Command injection in radare2's PDB parser (versions <6.1.4) enables arbitrary command execution when analysts process maliciously crafted PE/PDB files containing newline bytes in section header names. Attack requires local file access and user interaction (opening the file with radare2's idp command). Publicly available exploit exists with EPSS score of 0.07% (22nd percentile), indicating low likelihood of mass exploitation but significant risk for targeted attacks against reverse engineers and malware analysts who routinely examine untrusted binaries.
Unauthenticated privilege escalation in AVEVA Pipeline Simulation
Server-side request forgery in ProcessWire CMS 3.0.255 and prior allows authenticated administrators to abuse the 'Add Module From URL' feature to issue outbound HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance, port scanning, and potential access to cloud metadata endpoints. A public exploit exists but requires admin credentials, limiting real-world risk.
We need to produce a JSON with specific fields. The input: CVE-2026-20186, a Cisco ISE vulnerability. Description says: authenticated, remote attacker with Read Only Admin to execute arbitrary commands on OS. Insufficient input validation, crafted HTTP request, user-level access then elevate to root. In single-node deployments, DoS possible. CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-77: Command Injection. EPSS 0.23% (46th percentile). KEV status not in input? Input does not mention KEV. Tags: Denial Of Service, Cisco, Command Injection, Cisco Identity Services Engine Software. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD lists many affected versions. CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:*. References: Cisco advisory, NVD, vuldb. No mention of POC or KEV in the multi-source intelligence. SSVC says exploitation: none and automatable: no (so no active exploitation, not automatable). So the exploitation status is "no public exploit identified at time of analysis". No KEV listing. We must synthesize all data. product_name: "Cisco Identity Services Engine Software" but maybe just "Cisco ISE"? The description says "Cisco Identity Services Engine (ISE)". So "Cisco Identity Services Engine" but too long? "Cisco ISE" might be recognized. "Cisco Identity Services Engine" is primary. I'll use "Cisco ISE" as product_name (1-3 words). "Cisco ISE" is okay (2 words). I'll use "Cisco ISE". But I can also say "Cisco Identity Services Engine Software". Three words: "Cisco ISE Software"? "Cisco ISE" is clear. Summary: Not copy description. Start with impact verb. Example: "Command injection in Cisco ISE allows authenticated remote attacker with Read-Only Admin privileges to achieve OS command execution and privilege escalation to root, leading to total compromise and potential denial of service." Use EPSS, KEV? No KEV, EPSS low (0.23%), so not actively exploited. So: "A command injection vulnerability in Cisco Identity Services Engine (ISE) allows an authenticated attacker with Read-Only Admin privileges to execute arbitrary commands on the underlying OS via crafted HTTP requests, potentially escalating to root. Successful exploitation can lead to full device compromise and, in single-node deployments, a denial-of-service condition. Cisco has released a patch." No active exploitation. I'll incorporate EPSS: low exploitation probability. So: "Command injection in Cisco Identity Services Engine (ISE) allows an authenticated remote attacker with Read-Only Admin credentials to execute arbitrary commands on the underlying operating system via crafted HTTP requests, leading to full compromise with root access and, in single-node deployments, denial of service. Although the CVSS score is 9.9 (critical), EPSS indicates low exploitation probability (0.23%) and no active exploitation has been observed." That's good. technical_context: Explain underlying tech, CWE-77 (Command Injection). Cisco ISE is a network access control policy engine. The vulnerability is command injection due to insufficient input validation. CPE indicates software versions. Reference CWE-77. So: "Cisco Identity Services Engine is a security policy management platform that controls network access. This vulnerability is a command injection (CWE-77) arising from insufficient validation of user input processed by the ISE web interface. The attacker can inject arbitrary commands that are executed on the underlying Linux-based operating system. Affected software versions include multiple patches of Cisco ISE 3.1, 3.2, 3.3, and 3.4 as listed in ENISA EUVD." I'll mention CPE. risk_assessment: Use CVSS vector, EPSS, SSVC, KEV (none), POC (none). Compare signals: CVSS 9.9 Critical, but PR:L (read-only admin), so authentication is needed; attack complexity low, scope changed, so high impact. EPSS 0.23% is low, percentile 46% (so below median). SSVC: exploitation