Unauthenticated remote code execution in the goodoneuz/pay-uz Laravel package (all versions through 2.2.24) lets remote attackers overwrite executable PHP payment-hook files through the /payment/api/editable/update endpoint, which is registered via Route::any() with no authentication middleware. User-supplied content is written verbatim with file_put_contents() into PHP files that are later loaded via require() during normal payment processing, so any web-facing deployment can be fully compromised without credentials. CVSS is 10.0 and SSVC rates technical impact as total and the attack as automatable; there is no public exploit identified at time of analysis and EPSS is a modest 0.89% (75th percentile).
Authenticated remote command execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions <= 3.0.13 allows any logged-in user to run arbitrary OS commands by configuring a Custom MCP stdio server. The MCP adapter's allow-list of 'safe' binaries (e.g. npx) can be abused with code-execution arguments that bypass the validateCommandInjection and validateArgsForLocalFileAccess sanitizers, yielding total host compromise. Publicly available exploit code exists (SSVC exploitation: poc), though EPSS is low at 0.07%; it is not listed in CISA KEV.
Unauthenticated remote attackers can escalate to administrator privileges on WordPress sites running Riaxe Product Customizer plugin ≤2.1.2. The plugin exposes an AJAX endpoint ('install-imprint') without authentication checks that allows arbitrary WordPress option manipulation, enabling attackers to create administrator accounts by modifying registration settings. CVSS 9.8 (Critical) reflects the complete site compromise potential. EPSS data not provided but exploitation requires only HTTP access to any vulnerable WordPress installation with this plugin active-no special conditions beyond plugin presence.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 lets remote unauthenticated attackers manipulate backend database queries through the /parking/manage_park.php endpoint. Public proof-of-concept exploit code exists (per the mt-0505 CVE report and VulDB entry), and the flaw is automatable with total technical impact, though EPSS remains very low at 0.03% (9th percentile). No public evidence of active exploitation has been identified.
SQL injection in SourceCodester Simple Music Cloud Community System v1.0's /music/edit_music.php endpoint allows unauthenticated remote attackers to execute arbitrary SQL commands with full database access. The vulnerability carries a critical CVSS 9.8 score with network-accessible, low-complexity exploitation requiring no privileges or user interaction. EPSS probability is notably low at 0.01% (2nd percentile), suggesting limited real-world exploitation interest despite the critical severity rating. Proof-of-concept code is publicly available via GitHub, lowering the barrier for opportunistic attacks against exposed instances.
SQL injection in SourceCodester Simple Music Cloud Community System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the /music/view_genre.php endpoint, enabling complete database compromise including data theft, modification, and potential server takeover. CVSS 9.8 (Critical) with network-exploitable attack vector requiring no authentication or user interaction. EPSS score of 0.01% (2nd percentile) indicates low observed exploitation probability despite critical severity. Publicly available proof-of-concept exists (GitHub repository), lowering exploitation barrier for opportunistic attackers.
Integer underflow in Microsoft QUIC's ACK frame parser enables remote unauthenticated privilege escalation. The vulnerability (CWE-191: integer wrap-around) affects Microsoft's native QUIC library implementations (both OpenSSL and SChannel variants) distributed via NuGet packages. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and vendor-confirmed patch available (commit 1e6e999b), this represents a critical network-exposed flaw in QUIC protocol implementations. No active exploitation confirmed (not in CISA KEV) and public exploit code status unknown at time of analysis, but the straightforward attack vector (network-accessible protocol parsing) and authentication bypass capability warrant immediate patching priority for systems using Microsoft QUIC libraries.
OS Command Injection in HGiga iSherlock-base and iSherlock-audit versions 4.5 and 5.5 allows remote unauthenticated attackers to execute arbitrary operating system commands on the server with full system privileges. All four product variants (iSherlock-base-4.5, iSherlock-audit-4.5, iSherlock-base-5.5, iSherlock-audit-5.5) are affected in versions below build 476 (base) and 261 (audit). Vendor-released patch available per Taiwan CERT (TWCERT) advisory. CVSS 4.0 score of 10.0 reflects maximum severity with network attack vector, no authentication required, and high impact to all CIA triad properties including scope change. No public exploit identified at time of analysis.
SQL injection in SourceCodester Simple Music Cloud Community System v1.0 lets remote attackers manipulate backend database queries through the /music/view_user.php endpoint. Per the CVSS vector (PR:N), no authentication is required, and publicly available exploit code exists (SSVC exploitation: poc), though it is not listed in CISA KEV and carries a very low EPSS probability (0.03%, 8th percentile). Exploitation can expose or tamper with stored user and application data.
