Remote code execution in Alibaba fastjson versions 1.2.68 through 1.2.83 allows remote, unauthenticated attackers to run arbitrary code by submitting crafted JSON to any endpoint that deserializes untrusted input. The vendor advisory emphasizes that exploitation works under fastjson's stock default configuration - AutoType does not need to be enabled and no external classpath gadget is required - which removes the mitigations most defenders historically relied on. No public exploit identified at time of analysis, but the CVSS 9.0 rating and scope change (S:C) mark this as a high-priority deserialization flaw.
Authentication bypass in Logto versions 1.10.1 through 1.37.1 allows remote attackers to gain unauthorized access to accounts by using email identifiers that differ only in case or Unicode representation, due to missing normalization during principal lookup. An attacker can register or authenticate with a case-variant of a target email and collide with the intended principal, leading to account takeover without user interaction. No active exploitation or public exploit code has been identified, and EPSS indicates low exploitation probability.
Account takeover in Logto due to unverified email-based SSO linking allows attackers to gain unauthorized access to victim accounts. Affected versions 1.11.0 through 1.37.1 allow an attacker to register with a permissive identity provider using a victim's email and link that identity to the victim's existing account without email verification, bypassing authentication. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability.
Authentication bypass in Logto allows replay of captured OIDC id_tokens due to missing nonce claim
Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.
Arbitrary file upload in the Really Simple CSV Importer WordPress plugin (versions <= 1.3) lets an authenticated administrator write files of dangerous types into a web-accessible path, enabling web shell deployment and full site/server compromise. Reported by Patchstack, it carries a CVSS 9.1 (scope-changed) rating, but exploitation requires high privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.