Remote code execution in FlowiseAI Flowise (<= 3.0.13) allows attackers to run arbitrary OS commands on the server hosting a chatflow that uses the CSV Agent node. The CSV_Agents.run method evaluates LLM-generated Python in a non-sandboxed pyodide environment, and its FORBIDDEN_PATTERNS regex allow-list can be bypassed to import the os module and invoke system commands. An unauthenticated attacker can reach this via prompt injection against the chatflow, or an authenticated attacker can point the node at an attacker-controlled model server; publicly available exploit code exists, though EPSS remains low at 0.11%.
Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in NewSoft NewSoftOA allows remote unauthenticated attackers to execute arbitrary system commands on the server. CVSS 9.3 (Critical) with network attack vector and no authentication required. The description contains a contradiction - it states 'local attackers' while CVSS vector indicates AV:N (network-accessible). Based on CVSS vector, this is remotely exploitable without authentication. No CISA KEV listing or public exploit code identified at time of analysis, but network accessibility and lack of auth barriers make this a high-priority remediation target for organizations running NewSoftOA.
Unauthenticated cross-user JavaScript execution in WWBN AVideo (versions 29.0 and prior) lets a remote attacker broadcast arbitrary code to every connected browser through the YPTSocket WebSocket plugin. Because anonymous visitors are issued valid socket tokens and the server relays the attacker-controlled `msg` and `callback` fields verbatim into client-side eval() sinks, any visitor can execute JavaScript in the origin of all connected users - including administrators - yielding universal account takeover, session theft, and privileged action execution. Publicly available exploit code exists (SSVC: PoC) though the flaw is not listed in CISA KEV, and EPSS is currently low at 0.17%.
Storable versions before 3.05 for Perl has a stack overflow. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Remote code execution with complete system compromise affects Net::Dropbear Perl module versions before 0.14 due to bundled vulnerable libtomcrypt library. The module ships with Dropbear 2019.78 or earlier containing libtomcrypt v1.18.1, inheriting CVE-2016-6129 (RSA signature forgery) and CVE-2018-12437 (RSA key recovery via side-channel). CVSS 10.0 reflects network-accessible attack with no authentication or user interaction required and complete confidentiality, integrity, and availability impact with scope change. CISA SSVC framework confirms automatable exploitation with total technical impact, though no active exploitation reported. Patch available in Net::Dropbear 0.14 with updated cryptographic dependencies.
Unauthenticated path traversal in CrowdStrike LogScale cluster API allows remote attackers to read arbitrary files from server filesystems. Affects only self-hosted LogScale deployments with specific vulnerable versions; Next-Gen SIEM customers are not impacted. CrowdStrike proactively identified this during internal testing and deployed network-layer blocks for SaaS customers on April 7, 2026, with log analysis confirming no evidence of exploitation. CVSS 9.8 critical severity with network vector and no authentication required (AV:N/PR:N), though EPSS and KEV data not available at time of analysis.
Command injection in Tenda W30E V2.0 firmware V16.01.0.21 allows remote unauthenticated attackers to execute arbitrary operating system commands as root through the formSetUSBPartitionUmount function by manipulating the usbPartitionName parameter. The vulnerability achieves maximum CVSS severity (9.8) due to network accessibility without authentication, though EPSS exploitation probability remains low (0.17%, 38th percentile), suggesting limited attacker interest at time of analysis. No active exploitation confirmed by CISA KEV, and public exploit code status is unverified from researcher disclosure.
Uninitialized memory access in Firefox's Web Codecs API enables remote code execution without authentication. Attackers can exploit this CWE-457 (Use of Uninitialized Variable) flaw through network-accessible vectors with low complexity (AV:N/AC:L/PR:N/UI:N) to achieve complete system compromise including data exfiltration, arbitrary code execution, and denial of service. CVSS 9.8 severity is supported by SSVC assessment indicating automatable exploitation with total technical impact. Vendor-released patches available in Firefox 150 and Firefox ESR 140.10. CISA SSVC reports no active exploitation at time of analysis, though the vulnerability is classified as automatable with total technical impact.
DOM security mitigation bypass in Mozilla Firefox allows remote unauthenticated attackers to completely compromise browser security, achieving high confidentiality, integrity, and availability impact. Affects Firefox versions prior to 150 and Firefox ESR versions prior to 140.10. The vulnerability bypasses critical browser security controls designed to protect the Document Object Model. SSVC assessment indicates the flaw is automatable with total technical impact, though no active exploitation has been confirmed at time of analysis. CVSS 9.8 critical rating reflects network-based attack with no complexity barriers.
Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly validate the permissions bound to developer credentials, allowing a holder of such credentials to access resources or perform actions beyond their intended authorization. The vendor rates it CVSS 9.8 (network, no privileges, no interaction), though the description's reference to 'developer credentials' implies some prior credential is involved. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), but SSVC flags the technical impact as total and the flaw as automatable.
