Command injection in python-utcp allows remote attackers to execute arbitrary shell commands on Unix and Windows systems when user-controlled tool arguments are processed by the CLI communication protocol module. The _substitute_utcp_args method in cli_communication_protocol.py directly embeds unsanitized user input into bash or PowerShell commands without escaping, enabling full remote code execution. Vendor-released patch available in version 1.1.2 with shell-quoting mitigation (shlex.quote on Unix, single-quoted literals on Windows). CVSS 8.3 indicates high complexity and required user interaction, but scope change enables container/sandbox escape scenarios. No public exploit code or CISA KEV listing identified at time of analysis, though detailed proof-of-concept exists in the GitHub security advisory demonstrating data exfiltration via curl.
python-utcp CLI subprocess environment passes all process-level secrets to every tool call. When chained with CVE-2026-45369 command injection, remote authenticated attackers with low-privilege LLM tool access can exfiltrate AWS credentials, API keys, database URLs, and other environment variables in a single HTTP request. Patch available in version 1.1.2 (NVD references 1.1.3 as fixed version). GitHub security advisory confirms proof-of-concept demonstrating credential theft via env dump to attacker-controlled endpoint.
SQL injection in n8n workflow automation platform allows an attacker with write access to a connected git repository to execute arbitrary SQL against the internal PostgreSQL database when an administrator performs a Source Control Pull. The flaw stems from unsafe handling of column names within Data Table JSON files imported during sync. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.04%.
Remote code execution in HuggingFace Diffusers library (versions < 0.38.0) allows attackers to execute arbitrary Python code when victims load malicious pipelines from Hugging Face Hub repositories. The vulnerability bypasses the trust_remote_code=True safeguard through a type coercion flaw where None values are interpolated as 'None.py' filenames. Attackers can achieve silent code execution by publishing repositories containing a malicious None.py file alongside legitimate-looking configuration, requiring only that victims call DiffusionPipeline.from_pretrained() on the attacker's repository. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch: version 0.38.0.
Remote code execution in Google Chrome's V8 JavaScript engine before 148.0.7778.168 allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a type confusion bug and requires user interaction (visiting a malicious page); no public exploit identified at time of analysis and EPSS probability is very low (0.08%). Google has shipped a patched Stable channel release.
Arbitrary code execution in Google Chrome's GPU component (prior to 148.0.7778.168) lets a remote attacker run code inside the renderer/GPU sandbox by luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free that Chromium rates Medium, though CVSS scores it 8.8 (High). No public exploit is identified and there is no CISA KEV listing; EPSS is very low at 0.08%, indicating no observed exploitation activity at time of analysis.
Remote code execution in Google Chrome before 148.0.7778.168 stems from an integer overflow in the browser's font handling code, allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code - though notably constrained to run inside the renderer sandbox rather than achieving full host compromise. The flaw carries a CVSS of 8.8 but is rated Medium by Chromium's own severity scale, reflecting the sandbox containment. There is no public exploit identified at time of analysis, EPSS is very low (0.08%), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome on Windows before 148.0.7778.168 stems from a use-after-free in the GTK component, letting a remote attacker run arbitrary code when a victim opens a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable channel build; no public exploit is identified at time of analysis, EPSS risk is low (0.08%), and CISA SSVC marks exploitation status as none.
Remote code execution in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free (CWE-416) in the Downloads component, letting a remote attacker who lures a victim into performing specific UI interactions run arbitrary code via a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw was reported internally by the Chrome team and is patched in the Stable channel update. No public exploit identified at time of analysis, and EPSS is low at 0.08%.
Remote code execution in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a use-after-free (CWE-416); Google has shipped a fixed Stable channel build. There is no public exploit identified at time of analysis, EPSS is low (0.08%), and CISA SSVC records exploitation as none - though memory-corruption bugs in Chrome's media stack are historically attractive to attackers.
Remote code execution in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, and SSVC records no observed exploitation with a low EPSS of 0.08%. Exploitation requires user interaction (visiting a malicious page) and, because code runs inside the sandbox, a separate sandbox-escape bug would be needed for full host compromise.
Sandboxed remote code execution in Google Chrome desktop versions prior to 148.0.7778.168 allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw stems from an integer overflow in Chrome's XML handling and is rated High by Chromium; it requires user interaction (visiting a malicious page) and carries no public exploit identified at time of analysis, with a low EPSS of 0.08%.
