimax GS-5008PL switches running firmware 1.00.54 and earlier contain an authentication bypass in the management interface that allows unauthenticated remote attackers to gain administrative access by exploiting a flawed global authentication flag mechanism. Once bypassed, attackers can modify administrator credentials, upload malicious firmware, and alter device configurations without any authentication required. No patch is currently available for this high-severity vulnerability.
Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauthenticated root code execution by exploiting insecure file permissions in the cluster synchronization protocol. An attacker with cluster node access can overwrite the manager's configuration file to inject malicious commands that are subsequently executed with root privileges by the logcollector service. This vulnerability affects multi-node Wazuh deployments and has no available patch.
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access to server-level cryptographic material to authenticate as any user and obtain elevated privileges. The vulnerability affects all ScreenConnect versions prior to 26.1 and carries a CVSS score of 9.0, indicating critical severity. While not currently listed in CISA's KEV catalog and with no public proof-of-concept available, the vulnerability's authentication bypass nature and potential for complete system compromise make it a high-priority patching target.