Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint route confusion flaw that, when chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), lets attackers inject SQL and ultimately execute arbitrary code on the underlying host. Publicly available exploit code exists (a ProjectDiscovery Nuclei template and WPScan advisory), and the CISA SSVC framework rates the flaw as automatable with total technical impact, though it is not currently listed in CISA KEV. The vulnerability was reported by WPScan and patched in the WordPress 7.0.2 and 6.9.5 releases.
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attacker achieve full RCE on default deployments by chaining two endpoints: /api/v1/auto_login, which mints SUPERUSER tokens to any caller, and /api/v1/validate/code, which passes user-supplied code to Python's exec(). CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N) and a vendor patch is available; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrary SQL against the backend PostgreSQL database via the /pa endpoint, which concatenates the attacker-supplied PhoneIP value from a <PolycomIPPhone> XML body into queries without parameterization. Because SQL access on this PostgreSQL deployment can be escalated to command execution, a single crafted, unauthenticated request yields full database compromise and remote code execution on the VoIP appliance. There is no public exploit identified at time of analysis, though vendor SRA published a technical writeup, and the CVSS 4.0 base score is 9.3 (Critical).
Privilege escalation and full site takeover affects the AI Copilot WordPress plugin before 1.5.4, which fails to bind OAuth access tokens to a specific WordPress user and treats any valid token as an administrator session. An unauthenticated attacker who completes the plugin's public OAuth flow can invoke privileged MCP (Model Context Protocol) tools as an administrator, creating new users and escalating roles. Publicly available exploit code exists and the flaw carries a CVSS 9.8; no active exploitation has been confirmed (not in CISA KEV).
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenticated users with flow-creation privileges to bypass the allow_custom_components=false control via the Policies component's ToolGuard integration. Because validation only inspects the main component code and ignores dynamic CodeInput fields, attackers persist malicious Python in a flow that runs server-side when a guarded tool executes. No public exploit has been identified at time of analysis, but the flaw is IBM-confirmed with a vendor patch and carries a critical 9.9 CVSS due to cross-tenant escalation through the agentic MCP update_flow_component_field tool.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a malicious pickle payload that the AsyncDiskCache deserializes with unauthenticated pickle.loads(). Any actor able to influence cached data - via file system access, crafted workflow inputs, custom components, or API manipulation - gains full compromise at the privilege of the Langflow server process. Rated CVSS 9.9 and reported by IBM with a vendor patch available; no public exploit identified at time of analysis.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Python — and therefore arbitrary OS commands — with the privileges of the Langflow server process. The flaw is a design failure in the POST /api/v1/validate/code endpoint, which passes user-supplied code straight into Python's exec() with no sandbox, validation, or privilege drop. Rated CVSS 9.9 by IBM; no public exploit identified at time of analysis, though the trivial exec()-based trigger makes exploitation straightforward once authenticated.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plant files at attacker-chosen paths on the Langflow host. The flaw lives in the APIRequest component's 'Save to File' feature, which trusts filenames from a response Content-Disposition header without sanitizing path traversal sequences, so a malicious server response can escape the temporary directory and write to any location the Langflow process can reach. No public exploit identified at time of analysis, and it is not in CISA KEV; a patch is available per IBM's advisory.
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to elevate their account to superuser by directly manipulating the underlying database, then execute arbitrary system commands and achieve full compromise of the host running the Langflow service. The flaw (CWE-94, code injection) carries a critical CVSS 9.9 with a scope change, meaning code runs with the Langflow service account's permissions beyond the vulnerable component. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication that skips API key validation whenever WEBHOOK_AUTH_ENABLE is False - which is the shipped default. Any remote attacker who learns a flow's UUID can invoke that flow's webhook endpoint as though they were its owner, running arbitrary flow logic and reaching RCE. No public exploit identified at time of analysis, but the CVSS 9.8 rating and default-vulnerable configuration make this a high-priority patch.
Unauthenticated arbitrary file upload in Feng Office 3.11.13.11 lets remote attackers push attacker-controlled files (e.g. .html) into the web-accessible /tmp/ directory via the ck_upload_handler.php endpoint, with no authentication or user interaction. A public proof-of-concept exists on GitHub, and the CWE-434 flaw carries a CVSS 9.8, though EPSS remains low (0.46%, 37th percentile) and it is not in CISA KEV, indicating no confirmed in-the-wild abuse yet.
