Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
Path-traversal-driven remote code execution affects the Microsoft Teams client for Android in all builds prior to 1.0.0.2026133602, where improper restriction of pathnames (CWE-22) lets an unauthorized attacker escape the app's restricted directory and execute code over the network. Microsoft rates it CVSS 9.8, but real-world signals are muted: EPSS is 0.62% (47th percentile), CISA SSVC records exploitation status as 'none', and there is no public exploit identified at time of analysis. A vendor patch is available, making prompt client updates the decisive control.
Unauthenticated arbitrary file write in DB-GPT v0.8.1 lets remote attackers achieve remote code execution by smuggling directory-traversal sequences (../) through the user_id HTTP header of the Python file-upload endpoint. Because the header value is used unsanitized as a path component of the upload directory, an attacker can escape the intended python_uploads directory and drop attacker-controlled files into code-execution-sensitive locations such as Python startup hooks, cron directories, or agent scripts. Rated CVSS 4.0 9.3 (Critical); no public exploit identified at time of analysis, though a VulnCheck advisory and an upstream fix commit confirm the flaw.
Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyone able to reach a volume server's gRPC port coerce the server, via the unauthenticated VolumeServer.FetchAndWriteNeedle RPC, into fetching arbitrary attacker-chosen URLs and returning the response. Because the volume server gRPC plane is unauthenticated by default and the documented JWT hardening does not cover this RPC, an unauthenticated remote attacker (CVSS:3.1 AV:N/PR:N, base 9.3) can reach loopback, RFC 1918, link-local, and cloud metadata endpoints such as 169.254.169.254 to steal IAM credentials and pivot to internal services. No public exploit identified at time of analysis, and it is not in CISA KEV; the fix landed in version 4.24.
Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.
Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.
Authentication bypass in the Mira fertility-tracking cloud API allows any remote attacker to take over user accounts by supplying only a victim's email address and an arbitrary password, since the login endpoint validates the email but accepts any format-valid string as the password and returns a live active session token. Affecting Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 (Quanovate Tech Inc, operating as Mira / Mira Care), this reported by CISA (ICSMA-26-223-01) carries a CVSS 4.0 base score of 9.3 and exposes sensitive reproductive-health (hormone) records and account settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated read/write access to reproductive-health profiles in the Mira Android app (v4.5.15.4) lets internet-based attackers view, forge, delete, or destroy stored fertility and reproductive health records. The flaw stems from hard-coded credentials (CWE-798) and is reachable over the network with no authentication or user interaction, carrying a CVSS 4.0 base score of 9.3. It was reported through CISA/DHS ICS-CERT as medical advisory ICSMA-26-223-01; no public exploit code or active-exploitation listing has been identified at time of analysis.
Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.
Remote code execution in Microsoft High Performance Computing (HPC) Pack allows an unauthorized network attacker to run arbitrary code by submitting maliciously crafted serialized data that the product deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 and requires no authentication or user interaction per the vector. A vendor patch is available; no public exploit has been identified at time of analysis.
Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.
OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.
Root-level OS command injection in wg-easy 15.3.0 lets a low-privileged web user holding the clients.create permission escalate to full host compromise. Because the client name is written verbatim into the WireGuard config, an attacker embeds newline-separated PostUp directives that wg-quick later executes as root. No public exploit identified at time of analysis, but the CVSS 9.9 (S:C, full C/I/A) and simple, GUI-driven injection make this a high-priority issue for any exposed wg-easy instance.
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorization flaw that lets a remote attacker bypass authentication and run code in the context of the current user. Adobe's PSIRT rates it CVSS 10.0 with a changed scope, meaning a successful attack can impact resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical but the severity is maximal.
Authentication bypass in Zoho ManageEngine DDI Central versions prior to 6201 lets remote unauthenticated attackers hijack the password-reset workflow to seize control of arbitrary accounts. Successful takeover of an administrative account grants full control over the DNS, DHCP, and IPAM management platform, with total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not on CISA KEV, though CISA's SSVC framework rates the flaw as fully automatable with total technical impact.
Server-impersonation via broken TLS hostname verification affects Apache HttpComponents Client 5.4 through 5.6.3 when applications use the asynchronous HttpClient, where the HostnameVerificationPolicy#BUILTIN setting is silently ignored. An adversary positioned to intercept and modify network traffic can present a valid certificate issued for an unrelated domain and the async client will accept it, defeating the core TLS server-identity check and exposing transmitted data. There is no public exploit identified at time of analysis and EPSS is very low (0.09%), but the CVSS base score is 9.1 and the classic (synchronous) HttpClient is explicitly unaffected.