none, automatable no, so not currently being exploited, and not easily automated. So real-world risk is moderate: requires authenticated access with at least Read-Only Admin, which is not trivial, but if compromised, full control. So: "CVSS 9.9 indicates a critical severity due to network vector, low attack complexity, low privileges, and scope change leading to high impacts. However, exploitation requires an attacker to have Read-Only Admin privileges (PR:L), which limits the pool of potential attackers to those who can obtain such credentials. EPSS score of 0.23% (46th percentile) suggests low likelihood of widespread exploitation in the wild. SSVC analysis shows no current exploitation and not automatable, further reducing the immediate urgency. Although the impact is total compromise, the need for authenticated access to the management interface lowers the real-world risk, though organizations with exposed admin interfaces or weak credential hygiene face higher risk." I need to note conflicting or missing data: no active exploitation, patch available. No conflicting signals. affected_products: List versions from EUVD enumeration. "Cisco Identity Services Engine Software versions 3.1.0 through 3.4 Patch 3 are affected. Specifically, multiple patch levels of 3.1, 3.2, 3.3, and 3.4 as listed by ENISA EUVD are vulnerable. The Cisco security advisory (cisco-sa-ise-rce-4fverepv) provides full details and fixed releases." I'll reference advisory URL. remediation: "Cisco has released software updates to address this vulnerability; upgrades to the latest patched versions are recommended. Refer to the Cisco advisory cisco-sa-ise-rce-4fverepv for specific fixed versions (e.g., 3.1.0 Patch 10 or later, 3.2.0 Patch 7 or later, 3.3 Patch 7 or later, 3.4 Patch 3 or later). As a workaround, restrict network access to the ISE management interface to trusted IPs only, and enforce strong credential policies to prevent unauthorized read-only admin access. However, these are compensating controls; applying the vendor patch is the definitive solution." Since the vulnerability requires authenticated access, restricting admin interface access can help. exploit_scenario: "An attacker who has obtained Read-Only Admin credentials (e.g., through phishing or credential reuse) could leverage the command injection via crafted HTTP request to achieve arbitrary command execution with user-level OS access, then elevate to root to take full control of the ISE node." So 2-3 sentences. exploitation_conditions: Extract concrete prerequisites: Must have at least Read-Only Admin credentials (authenticated). Attack vector is network, but exploitation requires sending crafted HTTP request to the management interface. So specific condition: "The attacker must have valid credentials with at least Read-Only Admin privileges on the Cisco ISE device’s management interface. No configuration changes are required; the vulnerability exists in the input validation of a web application component. Exploitation is limited by the need for authenticated access to the administrative web interface, making it inaccessible to unauthenticated external attackers unless credentials are obtained." Also mention that single-node deployments extra DoS condition? Not a condition for exploitation, but impact. So: "Exploitation requires valid credentials with Read-Only Admin role on the ISE management web interface, which is typically restricted to network administrators. There is no indication that default configurations or public-facing deployments without authentication are vulnerable; however, if the admin interface is exposed to the internet or accessible without multi-factor authentication, the attack surface increases." Avoid generic phrases. So: "Requires authenticated access with at least Read-Only Admin credentials on the Cisco ISE administrative HTTP interface. No other special conditions—the flaw is present in default configurations as long as the attacker can interact with the web application." That's specific. attack_chain: Use phases. Steps: Obtain Read-Only Admin credentials (recon/delivery) → Send crafted HTTP request to ISE web interface → Exploit command injection vulnerability → Execute arbitrary commands as user-level OS account → Elevate privileges to root → Achieve full compromise or denial of service. Short steps: "Obtain Read-Only Admin credentials" → "Send crafted HTTP request to ISE management web interface" → "Trigger command injection via insufficient input validation" → "Execute commands as unprivileged OS user" → "Elevate privileges to root" → "Full node compromise or single-node DoS". That's 6 steps. confidence_notes: "Cisco has confirmed the vulnerability and released a security advisory with patches. Affected versions are listed by ENISA. No active exploitation has been reported; CISA KEV does not include this CVE, and SSVC