Full takeover of Oracle Advanced Inbound Telephony (a module within Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote, unauthenticated attacker over HTTP against the Setup and Administration component, per Oracle's April 2026 Critical Patch Update. Classified as a missing-authentication authentication bypass (CWE-306) with a 9.8 CVSS, successful exploitation yields complete confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis, and EPSS probability is low (0.04%), but CISA's SSVC assessment rates the technical impact as total and the flaw as automatable.
Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint developer credentials (API keys/OAuth application credentials) that carry more privileges than the issuing account should be able to delegate, breaking the platform's privilege boundary. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total and automatable. Note a significant signal conflict: the published CVSS 9.8 vector uses PR:N (unauthenticated) while the vendor description explicitly requires a 'highly privileged' user, which materially lowers the realistic risk.
Authentication bypass in Firefox's cookie-handling mechanism allows remote unauthenticated attackers to bypass security controls via network requests, achieving full confidentiality, integrity, and availability compromise. Affects Firefox versions prior to 150. Mozilla has released patches in security advisories MFSA2026-30 and MFSA2026-33. CISA SSVC framework classifies this as fully automatable with total technical impact, though no active exploitation is confirmed at time of analysis. CVSS 9.8 critical severity reflects the network attack vector with no authentication or user interaction required.
Authentication bypass in Firefox's cookie handling mechanism allows remote unauthenticated attackers to circumvent security controls and potentially execute arbitrary code or access protected resources. The vulnerability affects Firefox versions prior to 150 and has a critical CVSS score of 9.8 (network-exploitable, no authentication required, low complexity). Despite the severe CVSS rating, EPSS probability indicates only 0.02% likelihood of exploitation (4th percentile), suggesting limited real-world targeting. Mozilla has patched this in Firefox 150 per security advisories MFSA2026-30 and MFSA2026-33. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code at time of analysis.
Remote code execution in Atlassian Bamboo Data Center versions 9.6.0 through 12.1.0 allows authenticated attackers to execute arbitrary OS commands via command injection vulnerability. The attack requires low-privilege authentication (PR:L) but no user interaction, enabling complete system compromise across confidentiality, integrity, and availability with cross-scope impact (SC:H/SI:H/SA:H indicating container escape or lateral movement potential). Atlassian has released patches for three major version branches (9.6.25, 10.2.18, 12.1.6). No active exploitation confirmed in CISA KEV at time of analysis, though the authenticated nature and critical CVSS 9.4 score warrant immediate patching for internet-exposed instances with broad user access.
Remote unauthenticated path traversal in excel-mcp-server versions ≤0.1.7 allows network attackers to read, write, and overwrite arbitrary files on the host filesystem. The server's get_excel_path() function fails to validate file paths in two ways: it passes absolute paths without checking boundaries and joins relative paths without resolving traversal sequences. With default configuration binding to 0.0.0.0 (all network interfaces) and no authentication on SSE/Streamable-HTTP transport modes, exploitation is trivial. Vendor-released patch available in version 0.1.8. EPSS data not available; no CISA KEV listing identified at time of analysis.
Stored cross-site scripting in mailcow dockerized versions before 2026-03b enables remote attackers to execute arbitrary JavaScript in admin sessions by injecting malicious code through unauthenticated Autodiscover requests. The payload persists in Redis and triggers when administrators view Autodiscover logs on the admin dashboard. CVSS 9.3 reflects the network attack vector and high cross-scope impact, though exploitation requires admin interaction (UI:P) and no public exploit has been identified at time of analysis.
Heap corruption in the Noir language's Brillig bytecode compiler (Aztec's noir-lang, rust/brillig package) affects all releases up to and including 1.0.0-beta.18. When a Noir program issues a foreign call that returns a nested array of composite element types (e.g. `[(u32, u32); 3]`), the compiler's `allocate_foreign_call_result_array()` under-allocates heap memory, so the Brillig VM overwrites adjacent heap slots at execution time. No public exploit identified at time of analysis; EPSS is very low (0.04%) and CISA SSVC records no observed exploitation, though it rates the technical impact as total and the flaw as automatable.
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.
SQL injection in Zeon Academy Pro allows remote unauthenticated attackers to execute arbitrary SQL commands via the 'phonenumber' parameter in /private/continue-upload.php, enabling full database compromise including data exfiltration, modification, and deletion. The vulnerability is exploitable over the network without authentication (CVSS:4.0 9.3 Critical, AV:N/PR:N), representing a complete compromise of database confidentiality and integrity. Patch available from vendor per INCIBE-CERT advisory, though specific fixed version not disclosed in public references.
Authentication bypass in Oxia (oxia-db) metadata store and coordination system prior to 0.16.2 allows an attacker holding a valid OIDC/JWT token issued for a different service by the same identity provider to authenticate to Oxia. The OIDC provider unconditionally set SkipClientIDCheck: true in the go-oidc verifier, disabling library-level audience (aud) validation and breaking the audience/tenant isolation that OAuth2/OIDC relies on. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records no known exploitation, but the technical impact is rated total.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Management component, where a high-privileged attacker with HTTP network access can compromise the platform and, due to a scope change, significantly impact additional connected products. The flaw is classed as CWE-306 (Missing Authentication for Critical Function) and tagged as an authentication bypass, carrying a CVSS 3.1 base score of 9.1 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.