Remote code execution in Google Chrome on macOS prior to 148.0.7778.168 stems from a use-after-free in the Downloads component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the browser process. Rated Critical by Chromium and CVSS 8.8, it requires user interaction (visiting the page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with SSVC exploitation status of 'none'.
Renderer-side arbitrary code execution in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free in the Blink rendering engine, letting a remote attacker who lures a victim to a crafted HTML page run code within the browser's renderer sandbox. Chromium rates the flaw Critical severity; however, exploitation still requires the user to open a malicious page (UI:R), the code executes inside the sandbox (scope unchanged), and there is no public exploit identified at time of analysis. EPSS is low (0.08%, 23rd percentile) and CISA SSVC records exploitation as 'none', so this is a high-severity but not yet actively exploited issue.
Remote code execution in Google Chrome's Downloads component before version 148.0.7778.168 allows a remote attacker to execute arbitrary code when a victim visits or interacts with a crafted HTML page. Chromium rates this High severity, and the CVSS 8.8 vector confirms the flaw is network-reachable and unauthenticated but requires user interaction (UI:R). There is no public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with CISA SSVC marking exploitation status as none.
Remote code execution in Google Chrome on macOS (versions prior to 148.0.7778.168) stems from an object lifecycle flaw in the WebShare API, allowing a remote attacker to run arbitrary code within the browser process after luring a victim to a crafted HTML page and getting them to perform specific UI gestures. Rated Critical by Chromium and reported internally by the Chrome team, a vendor patch is available; there is no public exploit identified at time of analysis, and the EPSS probability is very low (0.07%). CISA SSVC currently rates exploitation as none with total technical impact.
Remote code execution in Google Chrome desktop prior to 148.0.7778.168 stems from a heap buffer overflow in the browser's media Codecs component, allowing a remote attacker to run arbitrary code within the renderer sandbox when a victim processes a crafted video file. Reported internally by the Chrome team and rated High severity by Chromium, it carries CVSS 8.8 but requires user interaction (UI:R). There is no public exploit identified at time of analysis, and EPSS is low at 0.07%.
Out-of-bounds write in the WebRTC component of Google Chrome before 148.0.7778.168 lets a remote attacker achieve arbitrary code execution inside the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC lists exploitation as none, indicating no observed in-the-wild activity yet.
Out-of-bounds write in Google Chrome's WebAudio component (versions prior to 148.0.7778.168) lets a remote attacker achieve arbitrary code execution within the renderer sandbox when a victim opens a crafted HTML page. Google rates the Chromium severity as High and has shipped a fixed Stable channel build; there is no public exploit identified at time of analysis and the EPSS score is very low (0.07%). Because execution is confined to the sandbox, real-world impact typically requires chaining a separate sandbox-escape bug.
Out-of-bounds memory write in Google Chrome's ANGLE graphics abstraction layer on Windows before 148.0.7778.168 lets a remote attacker corrupt memory by luring a victim to a crafted HTML page, potentially leading to renderer-process code execution. Rated Critical by Chromium and scored CVSS 8.8, it requires user interaction (visiting a page) but no authentication. Currently there is no public exploit identified and the SSVC exploitation status is 'none', though the very low EPSS (0.07%) reflects newness rather than confirmed safety.
Remote code execution in PostgreSQL (versions 14.x-18.x) allows authenticated database users to execute arbitrary code as the database operating system user via integer wraparound vulnerabilities in multiple server features. By passing gigabyte-scale inputs to affected database functions, attackers trigger allocation undersizing that leads to out-of-bounds writes. No active exploitation confirmed (not in CISA KEV), but CVSS 8.8 with network vector and low complexity indicates high exploitability once technical details become public. EPSS data not available at time of analysis.
Remote code execution in Google Chrome's WebML component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. Chromium rates this a Critical severity heap buffer overflow (CWE-122), though the CVSS base is 8.8 because code execution is contained inside the sandbox rather than achieving a full host compromise. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.06%, 20th percentile), consistent with SSVC showing no observed exploitation.
Open WebUI versions through 0.8.11 allow authenticated users to execute arbitrary Python code in the Jupyter container by bypassing the ENABLE_CODE_EXECUTION=false configuration flag. The /api/v1/utils/code/execute endpoint fails to enforce the admin-configured feature gate (CWE-863: Incorrect Authorization), enabling any verified user to run code even when administrators believe execution is disabled. The vulnerability is confirmed by vendor POC (verified 2026-03-25) demonstrating successful code execution, file access, and SSRF to internal Docker services despite explicit admin configuration disabling the feature. Vendor-released patch available in v0.8.12 (commit 6d736d3c5) enforces the configuration check before dispatching code to Jupyter.