Heap buffer overflow in Creolabs Gravity scripting language before 0.9.6 enables remote code execution when applications evaluate untrusted scripts containing many string literals at global scope. The vulnerability stems from insufficient bounds checking in gravity_fiber_reassign(), allowing heap metadata corruption. VulnCheck disclosed this issue with a vendor-released patch (commit 18b9195) available. CVSS 9.3 reflects the critical network-accessible, unauthenticated attack vector. No active exploitation (CISA KEV) or public POC identified at time of analysis, but technical details in GitHub issue #437 could facilitate exploit development.
Remote unauthenticated code execution in Openfind MailGates (5.0-6.0) and MailAudit (5.0-6.0) via stack-based buffer overflow allows complete system compromise. Attackers can send crafted network requests to exploit CWE-121 buffer overflow conditions without authentication, achieving arbitrary code execution with high impact to confidentiality, integrity, and availability. Vendor patches available (MailGates 6.1.10.054, 5.2.10.099; MailAudit 6.1.10.054, 5.2.10.099). CVSS 9.3 with network attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N) creates critical exposure for internet-facing mail security appliances. EPSS data unavailable; no confirmed active exploitation or public POC identified at time of analysis.
WinMatrix agent escalates privileges to SYSTEM without authentication, enabling authenticated local users to execute arbitrary code with full administrative control on both the local machine and all networked hosts where the agent is deployed. This environmental spread capability (CVSS scope change: H) transforms a local vulnerability into an enterprise-wide threat. Taiwan CERT issued advisories in January 2026 for versions 3.5.13 through 3.5.26.15. No public exploit identified at time of analysis, but CVSS 9.3 reflects catastrophic potential impact given the agent's privileged access and network propagation capability. EPSS data not available for new 2026 CVE.
Lua sandbox escape in Luanti 5.x (formerly Minetest) game engine allows malicious mod code to break out of LuaJIT security restrictions and execute arbitrary code on the host system. Affects all Luanti 5.0.0 through 5.15.1 when compiled with LuaJIT instead of standard Lua. Attackers with ability to distribute crafted mods can achieve complete system compromise with scope change (S:C in CVSS), escalating from sandboxed mod execution to full host access. No authentication required but local access needed (AV:L). Patch available in version 5.15.2 via two upstream commits. EPSS data not available; no confirmed active exploitation or public POC at time of analysis.
Unauthenticated remote denial-of-service in ChilliCream's Hot Chocolate GraphQL server for .NET (HotChocolate.Language package) lets any client crash the entire worker process by sending a small, deeply nested GraphQL document. Because the recursive-descent Utf8GraphQLParser has no depth limit, ~40 KB of nested selection sets, object/list values, or list types triggers an uncatchable StackOverflowException that terminates the process, dropping all in-flight HTTP requests, IHostedService background tasks, and WebSocket subscriptions on that worker. No public exploit identified at time of analysis and EPSS is low (0.09%), but the attack is trivial (AC:L, PR:N) and CISA SSVC flags it as automatable, so it is a practical availability threat to internet-facing GraphQL endpoints.
Remote code execution in Digital Knowledge KnowledgeDeliver (all versions prior to February 24, 2026) via malicious ViewState deserialization. A hard-coded ASP.NET machineKey allows unauthenticated remote attackers to bypass ViewState validation and execute arbitrary code on the server. Mandiant reported this critical deserialization vulnerability. EPSS score of 0.08% (24th percentile) suggests low observed exploitation activity, though no public exploit is confirmed at time of analysis. CVSS vector indicates network-accessible attack requiring no privileges or user interaction, but the 7.5 score reflects only Confidentiality impact-real-world RCE capability makes this significantly more severe than the partial CVSS rating suggests.
SQL injection in SourceCodester Payroll Management and Information System v1.0 lets remote unauthenticated attackers manipulate backend database queries through the /payroll/view_employee.php endpoint. The flaw exposes confidential employee and payroll data and permits tampering with stored records. Publicly available exploit code exists (community vulnerability report), though EPSS remains very low (0.03%, 10th percentile) and it is not listed in CISA KEV.
Authentication bypass in @fastify/middie 9.3.1 and earlier lets unauthenticated attackers reach protected routes because inherited middleware is not registered directly on child plugin engine instances. When a Fastify app defines auth/authz middleware in a parent scope and mounts child plugins through middie, those child-scope routes silently skip the parent's checks, exposing them to anyone. Rated CVSS 9.1; SSVC lists a public PoC and total technical impact, though EPSS is only 0.03% and there is no evidence of active exploitation.
Stored cross-site scripting escalating to remote code execution in SiYuan (b3log) versions 3.6.3 and below, where Mermaid diagrams render with securityLevel 'loose' and inject SVG via innerHTML, letting javascript: URLs in Mermaid code blocks survive into the DOM. On Electron desktop builds — created with nodeIntegration enabled and contextIsolation disabled — a victim opening a note with a malicious Mermaid block and clicking the diagram node triggers arbitrary code execution. Publicly available exploit code exists (SSVC 'poc'); not listed in CISA KEV, and EPSS is very low at 0.05%.