Heap-based buffer overflow in IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 and 8.2.0.0-8.2.1.0) lets a remote attacker corrupt heap memory through improper bounds checking, potentially achieving arbitrary code execution or crashing the affected process. The flaw carries a CVSS 3.1 base score of 9.8, but no public exploit identified at time of analysis and the EPSS probability is low (0.46%, 37th percentile). Note that the affected component is the backup Client, while the description references crashing 'the server,' introducing ambiguity about the true exploitation path.
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets anonymous attackers run arbitrary code by abusing the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The CVSS 3.1 base score is 9.8 (network, low complexity, no privileges or user interaction). No public exploit is identified at time of analysis, and the EPSS probability is modest at 0.44% (36th percentile), indicating exploitation is technically trivial but not yet observed at scale.
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-lived superuser bearer token from the /api/v1/login/auto_login endpoint whenever the AUTO_LOGIN setting is on - which is the default. Because the endpoint mints full-admin tokens with no credentials, any network-reachable attacker gains complete administrative control, and overly permissive CORS can leak those tokens to unintended origins. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated privilege escalation in the Bricksforge WordPress plugin (versions ≤ 3.1.8.6) lets remote attackers create a new administrator account by abusing the Pro Forms User Registration action. The plugin fails to validate the fieldIds parameter, so attacker-supplied field IDs are injected into the trusted form-field whitelist, enabling mass-assignment of a privileged role. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable (CVSS 9.8) on any site exposing a Pro Forms registration element.
Remote code execution and information disclosure in IBM Db2 Genius Hub (1.1, 1.1.1, 1.1.2) and IBM Agentics 1.0 stem from the use of inherently dangerous functions invoked without sufficient input restrictions, allowing remote attackers to run arbitrary code or read sensitive data. IBM's PSIRT reported the flaw with a 9.8 critical CVSS reflecting network-reachable, unauthenticated exploitation with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and the low EPSS score (0.33%, 25th percentile) suggests exploitation is not yet widespread.
XML External Entity injection in the libpve-storage-perl library (the storage-management Perl backend of Proxmox VE) affects builds identified as libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7, per MITRE. An attacker able to submit crafted XML to an affected storage-handling code path can force the parser to resolve external entities, enabling arbitrary local file disclosure and potential SSRF or denial of service. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS was not provided.
Missing authentication in IBM Langflow OSS 1.0.0 through 1.10.0 lets unauthenticated remote attackers register unlimited user accounts against any exposed instance. When the documented NEW_USER_IS_ACTIVE=true option is set, those accounts become immediately active and can log in to reach known remote-code-execution endpoints, providing a full authentication foothold without relying on AUTO_LOGIN. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make internet-facing deployments a high priority.
Privilege escalation in the Aimogen Pro (Aiomatic) all-in-one AI toolkit plugin for WordPress affects all versions through 2.8.4 and lets unauthenticated attackers create administrator accounts. The 'aiomatic_call_google_ai_function' AJAX handler lacks a capability check, allowing the 'aimogen_wp_god_mode' tool to clear function blacklists and invoke arbitrary PHP functions. No public exploit identified at time of analysis, but the pre-auth nature and 9.8 CVSS make this a full-site-takeover risk.
Authentication bypass and full data compromise affects IBM Langflow OSS 1.0.0 through 1.10.1, which ships hard-coded credentials (a static password or cryptographic key) embedded in the application. Because the same secret is present in every deployment, remote attackers who read it from the public source or a binary can authenticate to inbound interfaces, impersonate the app to external components, or decrypt internal data on any affected instance. No public exploit identified at time of analysis, but the shared-secret nature makes exploitation trivial once the value is known.
Unauthenticated media upload in the Events Booking extension for Joomla (versions 1.0 through 5.8.0, developed by joomdonation.com) allows any remote user to push media assets to the server without authentication because the feature is enabled by default. Assigned CVSS 9.8 and CWE-1188 (insecure default configuration), the flaw is reported by Joomla/joomdonation and tracked as EUVD-2026-45184; there is no public exploit identified at time of analysis and the EPSS probability is low (0.15%, 4th percentile). Fixed in version 5.8.0.