indicates exploitation: none and automatable: no. The EPSS score is 0.23%, indicating low likelihood of exploitation. The CVSS vector and description are consistent. Missing: proof of concept code is not publicly available at this time." But we don't know about POC; can say "No public exploit code has been identified at time of analysis." So: "Cisco advisory confirms the vulnerability and patch availability. No active exploitation has been observed (not in CISA KEV, SSVC exploitation: none). EPSS low. Affected versions are confirmed via EUVD and vendor advisory. No public proof-of-concept code has been released. The CVSS vector aligns with the description." That's fine. prevalence: Cisco ISE is a widely used network access control product in enterprise environments. So prevalence: "high". Justification: "Cisco ISE is a widely deployed enterprise access control solution." So prevalence_basis: "widely deployed enterprise access control solution". Good. assessed_cvss_vector: My own independent CVSS 3.1 vector. I need to adjust? I can use: AV:N (network, HTTP request), AC:L (no special complexity, just crafted request), PR:L (requires read-only admin), UI:N (no user interaction beyond the attack request), S:C (scope change, OS commands executed on underlying OS from the application component), C:H/I:H/A:H (full compromise). So replicating the given vector. I'll output "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H". That's identical. I need to justify: "Requires authenticated access (PR:L) but no user interaction and no complexity; scope change leads to full impact." So rationale: "Network vector with low complexity, low privileges (Read-Only Admin), and scope change results in total system compromise." That's good. assessed_cvss40_vector: Convert to CVSS 4.0 base vector. For base, we need AV, AC, AT, PR, UI, VC, VI, VA, SC, SI, SA. Attack Vector: Network (N). Attack Complexity: Low (L). Attack Requirements: None (N) — since no specific requirement, so AT:N. Privileges Required: Low (L). User Interaction: None (N). Vulnerable System Confidentiality: High (H) (commands executed on OS give access to data). Integrity: High (H). Availability: High (H). Subsequent System: None (N) for all, because it's the same system? Actually scope change from application to OS, but in CVSS 4.0, the Vulnerable System (the application web interface) is the first. The impact on the OS is considered a subsequent system? The vulnerable component is the web application, the subsequent system is the OS. So SC, SI, SA should reflect impact on the OS: High because full compromise. So "SC:H/SI:H/SA:H". But the CVSS 4.0 base vector uses VC/VI/VA for the vulnerable component's CIA, and SC/SI/SA for the subsequent system. So the vulnerable system is the web application itself: maybe not directly impacted? But the vulnerability is in the web app, and its exploitation leads to OS commands, so the web app's integrity might be compromised, but the impact is on the OS. In CVSS 3.1, scope changed, so the impacted component is the underlying OS (as subsequent system). For CVSS 4.0, we need to assign CIA to both components. The vulnerable component (the web app) might not suffer direct confidentiality/integrity/availability impact; it is used to execute code on a subsequent system. So VC/VI/VA could be N/N/N? But typical mapping: The attack results in execution of commands on the OS, so the vulnerable component (web app) might just be the vector, not directly impacted. But in CVSS 4.0, when scope changes, the vulnerable component gets some score from the subsequent. So I'll set VC:N, VI:N, VA:N (no direct impact on web app) and SC:H, SI:H, SA:H (full impact on OS). But that seems odd. Many assessments map S:C/C:H to SC:H in CVSS 4.
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Read Only Admin privileges to execute arbitrary operating system commands via crafted HTTP requests, resulting in full root access. The vulnerability, rated 9.9 (Critical), impacts multiple ISE versions; in single-node deployments, the affected device may become unavailable, causing denial of service. No active exploitation (KEV) or public exploit code has been identified, and the EPSS score of 0.21% indicates low likelihood of widespread attacks.
Authentication bypass in Visa Acceptance Solutions WordPress plugin (all versions through 2.1.0) allows unauthenticated remote attackers to gain complete account takeover by providing any user's email address during guest checkout. The vulnerability enables login as any existing user, including administrators, without password verification or email ownership validation. With a CVSS score of 9.8 (critical) and attack complexity of Low, this represents an immediate exploitation risk requiring no user interaction or privileges, though no public exploit or active exploitation (KEV) has been identified at time of analysis.