Heap buffer overflow in Google Chrome's WebML component on Windows lets a remote attacker trigger heap corruption-and potentially achieve code execution in the renderer-by luring a victim to a crafted HTML page in a version prior to 148.0.7778.168. Chromium rates the flaw High severity, and a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.06%).
Symlink following vulnerabilities in PostgreSQL pg_basebackup and pg_rewind enable database superusers to overwrite arbitrary files on the destination server's filesystem, leading to local OS account takeover. Exploitation requires a malicious origin database superuser convincing an administrator to run these backup/replication tools (UI:R in CVSS), with practical impact limited to scenarios where database files are transferred between systems or snapshotted before server restart. No public exploit identified at time of analysis. CVSS 8.8 reflects theoretical severity, but real-world risk depends on specific operational workflows involving backup file transfers across trust boundaries.
PostgreSQL libpq client library allows malicious server superusers to execute arbitrary code on connecting clients by overwriting stack buffers via unbounded responses to PQfn() calls. The vulnerability affects lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions used by psql and pg_dump utilities. A compromised or malicious PostgreSQL server can exploit clients running these common administrative tools during routine operations like database backups or large object exports. EPSS and KEV data not available for this recent CVE. CVSS 8.8 reflects the network attack vector with user interaction requirement (connecting to malicious server).
Out-of-bounds write in OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0 allows remote attackers to crash applications or potentially execute arbitrary code by delivering maliciously crafted CbYCrY image files. A signed integer overflow in the ConvertCbYCrYToRGB() pixel-loop calculation generates large negative pointer offsets, corrupting memory during image processing. EPSS data not available; no evidence of active exploitation (not in CISA KEV); exploitation requires user interaction to process attacker-supplied image files.
Remote code execution in OpenImageIO versions before 3.0.18.0 and 3.1.13.0 allows unauthenticated attackers to achieve arbitrary read/write memory access by delivering a maliciously crafted kABGR DPX image file with oversized dimensions. The signed integer overflow in SwapRGBABytes() creates a negative pointer offset that enables both out-of-bounds read via memcpy and subsequent out-of-bounds writes, potentially leading to code execution when a user opens the malicious image. EPSS data not available; no confirmed active exploitation (not in CISA KEV), though the vendor-disclosed nature and VFX industry targeting suggests focused adversary interest in content creation pipelines.
Stack buffer overflow in PostgreSQL's refint module allows low-privileged database users to execute arbitrary code as the database operating system user across all supported versions before 14.23, 15.18, 16.14, 17.10, and 18.4. The vulnerability enables two distinct attack paths: direct stack overflow leading to OS-level code execution, and SQL injection when applications expose user-controlled columns configured as refint cascade primary keys. With CVSS 8.8 (AV:N/AC:L/PR:L) and network-based exploitation requiring only low-privilege database credentials, this represents a critical privilege escalation risk for PostgreSQL deployments. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Renderer-sandboxed remote code execution in Google Chrome's Fonts component (versions prior to 148.0.7778.168) lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a CWE-787 out-of-bounds write reported internally by the Chrome team. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile), consistent with the CISA SSVC assessment of no known exploitation.
Privilege escalation in the InfusedWoo Pro WordPress plugin (versions through 5.1.2) allows authenticated subscriber-level users to elevate themselves to Administrator by abusing the unprotected infusedwoo_gdpr_upddata() function to overwrite their wp_capabilities user meta. No public exploit identified at time of analysis, EPSS is very low (0.04%), and the issue is not listed in CISA KEV, but the technical impact is total once the simple authentication prerequisite is met.
Arbitrary code execution in Google Chrome on macOS (versions prior to 148.0.7778.168) stems from a use-after-free in the browser's Extensions subsystem, allowing an attacker who convinces a user to install a malicious extension to run arbitrary code through a crafted Chrome extension. Chromium rates the severity Medium, but the CVSS 3.1 base score is 8.8 (High) because the flaw yields full confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and the EPSS probability is negligible (0.02%, 5th percentile), indicating no observed real-world exploitation to date.
Remote code inclusion in Yordam Library Automation System versions 19.5 through 22.0 allows unauthenticated attackers to execute arbitrary code with high integrity and confidentiality impact via user interaction. The vulnerability was reported by Turkey's National Cyber Security Directorate (USOM), indicating potential targeting of Turkish government or educational institutions using this library management software. With network-accessible attack vector and low complexity (CVSS AV:N/AC:L), this represents a significant risk to organizations running unpatched versions despite requiring user interaction (UI:R).