SQL injection in cool-admin-java 8.0.0 lets attackers inject arbitrary SQL through the order() method of CrudOption.java, a shared CRUD helper used across the framework's auto-generated data endpoints. The flaw carries an NVD CVSS of 9.8 (CWE-89) and, if reachable without authentication as the vector implies, permits full read/write access to the backing database. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile), indicating minimal observed exploitation activity so far.
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements, per a TR-CERT advisory (TR-26-0573). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) indicates full compromise of the backend database with no authentication or user interaction. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stored/reflected cross-site scripting in IBM Engineering AI Hub 1.0.0 through 1.2.0 lets a remote unauthenticated attacker inject arbitrary scripts into generated web pages that execute in a victim's authenticated browser session. Because the CVSS scope is marked changed (S:C), successful exploitation can impact resources beyond the vulnerable component - such as the user's session with adjacent applications. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Authorization bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets remote unauthenticated attackers manipulate a user-controlled key (an IDOR-style reference) to reach functionality that should be restricted by access-control lists. Reported to Turkey's national CSIRT (USOM) with a CVSS 9.4, it enables reading and altering other tenants'/users' resources; no public exploit identified at time of analysis and the flaw is not in CISA KEV.
Session forgery in the clawvet self-hosted API server (apps/api) before 0.7.5 lets a remote unauthenticated attacker fully impersonate any user and steal their secret apiKey. The server ships a hard-coded fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and .env.example, while an unauthenticated GET /api/v1/scans endpoint leaks victim userId values; combining these, an attacker forges a valid HS256 cg_session cookie offline and calls GET /api/v1/auth/me to exfiltrate the victim's email, subscription plan, and API key. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the technique is fully described and trivially reproducible; only the self-hosted API is affected, not the published clawvet npm CLI package.
OS command injection in django-pyas2 through version 1.2.3 lets an authenticated admin plant shell commands in the Partner model's cmd_receive and cmd_send fields, which pyas2/utils.py hands directly to os.system() when an AS2 message is processed. The submitted CVSS vector rates this 9.1 (network, unauthenticated), but the description explicitly requires an authenticated admin user, so real-world exploitability is meaningfully narrower than the headline score. EPSS is low (0.64%, 47th percentile), there is no CISA KEV listing, and a third-party vulnerability-research repository is referenced that appears to document the flaw.
Remote code execution in the Generic OEM UZ801_v2.1 4G LTE Router firmware V3.4.3 allows an unauthenticated remote attacker to run arbitrary commands through the exposed sbin/adbd (Android Debug Bridge daemon) component. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact, reflecting full command execution on the device. No CISA KEV listing is present and EPSS is low (0.35%, 27th percentile), but a researcher GitHub repository is referenced, indicating publicly available exploit code likely exists.
Two-factor authentication bypass in Grav CMS before 2.0.4 lets an attacker who already knows a victim's password overwrite that user's TOTP secret and log in with full 2FA protection stripped away. During the pending TOTP challenge window the login plugin's regenerate2FASecret task verifies only that the user exists — not that the caller is authorized — and requires no CSRF nonce, so the attacker sets an attacker-chosen secret, computes a valid code, and completes login. VulnCheck-reported and CVSS 4.0 scored 9.1; no public exploit identified at time of analysis.
Output-handling discrepancy in the OpenRISC OR1200 soft-core CPU (commit 83ac6b) causes the CPU output port to differ between the RTL source and the synthesized netlist, producing unexpected hardware behavior. The flaw was surfaced by the academic SynFuzz hardware-fuzzing research (arXiv 2504.18812) rather than in-the-wild attacks, affects the open-source mor1kx/OR1200 core used mainly in research and FPGA/SoC prototyping, and has no public exploit identified at time of analysis. Assigned CVSS 9.1 (NVD/MITRE) but with a very low EPSS of 0.17% (6th percentile), reflecting a research-grade correctness finding rather than a mass-exploitation threat.
Improper access control in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) allows remote unauthenticated attackers to invoke privileged functionality that is not properly constrained by access control lists. Because the missing authorization check exposes state-changing operations, an attacker can modify or disrupt platform data and availability without credentials. This was reported by Turkey's national CSIRT (USOM); no public exploit has been identified at time of analysis and no EPSS or CISA KEV data is available.