Privilege escalation to WordPress administrator via insecure token-based authentication in Barcode Scanner (+Mobile App) plugin versions ≤1.11.0 allows remote unauthenticated attackers to gain full administrative control. The plugin leaks valid admin authentication tokens through the 'barcodeScannerConfigs' action and accepts Base64-encoded user IDs without validation, enabling attackers to spoof admin credentials, extract legitimate tokens, and modify any user's 'wp_capabilities' meta to grant themselves administrator privileges. CVSS 9.8 (Critical) with network vector, low complexity, and no authentication required. Vendor patch deployed in changeset 3506824.
Unrestricted file upload in WebStack WordPress theme allows unauthenticated remote code execution. The io_img_upload() function in all versions through 1.2024 lacks file type validation, enabling unauthenticated attackers to upload malicious files (e.g., PHP shells) directly to the server. No public exploit identified at time of analysis, but EPSS score and attack complexity (CVSS AC:L) indicate straightforward exploitation. Critical severity (CVSS 9.8) warranted due to complete system compromise potential with zero authentication barriers.
Remote code execution in Slah CMS v1.5.0 and below allows unauthenticated attackers to inject and execute arbitrary code via a crafted input to the session() function in config.php. Proof-of-concept exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. With a CVSS score of 9.8 and a full-impact compromise, this vulnerability poses a critical risk to any exposed instance.
Improper certificate validation in the SSO integration with Control Hub for Cisco Webex Services allowed unauthenticated remote attackers to impersonate any user by supplying a crafted token to a service endpoint. This authentication bypass enables full unauthorized access to Cisco Webex meetings, messaging, and related resources. While no active exploitation or public exploit code is known, the high severity and low attack complexity merit immediate attention.
Remote code execution in Upsonic 0.71.6 allows unauthenticated attackers to execute arbitrary OS commands via crafted MCP tasks. Although an allowlist restricts commands, the permitted npm and npx commands accept flags that enable OS command injection. The vulnerability is automatable with total technical impact, but no exploitation has been observed and the EPSS score is very low (0.04%).
A heap buffer overflow in the ANGLE graphics layer engine in Google Chrome before 147.0.7727.101 may allow a remote attacker to escape the browser sandbox and execute arbitrary code on the host system by convincing a victim to visit a malicious website. Exploitation requires user interaction, and while no active exploitation has been reported, the criticality stems from the potential for full system compromise.
Dgraph distributed GraphQL database versions ≤25.3.1 expose admin authentication tokens through an unauthenticated /debug/pprof/cmdline endpoint, allowing remote attackers to retrieve the token from process command line arguments and gain full administrative access to the database. The vulnerability combines unauthenticated information disclosure (CWE-200) with subsequent authentication bypass, enabling configuration changes and operational control. Fixed in version 25.3.2 per vendor advisory GHSA-95mq-xwj4-r47p. CVSS 9.4 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation against default configurations with no authentication required.
Remote code execution in OpenText RightFax on Windows via unsafe deserialization allows unauthenticated attackers to execute arbitrary code. All versions through 25.4 are affected, spanning multiple major releases, with patches now available from OpenText. No public exploit or active exploitation has been identified at time of analysis, but the vulnerability is automatable and carries total technical impact.
Unauthenticated information disclosure in WordPress 3D FlipBook plugin ≤1.16.17 allows remote attackers to retrieve metadata of draft, private, and password-protected flipbooks via the send_post_pages_json() function missing a capability check. EPSS predicts very low exploitation probability (0.03%), but publicly available exploit code exists, and the attack requires no authentication or user interaction (CVSS 5.3). No evidence of active exploitation (not in CISA KEV) and SSVC flags automatable partial technical impact with no current exploitation.
