Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
Unauthenticated remote code execution in Puwell IP Camera firmware versions 2.x through 4.x lets remote attackers achieve root-level control by sending a crafted JSON payload to an undocumented DebugShell service listening on TCP port 34567. Because the service performs neither authentication nor input sanitization, any attacker with network reach to the port can pass operating-system commands directly to the device, resulting in full compromise. Reported by VulnCheck with publicly available exploit code exists; no public evidence of active in-the-wild exploitation (not in CISA KEV).
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDataFrame) can be defeated with Unicode homoglyph identifiers, letting an attacker run arbitrary Python that escapes the Pyodide sandbox and executes OS commands on the Flowise host with the process's privileges. The affected CSV Agent and Airtable Agent nodes gate LLM-generated (and config-supplied) Python through an ASCII word-boundary regex blacklist, which Python's NFKC identifier normalization silently rewrites back into the forbidden dunders. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the GitHub advisory documents a complete, reproducible bypass technique, so weaponization is straightforward; the vendor rates it 9.5 (CVSS 4.0).
Remote code execution in Flowise (npm flowise / flowise-components <= 3.1.2) lets an unauthenticated attacker who can query a chatflow built on the CSV Agent node coerce the backing LLM, via prompt injection, into returning a Python payload that slips past the regex blocklist validator and runs in an unsandboxed pyodide runtime, yielding arbitrary code execution as the Flowise service account. Trend Micro ZDI (Dre Cura, TrendAI Research) demonstrated eight distinct validator-bypass techniques and shipped a working proof of concept; this is scored CVSS 4.0 9.5 (CWE-94). Publicly available exploit code exists, but there is no CISA KEV listing or evidence of active exploitation at time of analysis.
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.
Remote code execution in Flowise (flowise and flowise-components <= 3.1.2) is possible through the CSVAgent node, which executes user-supplied Python in a pyodide runtime. A regex denylist blocks imports and dangerous builtins, but attackers bypass it entirely by calling the pre-imported pandas library's read_pickle() to deserialize an attacker-controlled base64 pickle, achieving arbitrary command execution. A detailed working proof-of-concept (pickle __reduce__ gadget plus a custom file-like reader class to feed the payload) is published in the vendor GHSA advisory; publicly available exploit code exists, but there is no public exploit identified as being used in the wild and it is not in CISA KEV.
Remote code execution as root in Flowise (npm packages flowise and flowise-components, versions 3.0.5 through 3.1.2) lets any authenticated user with a valid API key escape the NodeVM sandbox used by the custom-function feature and run arbitrary OS commands. The flaw stems from executeJavaScriptCode() merging caller-supplied nodeVMOptions over its secure defaults with a JavaScript spread, so an attacker can re-enable blocked builtins (child_process, fs) via require.builtin:["*"]. A detailed working exploit is published in the vendor's GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing, meaning no confirmed active exploitation at time of analysis.
Remote code execution in FlowiseAI Flowise 3.1.2 lets an authenticated user abuse the 'SQLite Record Manager' node's `additionalConfig` input to override the target database path and write an attacker-shaped SQLite file to any location on disk. Because the official Docker image runs as root, the file can be planted at /etc/chromium/exploit.conf, and a second Upsert operation that launches Puppeteer/Chromium sources that .conf file and executes an embedded reverse-shell payload, yielding full application compromise as root. No public exploit is identified at time of analysis beyond the detailed reproduction steps in the elttam advisory; the issue is patched in 3.1.3.
Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary commands via the check_connection endpoint, which insecurely deserializes attacker-supplied YAML/JSON. By setting the __type__ field to subprocess.check_output with chosen arguments, an attacker instantiates arbitrary Python objects and executes OS commands with the application's process privileges. Publicly available exploit code exists (VulnCheck advisory and upstream issue), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as actively exploited.
Unauthenticated device takeover of Puwell IP Cameras (firmware 2.x through 4.x) is possible by sending protocol-conforming packets to TCP port 23456 and abusing the unvalidated Session field in the vendor's proprietary control protocol. Remote attackers with no credentials can view live video, drive pan/tilt motors, activate audio, and reboot the camera. Publicly available exploit code exists (disclosed by VulnCheck), and the CVSS 4.0 base score of 9.3 reflects network-reachable, no-interaction access with high confidentiality, integrity, and availability impact; there is no CISA KEV listing indicating active exploitation at this time.
Unauthenticated arbitrary file access in the Easy Integration for Dropbox WordPress plugin before 2.2.0 lets remote attackers list, download, and upload files across the site's connected Dropbox account and harvest the connected-account and administrator email addresses. Several file-management AJAX actions are registered for logged-out users but skip authorization checks (CWE-862), turning the plugin into an open proxy to the linked cloud storage. Publicly available exploit code exists and a vendor patch is released, though EPSS estimates exploitation probability at only 0.14% (4th percentile).