Remote attackers can bypass access controls in Yordam Library Automation System versions 19.5 through 22.0, achieving high confidentiality, integrity, and availability impact through incorrectly configured security levels. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling unauthorized access to library management functions. Reported by Turkey's national CERT (USOM), indicating regional awareness though not yet confirmed for active exploitation or CISA KEV listing.
Authentication bypass in Yordam Library Automation System versions 21.6 through 22.0 enables remote attackers to impersonate legitimate users and gain unauthorized administrative access by manipulating user identifiers in requests. Attackers who successfully exploit this vulnerability can achieve full system compromise including reading sensitive library records, modifying catalog data, and disrupting availability. The vulnerability requires user interaction (likely social engineering or malicious link), but no authentication, making it accessible to external threat actors. TR-CERT has published an advisory confirming the issue affects Turkish government and educational institutions using this library management platform.
Authorization bypass in Yaay Social Media App versions 3.8.0 through 24102025 allows remote unauthenticated attackers to access restricted functionality and data by manipulating user-controlled key parameters. The vulnerability enables unauthorized access to features normally protected by access control lists (ACLs), potentially exposing user data, administrative functions, or content modification capabilities. TR-CERT has disclosed this issue with a CVSS base score of 8.8, requiring user interaction for exploitation. No evidence of active exploitation (not in CISA KEV) or public exploit code has been identified at time of analysis.
Fleet server crashes from a single malformed gRPC request to the PublishLogs endpoint, allowing complete denial of service. An attacker with any enrolled Launcher node key can terminate the Fleet server process instantly via a crafted gRPC call. CVSS 8.7 (High) reflects the ease and impact, though exploitation requires prior enrollment of a Launcher host. Vendor-released patch version 4.81.0 available. No public exploit identified at time of analysis, but attack requires minimal sophistication given authenticated access.
Broken access control in FlowiseAI Flowise versions 3.1.1 and earlier allows any authenticated user to perform unauthorized CRUD operations on OpenAI Assistants Vector Stores via the /api/v1/openai-assistants-vector-store endpoints. The route handlers lack the checkAnyPermission() middleware applied to other privileged endpoints, so role-based access controls are bypassed entirely once an attacker has any valid API key or session. No public exploit is identified at time of analysis, but the fix is bundled in the FlowiseAI security release 3.1.2 alongside several other authorization fixes.
Authentication bypass in Crabbox versions prior to v0.12.0 allows authenticated attackers with shared-token access to impersonate arbitrary owners or organizations. By injecting crafted X-Crabbox-Owner and X-Crabbox-Org headers in API requests, attackers can bypass authorization checks and gain full access to victim lease operations across organizational boundaries. VulnCheck reported this vulnerability, and a vendor-released patch is available in version v0.12.0. CVSS 8.7 (High) reflects network-accessible exploitation with low privileges required, high impact to confidentiality, integrity, and availability within the vulnerable component scope.
Hard-coded database credentials in Comarch ERP Optima client allow remote attackers on adjacent networks to access the backend database with elevated privileges and execute system commands on the server. The immutable credentials enable authentication bypass without requiring any user interaction or existing privileges. Fixed in version 2026.4, reported by CERT-PL. No public exploit or KEV listing identified at time of analysis, though the straightforward nature of credential-based attacks (CVSS:4.0 AV:A/AC:L/PR:N) suggests high exploitability for attackers with local network access.
Stored cross-site scripting (XSS) in pyLoad's download management interface allows authenticated users with add-package permissions to inject JavaScript that executes in administrators' browsers when viewing the /collector or /queue pages. The vulnerability stems from unescaped template literal interpolation in packages.js that directly writes attacker-controlled link URLs to the DOM via jQuery .html(). Exploitation requires low-privilege authentication (Perms.ADD role) but enables full session hijacking against administrators, leading to plugin upload, configuration tampering, and potential remote code execution through reconnect-script features. A secondary unauthenticated attack vector exists when the ClickNLoad handler is enabled via POST /flash/add. No public exploit identified at time of analysis, though detailed proof-of-concept is published in the GitHub advisory.
Stored cross-site scripting in GitLab Enterprise Edition's customizable analytics dashboards allows an authenticated user to execute arbitrary JavaScript in the browsers of other users who view the affected dashboard. The flaw affects EE 18.7-18.9.6, 18.10-18.10.5, and 18.11-18.11.2, carries a CVSS 8.7 (scope-changed) rating, and a vendor patch is available. No public exploit identified at time of analysis and EPSS is very low (0.02%, 5th percentile).