GOST CTR block cipher in Bouncy Castle BC-JAVA processes only the first 255 blocks correctly, causing silent data corruption in encryption/decryption operations for longer messages. Affects BC-JAVA versions 1.59 through 1.83, with fix available in version 1.84. Local attack vector (CVSS AV:L) with critical CVSS 9.4 score reflects potential for both confidentiality and integrity compromise when applications process GOST-encrypted data streams exceeding 255 blocks (~4KB). No KEV listing or public
Hard-coded credentials in Sonatype Nexus Repository 3.0.0 through 3.70.5 allow unauthenticated attackers with network access to gain read/write access to the internal OrientDB database and execute arbitrary operating system commands as the Nexus process user when the `nexus.orient.binaryListenerEnabled` configuration is enabled. Exploitation
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected routes via URL path manipulation. The vulnerability exploits a URL normalization mismatch: Fastify router normalizes URLs (removing duplicate slashes or handling semicolon delimiters based on configuration), but @fastify/express passes the original un-normalized URL to Express middleware, causing path-scoped authentication checks to fail and be skipped entirely. No public expl
Authentication bypass in OAuth2 Proxy allows unauthenticated remote attackers to access protected resources by spoofing the X-Forwarded-Uri header when the service is configured with --reverse-proxy and at least one skip-auth route or regex. This issue, addressed in version 7.15.2, remains exploitable if the new --trusted-proxy-ip flag is not set, requiring operators to strip or overwrite the dangerous header at the reverse proxy layer. No active exploitation or public proof-of-concept code has been identified, and EPSS estimates a low 0.08% probability of exploitation.
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authorization, and rate limiting controls due to path doubling logic error. When child plugins register with prefixes matching middleware paths, the onRegister function incorrectly doubles the middleware path, preventing any matches against incoming requests. Affects fastify/express versions ≤4.0.4 across all routes within child plugin scopes. Remote attackers require no authentication (CVSS PR:N), no user interaction, and low attack complexity to bypass critical security controls. No public exploit identified at time of analysis, though exploitation requires no special configuration or request crafting.
Information disclosure in Pyroscope enables unauthenticated remote attackers to extract the Tencent Cloud Object Storage (COS) secret_key from the API if the database is configured with the Tencent COS storage backend. Fixed versions are 1.15.2, 1.16.1, and all 1.17.x releases. No active exploitation or public exploit code has been identified at this time.
Privilege escalation in ArgoCD Image Updater allows authenticated low-privileged users in a multi-tenant Red Hat OpenShift GitOps environment to update container images of applications in other namespaces. This cross‑namespace attack bypasses access controls, leading to unauthorized image changes and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is very low.
Server-side template injection (SSTI) in Thymeleaf 3.1.3 and prior allows unauthenticated remote attackers to bypass expression sanitization and execute unauthorized code when applications pass unvalidated user input to the template engine. The flaw stems from improper neutralization of specific syntax patterns, and a fix is available in version 3.1.4.RELEASE. No public exploit or active exploitation has been identified at the time of analysis, and EPSS indicates low exploitation probability (0.13%).
Server-Side Template Injection (SSTI) in Thymeleaf 3.1.3.RELEASE and earlier allows unauthenticated remote attackers to bypass expression scope restrictions and
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.
Non-constant time comparison operations in the Legion of the Bouncy Castle BC-JAVA cryptographic library (core modules, versions 2.17.3 through 1.83) expose FrodoKEM private keys to timing side-channel attacks, enabling remote unauthenticated attackers to extract cryptographic secrets through statistical analysis of operation timing variations. CVSS 4.0 score of 10.0 reflects maximum confidentiality and integrity impact across system and subsequent contexts. EPSS probability is low (0.04%, 14th percentile) and no active exploitation is confirmed, but SSVC framework rates this as automatable with total technical impact. Vendor patch available in BC-JAVA 1.84.
Arbitrary code execution within Chrome's sandbox affects all versions prior to 147.0.7727.101 via crafted HTML pages exploiting a use-after-free in codec processing. Remote attackers require user interaction (visiting a malicious page) but need no authentication. CVSS 8.8 (High) with network attack vector, low complexity, and high impact across confidentiality, integrity, and availability. Google patched this in the stable channel update released April 15, 2026. No public exploit code or CISA KEV listing identified at time of analysis, though Chromium issue tracker #495996858 indicates vendor-confirmed vulnerability. The sandbox containment limits initial exploitation to Chrome's restricted environment, not direct system compromise.