Unauthenticated arbitrary file read in OpenCode Studio before 2.4.4 lets remote attackers pull other users' intermediate audio, video, and subtitle artifacts directly from the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints, and delete any rendered video via the unauthenticated DELETE /api/short-video/:videoId endpoint. Reported by VulnCheck and rated CVSS 4.0 9.3, the flaw exposes both confidentiality and integrity of user job data with no login required. Publicly available exploit code exists, though there is no public exploit identified as being used in active attacks.
Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.
Authenticated remote code execution in FlowiseAI Flowise 3.1.2 and earlier lets any logged-in user escape the vm2 sandbox and run arbitrary OS commands on the host. The MySQL/Postgres/SQLite Record Manager and MySQL/Agent Memory nodes expose an unfiltered additionalConfig input passed directly into the TypeORM DataSource constructor, whose entities/subscribers/migrations options can load attacker-supplied JavaScript files. A full public reproduction (including a root reverse-shell payload) was published in the elttam advisory, and the vendor fixed it in 3.1.3.
Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.
Remote code execution and denial of service in OpenSIPS SIP server (versions 4.0.0 and prior) arises from a stack buffer overflow in the sip_to_json() function, where an attacker-controlled SIP header name longer than 255 bytes is memcpy'd into a fixed 255-byte stack buffer. Because both the length and content of the overwrite are attacker-controlled, a single unauthenticated UDP packet to SIP port 5060 can crash the process or, on builds lacking stack protections, hijack the saved return address for RCE. No public exploit identified at time of analysis; the issue was not fixed at publication, making this an unpatched flaw affecting any deployment whose routing script invokes sip_to_json().
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticated attackers to upload a web shell to the server due to unrestricted file-type validation (CWE-434), resulting in full compromise of the HR application host. Any remote attacker can reach the upload functionality without credentials or user interaction and execute arbitrary commands. No public exploit identified at time of analysis, though the maximal CVSS 9.8 severity and trivial exploitability make this a high-priority fix for affected deployments.
Privilege escalation in the Android kernel VPU (Video Processing Unit) driver stems from a use-after-free in vpu_ioctl.c, allowing an attacker to elevate to kernel-level privileges without any additional execution privileges or user interaction. It affects Google Android devices (per the Pixel security bulletin for 2026-08-01), and Android's advisory states no user interaction is required; SSVC rates the technical impact as total and the flaw as automatable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the total-impact, no-interaction profile makes it a high-priority patch target.
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human Resources platform in versions 26.0 up to (but not including) 26.1, allowing remote attackers to compromise the underlying database and recover sensitive HR data that is stored without encryption. Rated CVSS 9.8 by TR-CERT with a fully remote, unauthenticated network vector and high impact to confidentiality, integrity, and availability. Currently there is no public exploit identified at time of analysis and no EPSS or KEV signal provided in the source data.
Command injection in Google::Auth for Perl before 0.06 lets an attacker who controls an Application Default Credentials configuration achieve arbitrary code execution. When a 'type: external_account' credentials JSON contains a credential_source.executable block, the Pluggable subclass runs the named command via a single-argument system($command), handing the whole string to /bin/sh -c, and copies the JSON's environment_variables into %ENV first - all with no opt-in gate (the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES check was added only in the fix). Reported by CPANSec with no public exploit identified at time of analysis and a low EPSS of 0.20%, but the code path is trivially reachable from the standard ADC flow via GOOGLE_APPLICATION_CREDENTIALS.
Kernel memory corruption in the Linux kernel SCTP stack allows a remote peer to trigger a use-after-free during ASCONF DEL-IP processing, corrupting an association's transport list and leaving primary_path/active_path pointing at freed memory. The flaw affects the SCTP dynamic address reconfiguration (ASCONF) path across a wide range of kernel versions and, given kernel-level impact, can lead to denial of service and potentially privilege escalation or code execution. Despite the 9.8 CVSS and 'Information Disclosure' tag, there is no public exploit identified at time of analysis and EPSS is low (0.16%), reflecting the SCTP/ASCONF-specific conditions required.
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.
Credential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attacker to masquerade as a legitimately managed backup agent and harvest that agent's credentials. Because VSPC is the multi-tenant management plane MSPs use to orchestrate backups across customer estates, captured agent credentials give an attacker a foothold to pivot into managed endpoints. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (9.5) and CWE-288 identifies an authentication-bypass root cause.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Remote code execution in Keysight IxChariot Endpoint and related Keysight network-test products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single specially crafted packet. The flaw is a classic stack-based buffer overflow reachable over the network with no user interaction (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the trivial attack complexity and lack of any authentication make it a high-priority patch for any environment running these test tools.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Stored (second-order) SQL injection in OpenMeter (v1.0.0-beta.218 through v1.0.0-beta.231) lets an actor who can create or update a customer plant a malicious payload in the usageAttribution.key or usageAttribution.subjectKeys fields, which is later concatenated unsanitized into a ClickHouse WITH map(...) expression when the customer is referenced in a meter or event query. The delayed execution means the injection fires during downstream analytics/metering operations rather than at input time, giving an attacker read/manipulation access to the ClickHouse backend that stores usage and billing telemetry. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 9.3 (Critical).