Stored cross-site scripting in GitLab Enterprise Edition 18.7-18.11.x allows an authenticated user to inject arbitrary JavaScript that executes in other users' browser sessions due to improper input sanitization. The CVSS 8.7 score is elevated by Scope:Changed (S:C), reflecting that injected script can pivot across security contexts and potentially target administrators. No public exploit identified at time of analysis, EPSS is very low (0.02%, 5th percentile), and SSVC indicates no observed exploitation, but a vendor patch is available across all three affected branches.
Stored cross-site scripting (XSS) in Open WebUI ≤0.9.2 allows authenticated users with default speech-to-text permissions to upload polyglot WAV+HTML files through the audio transcription endpoint, achieving code execution in victim browsers and enabling full account takeover including administrator sessions. The vulnerability chains insecure file extension handling with unrestricted Content-Type serving and non-HttpOnly JWT storage to weaponize a single-click attack. Publicly available exploit code exists with video demonstration; no active exploitation confirmed by CISA KEV at time of analysis. CVSS 8.7 (High) reflects changed scope (S:C) and user interaction requirement, but real-world risk is elevated because the vulnerable permission defaults to enabled and the attack yields immediate admin-level access in typical deployments.
Stored cross-site scripting in GitLab Enterprise Edition lets an authenticated user holding Developer-role permissions inject arbitrary JavaScript that executes in the browsers of other users who view the affected content. The flaw stems from improper input sanitization and affects all 16.4-series through 18.11.x releases prior to the 18.9.7, 18.10.6, and 18.11.3 patch releases. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but CVSS is rated 8.7 because the scope-changing XSS can hijack higher-privileged user sessions.
Remote code execution in Vvveb CMS before 1.0.8.3 allows authenticated super_admin users to upload malicious plugin ZIP files containing arbitrary PHP code. Once uploaded, the code executes with web server privileges via unauthenticated HTTP requests to the plugin's public directory, enabling privilege escalation from authenticated admin to system-level code execution. CVSS 8.6 (High) with network attack vector but requires high privileges (PR:H). No active exploitation confirmed at time of analysis, but attack chain is straightforward with publicly documented technique.
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files via XML External Entity (XXE) injection in the web UI. The vulnerability affects the management interface with network-accessible attack vector, low complexity, and no required privileges (CVSS 8.6). Attackers can extract sensitive configuration files, credentials, and operational data from the SD-WAN management platform. EPSS data not provided; exploitation status unknown but the unauthenticated remote vector and publicly disclosed Cisco advisory elevate real-world risk for internet-exposed instances.
Privilege escalation in Crabbox versions prior to v0.12.0 allows authenticated users with visibility-only permissions to escalate privileges and obtain code execution, remote desktop access, and data exfiltration capabilities. By directly invoking three unprotected ticket-generation endpoints (/v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, /v1/leases/:id/egress/ticket), attackers can obtain bridge-agent credentials and impersonate trusted lease-side bridges, bypassing intended read-only access restrictions. The vulnerability was patched in v0.12.0 (commit 95cb30dc) following VulnCheck disclosure. CVSS 8.6 (High) reflects network-accessible exploitation requiring only low-privilege authentication with low attack complexity. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, though the attack is straightforward for authenticated insiders.
Cleartext HMAC signing key exposure in Amazon SageMaker Python SDK versions <2.257.2 and <3.8.0 enables authenticated attackers with SageMaker describe API and S3 write permissions to forge model artifact integrity signatures and achieve remote code execution in inference containers. AWS released patches in v2.257.2 and v3.8.0 with security fixes addressing Triton HMAC key exposure and missing integrity checks. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting limited exploitation activity despite high CVSS score.
Arbitrary file read in Portainer Community Edition allows authenticated low-privileged users to exfiltrate any file readable by the Portainer process — commonly root — by submitting a Git-backed stack whose docker-compose.yml is a symlink to a target like /etc/shadow or a Kubernetes service account token. The flaw stems from go-git v5 materializing Git symlink blobs as real OS symlinks during checkout combined with GetFileContent reading the entry point through os.ReadFile without resolving links, and is amplified by Portainer's scheduled stack auto-update, which lets a previously benign repository turn malicious after initial review. A fully validated proof-of-concept exists from the reporter (b-hermes), but there is no public exploit identified at time of analysis and no CISA KEV listing.