Remote code execution in Google Chrome via a use-after-free vulnerability in the Cast component allows an attacker who serves a crafted HTML page to execute arbitrary code. The flaw affects Chrome versions prior to 147.0.7727.101 and has a CVSS score of 8.8. At the time of analysis, no active exploitation or public exploit code has been reported, and EPSS indicates a low exploitation probability (0.08%).
A use-after-free vulnerability in Google Chrome's Forms component enables remote code execution within the browser's sandbox when a user visits a malicious web page. The Chromium project rates the severity as High, and the flaw was resolved in version 147.0.7727.101. The low EPSS score (0.08%), absence of CISA KEV listing, and SSVC assessment of no current exploitation suggest limited immediate risk.
Arbitrary code execution within Google Chrome's sandbox affects all versions prior to 147.0.7727.101 through a use-after-free vulnerability in the codec processing components. Remote attackers can exploit this by tricking users into visiting a malicious webpage, achieving high-severity compromise of confidentiality, integrity, and availability within the sandboxed renderer process. Google has released version 147.0.7727.101 as a stable channel update to address this flaw. No evidence of active exploitation (not in CISA KEV) or public exploit code has been identified at time of analysis, though the simplicity of the attack vector (network-based, low complexity, requiring only user interaction) warrants prioritized patching.
Heap buffer overflow in Google Chrome's PDFium library (versions prior to 147.0.7727.101) enables remote code execution within the Chrome sandbox when a victim opens a malicious PDF file. Despite CVSS 8.8 severity, exploitation requires user interaction (opening a crafted PDF) and is confined to the sandbox, limiting system-level impact. Vendor patch available in Chrome 147.0.7727.101. No active exploitation confirmed (not in CISA KEV), no public POC identified at time of analysis. EPSS data not provided.
Remote code execution in Google Chrome's V8 JavaScript engine (versions before 147.0.7727.101) allows an attacker who convinces a user to visit a crafted HTML page to perform out-of-bounds memory access, potentially leading to full system compromise. There is no evidence of active exploitation, and the exploitation probability is very low (EPSS 0.07%). The flaw is classified as Medium severity by Chromium due to the required user interaction.
Arbitrary code execution in Google Chrome on Android prior to 147.0.7727.101 results from a use-after-free vulnerability in the Permissions component. A remote attacker can exploit this by tricking a user into interacting with a malicious HTML page through specific UI gestures, leading to full compromise of the browser process. No public exploit or active exploitation is reported, and EPSS indicates a low likelihood of widespread exploitation.
Out-of-bounds memory access in Google Chrome 147 on Windows prior to
Remote code execution in Google Chrome on Android versions prior to 147.0.7727.101 allows a remote attacker to compromise the browser. A use-after-free vulnerability in the XR component can be triggered via a crafted HTML page, enabling out-of-bounds memory read and potentially full system compromise. While the CVSS score is 8.8, the EPSS probability is low (0.07%) and no active exploitation has been observed, though exploitation only requires user interaction.
Remote code execution in OWASP BLT's CI/CD workflow enables unauthenticated attackers to compromise the repository. The vulnerable .github/workflows/regenerate-migrations.yml workflow runs with full write permissions, copies attacker-supplied files from a pull request, and executes Python code that loads a malicious models.py during Django migrations. An external contributor who opens a pull request can achieve arbitrary code execution and secret exfiltration when a maintainer applies the regenerate-migrations label; a fix is expected in version 2.1.1, with no active exploitation confirmed but a proof-of-concept available.
Privilege escalation in Login as User WordPress plugin (all versions ≤1.0.3) allows authenticated subscribers to become administrators by manipulating a client-side cookie. Attackers with Subscriber-level access can set the 'oclaup_original_admin' cookie to an admin user ID and trigger the 'Return to Admin' function, granting full admin privileges. CVSS 8.8 (High) with network vector, low complexity, and low privileges required. No public exploit identified at time of analysis, EPSS data not available. Wordfence reported vulnerability with direct source code references to vulnerable functions in class-login-handler.php.