Authentication bypass in Atlas-Livre, a PHP guestbook/livre d'or web application by maximeAmini, lets unauthenticated remote attackers reach admin-only controller endpoints under Espace_admin/controleur/ and trigger destructive actions such as record deletion. The flaw stems from PHP redirect guards that call header() without a following exit/die, so protected code keeps executing regardless of session state. No public exploit is confirmed via KEV, though a referenced GitHub gist may contain proof-of-concept material; there is no active-exploitation listing at time of analysis.
Unauthenticated OAuth2 access-token theft in Flowise (npm/flowise <= 3.1.2) stems from the token-refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId being listed in WHITELIST_URLS, so it bypasses authentication entirely. Any remote party who knows or guesses a credential ID can force the server to decrypt the stored OAuth2 credential, refresh it against the provider using the victim's client secret, and receive the fresh access_token directly in the response body. No public exploit code has been identified, but the researcher (Shinobi Security) validated the missing-auth behavior in Docker, and a vendor-released patch is available in 3.1.3.
Remote code execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions 3.1.2 and earlier lets an authenticated user achieve root command execution on the host by injecting Python into the CSV Agent's Pyodide sandbox, which bridges back to the host Node.js process. Attackers reach OS command execution, credential theft, arbitrary file read, and server crash. A working Metasploit module and root Meterpreter session are documented, so publicly available exploit code exists, though the flaw is not listed in CISA KEV.
Adjacent-buffer overflow in OpenSIPS 3.4.0-beta through 3.6.5 and 4.0.0-beta arises in the {s.b64encode} string transformation, where the size check only validates that the input fits the 64 KB transformation buffer but ignores the ~33% expansion that base64 encoding introduces. Remote attackers can send a SIP message with a header value of roughly 50,000+ bytes to overflow the buffer by up to 21,844 bytes into an adjacent transformation buffer, corrupting values used by chained transformations on the same message; exploitability hinges on the routing script applying {s.b64encode} to attacker-controlled input. No public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available in 3.6.6 and 4.0.0-rc1.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
Memory corruption in the OpenSIPS SIP server (versions prior to 3.6.6 and 4.0.0-rc1) lets remote attackers overflow a fixed 1024-byte global buffer via an oversized SIP URI username, deterministically corrupting adjacent global state such as the disable_503_translation flag and altering the server's routing behavior for subsequent messages. Exploitation requires that the deployed routing script pass an attacker-controlled username into construct_uri(); where that pattern exists, the flaw affects integrity and availability without authentication. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Hard-coded RSA private key exposure in GeoVision GV-AS1620 (GV-Cloud) access-control appliances lets remote attackers decrypt and forge the device's HTTPS traffic. The firmware ships an embedded, static RSA private key used by the built-in Lighttpd web server for TLS termination, so anyone who extracts it from one device can passively decrypt or actively impersonate the management interface of every device sharing that key. No public exploit identified at time of analysis, but the shared-secret nature makes the flaw broadly reusable once the key is recovered.
Hard-coded RSA private key exposure in the GeoVision GV-AS1620 (AS Manager) access-control device lets attackers who extract the firmware-embedded key decrypt and forge the Lighttpd TLS session used for the device's HTTPS management interface. Because the key is static and shared across all units of the same firmware, a single extraction compromises every deployed device, enabling passive traffic decryption and active server impersonation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1) stems from a cryptographic key embedded directly in the application binary, letting attackers recover the same static key from any deployment and abuse it against protected data. Because the key is identical across all installations, its extraction undermines confidentiality and integrity of anything it protects. No public exploit identified at time of analysis, and the flaw was reported through Turkey's national CSIRT (TR-CERT).
Arbitrary code execution in NASA's core Flight System (cFS) v7.0.1 is possible through the Executive Services (ES) dynamic application start path, where improper access control lets an attacker plant a malicious shared object on target storage that is then loaded and run as a flight application. SSVC records a proof-of-concept exploit (publicly available exploit code exists) and rates technical impact as total with automatable exploitation, though EPSS is very low at 0.15% (5th percentile). The published NVD vector is CVSS 9.1 (AV:N), but the described mechanism - dropping a shared object onto storage - implies local write access is a genuine prerequisite.
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plant or overwrite files on the management server via path traversal (CWE-22), which can be escalated to remote code execution on that server. All versions matched by the wildcard CPE are provisionally in scope pending vendor confirmation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.0 (Critical), driven by high confidentiality, integrity and availability impact plus subsequent-system impact.