Cryptographic signature verification bypass in ASP.NET Core 10.0 enables remote unauthenticated attackers to forge authentication tokens and gain unauthorized access to protected resources. Tagged as a JWT attack involving authentication bypass, this vulnerability allows complete compromise of confidentiality and integrity without requiring any special conditions (AV:N/AC:L/PR:N/UI:N). Microsoft has released a security update addressing this flaw. No active exploitation confirmed in CISA KEV at time of analysis, though the authentication bypass nature and network-accessible attack surface present significant risk for widely deployed ASP.NET Core applications.
Arbitrary file write in FreeScout (prior to 1.8.215) allows authenticated administrators to achieve remote code execution by uploading malicious ZIP archives during module installation. The path traversal vulnerability (CWE-22) enables attackers to write files to any location on the server filesystem, including web-accessible directories where PHP shells can be placed. With CVSS 9.1 (Critical) and EPSS data not provided, the primary risk factor is the changed scope (S:C) indicating potential container/hosting infrastructure compromise beyond the application itself. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis, though the fix commit provides implementation details that could facilitate exploit development.
Unauthenticated authentication-bypass and access-control weakness in Oracle Identity Manager Connector 12.2.1.4.0 (Core component of Oracle Fusion Middleware) allows a network attacker to read, create, delete, or modify any data the connector can reach over HTTPS. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, it is easily exploitable without credentials or user interaction, though EPSS is very low (0.03%) and there is no public exploit identified at time of analysis. SSVC marks technical impact as total and the flaw as automatable, so it warrants prompt patching in the April 2026 Oracle CPU despite the currently low observed exploitation.
Authentication bypass in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) lets a remote, unauthenticated attacker reach and manipulate all connector-accessible data over HTTPS. Because the flaw is a missing-authentication weakness (CWE-306), an attacker can read, create, delete, or modify critical identity data with no credentials and low complexity. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), but the CVSS 9.1 and CISA SSVC 'total' technical impact rating mark it as high severity.
Unauthenticated data compromise in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) allows a remote attacker to reach the connector over HTTPS with no credentials and read, create, delete, or modify all connector-accessible data. Mapped to CWE-306 (Missing Authentication) and tagged as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 (C:H/I:H). There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), but CISA SSVC rates it automatable with total technical impact.
Remote unauthenticated attackers can leak GitHub workflow tokens from goshs repositories via ArtiPACKED attack. The vulnerability exploits artifact packaging mechanisms to extract GITHUB_TOKEN credentials despite the token never appearing in source code. With CVSS 9.1 (Critical) and network attack vector requiring no authentication, this poses immediate risk to CI/CD pipelines using goshs. No public exploit identified at time of analysis, though the attack technique (ArtiPACKED) is documented. EPSS data unavailable; not listed in CISA KEV.
Crafty Controller Users API allows authenticated administrators with high privileges to modify other user accounts due to improper API permission validation. Despite requiring PR:H (high privileges) and authentication, the vulnerability achieves CVSS 9.0 due to scope change, enabling privilege escalation and potential system-wide compromise. GitLab reports this as an authentication bypass affecting Crafty Controller by Arcadia Technology, LLC. No CISA KEV listing or public exploit code identified at time of analysis, though the authentication bypass tag suggests deviation from intended access controls even for privileged users.
Mass assignment vulnerability in FreeScout versions before 1.8.213 allows authenticated administrators to covertly exfiltrate all outgoing emails and inject malicious content into email communications. By exploiting unfiltered parameter binding in mailbox connection settings endpoints, an attacker with admin credentials can silently set auto_bcc to forward copies of every outgoing email, redirect SMTP traffic through attacker-controlled servers, inject tracking pixels or phishing links into signatures, and enable malicious auto-replies-all invisible to other administrators. The CVSS score of 9.0 reflects high confidentiality and integrity impact with changed scope, though exploitation requires high-privilege (admin) access. No public exploit code or CISA KEV listing identified, but the vulnerability is particularly dangerous in multi-admin deployments and when combined with session compromise vectors like XSS (noted in tags), as it provides persistent email surveillance beyond initial access.
Sandbox bypass in OpenClaw (pre-2026.3.31) enables authenticated remote attackers to escalate privileges by manipulating heartbeat context inheritance and senderIsOwner parameters. Exploitation requires low attack complexity with present attack technique capability, achieving complete compromise of confidentiality, integrity, and availability across vulnerable and subsequent system scope. No active exploitation confirmed (not in CISA KEV), but VulnCheck disclosure indicates researcher-identified vulnerability with public GitHub commit and security advisory available.