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive fields (like roles or permissions) of any user account through the REST API's user patching endpoint, leading to full system compromise. The vulnerability stems from insufficient field-level authorization, and the EPSS exploitation probability is very low (0.04%) with no known active exploitation; a vendor patch is available in version 5.17.
Type confusion in Chrome's Turbofan JIT compiler allows remote code execution inside the renderer sandbox. Affects Google Chrome versions prior to 147.0.7727.101. No active exploitation or public exploit is known, and a vendor patch is available.
Remote code execution in Google Chrome's Video component prior to version 147.0.7727.101 allows a remote attacker to execute arbitrary code within the browser's sandbox by serving a crafted HTML page. No active exploitation or public proof-of-concept has been identified; EPSS estimates a very low probability (0.03%) of exploitation in the wild.
Remote code execution in Google Chrome prior to 147.0.7727.101 allows attackers to execute arbitrary code inside the browser sandbox via a crafted HTML page, exploiting a type confusion vulnerability in the Turbofan JavaScript engine. Chromium rates this as High severity, though EPSS data indicates a very low 0.03% probability of exploitation with no active attacks reported. The flaw affects all Chrome desktop platforms and requires user interaction to visit a malicious site.
Use-after-free in CSS in Google Chrome prior to 147.0.7727.101 enables a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. No public exploit code or active exploitation is currently known, and EPSS predicts extremely low exploitation probability (0.03%).
Remote code execution in Google Chrome’s Prerender feature allows attackers to execute arbitrary code on a victim's system by convincing them to visit a malicious webpage. This critical-severity vulnerability affects Chrome versions prior to 147.0.7727.101 and is rated CVSS 8.8, but has a very low EPSS exploitation likelihood and no known active exploitation.
Use-after-free in Google Chrome's FileSystem allows a remote attacker to potentially corrupt memory and gain full control of the affected system via a crafted HTML page. The vulnerability, fixed in Chrome 147.0.7727.101, requires user interaction (visiting a malicious site) and has a CVSS score of 8.8, but EPSS indicates a very low exploitation probability (0.03%) and no active exploitation or public exploit code is known.
Remote code execution via crafted PDF in Google Chrome versions prior to 147.0.7727.101 allows an attacker to execute arbitrary code inside the browser's sandbox. The heap buffer overflow in PDFium is triggered by opening a malformed PDF file. No public exploit code or active exploitation has been confirmed, and EPSS indicates a low probability of exploitation.
Pre-authentication resource exhaustion in Bouncy Castle BC-JAVA PGP modules (bcpg) allows remote attackers to trigger denial-of-service by exploiting unbounded AEAD chunk sizes, affecting all versions before 1.84. The maximum CVSS 4.0 score of 10.0 reflects complete compromise potential across confidentiality, integrity, and availability with no attack complexity, no authentication requirements, and network-based exploitation. No public exploit identified at time of analysis, though the attack s
Remote code execution in HP DeskJet All-in-One printers via malformed WSD scan requests allows adjacent network attackers to fully compromise the device. A stack-based buffer overflow (CWE-121) in the MFP's processing of Web Services for Devices (WSD) scan jobs enables unauthenticated arbitrary code execution. No active exploitation or public proof-of-concept has been reported, and EPSS predicts low exploitation likelihood.
Stored cross-site scripting in ApostropheCMS SEO fields permits an authenticated attacker to inject arbitrary JavaScript that executes in the context of any authenticated user viewing the crafted page. This can be leveraged to exfiltrate sensitive user data (usernames, emails, roles) and perform actions as the victim via internal APIs. Public exploit code exists, but no active exploitation has been reported; a patch is available.
Remote code execution in Agent Zero 0.9.8 via unsanitized command execution in its External MCP Servers feature allows unauthenticated attackers to inject arbitrary operating system commands. By crafting a malicious MCP server definition with attacker-controlled command and args, a remote attacker can achieve code execution with the privileges of the Agent Zero process, potentially leading to full system compromise. No active exploitation or public exploit is currently known, and EPSS indicates low exploitation probability.