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated attacker run code in the context of the current user via an incorrect-authorization flaw (CWE-863). The maximum CVSS 3.1 base score of 10.0 reflects a network-reachable, no-interaction bug with a changed scope, meaning impact can extend beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE and a vendor PSIRT advisory makes this a top-priority patch.
Unauthenticated remote code execution in Dassault Systèmes SIMULIA Execution Engine (Release 2023 through Release 2026) allows a network attacker to run arbitrary code on the server by submitting a malicious serialized object that the application deserializes without validation. The flaw carries a maximum CVSS 3.1 base score of 10.0 and requires no privileges or user interaction, making any exposed instance fully compromisable. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause combined with a network attack vector makes it a high-priority patching target.
Local arbitrary binary execution in Streambert, a cross-platform Electron desktop app for streaming and downloading video, affects all versions prior to 2.5.0 because the 'run-download' IPC handler fails to validate executable paths it receives. A renderer process that has already been compromised can invoke this handler to launch any local binary with the application's privileges, effectively escaping the renderer sandbox into full host code execution. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through GitHub (advisory GHSA-x267-77m6-qjc9) and fixed in version 2.5.0.
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding only read-collaborator access on a bot read a workspace's OAuth `credentialsId` and then overwrite that credential by calling handleUpdateOAuthCredentials() with an attacker-controlled writable `workspaceId`. Because the update authorized only the attacker's supplied workspace but then located and mutated the credential by its global `id` alone (and rewrote its `workspaceId`), a low-privilege user in one workspace can seize and reassign OAuth credentials belonging to another workspace. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fixing commit and PR are public.
Arbitrary file deletion in the Formidable Digital Signatures plugin for WordPress (all versions through 3.0.6) lets unauthenticated attackers delete server files by passing an attacker-controlled path in item_meta[field_id][content] together with the delete_saved_image flag during normal anonymous form submission. Because deleting wp-config.php can force WordPress back into its setup routine, this file-deletion primitive escalates to full site takeover, which is why it carries a CVSS 9.8. No public exploit identified at time of analysis; not listed in CISA KEV.
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated SQL injection in Friendica (through the 2026.08-dev branch) lets remote attackers inject arbitrary SQL through the photo-view 'order' parameter, which is concatenated unsanitized into a SHOW COLUMNS query executed via a bare PDO::query() call. Because PDO::query() permits stacked statements, an attacker needs no credentials to read, alter, or destroy the entire backing database. No public exploit identified at time of analysis, but the flaw is trivially reachable and carries a CVSS 9.8.
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without any credential check whenever jwt.filer_signing.key is left unset, which is the default. Any client able to reach the filer's gRPC port can invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint their own access keys and obtain S3 administrative control over the storage cluster. Rated CVSS 9.8; no public exploit identified at time of analysis, though the upstream fix commit and PR are public.
Authentication bypass in Red Hat PicketLink Federation's SAML implementation lets unauthenticated remote attackers impersonate any principal in any role, because the unsolicited (IdP-initiated) response handler accepts forged SAML assertions without verifying their signature or validating their contents. Successful exploitation yields full identity spoofing, enabling information disclosure and access to restricted operations. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial-to-forge nature make this a high-priority flaw for any application relying on PicketLink SAML SSO.
SQL injection in PeerTube's federation layer (versions prior to 8.1.6) lets an unauthenticated remote ActivityPub server read and write arbitrary database tables and seize administrator accounts. The flaw lives in ActorFollowModel.updateScore(), where an attacker-controlled actor inboxUrl is string-interpolated directly into an UPDATE statement; by exfiltrating oAuthToken.accessToken values an attacker can impersonate admins. No public exploit identified at time of analysis, but the fixing commit and GitHub advisory publicly disclose the exact vulnerable code path.
SQL injection in e107 CMS version 2.4.0 (and earlier) lets unauthenticated remote attackers inject arbitrary SQL through the news item page ID parameter, which is concatenated unescaped into a WHERE clause. Because no authentication is required and the flaw yields full read/write/delete access to the backend database - including administrator credential hashes - it enables complete site compromise. No public exploit has been identified at time of analysis, though the trivial injection point makes exploitation straightforward.
SSO-based account takeover in usememos Memos v0.27.1 lets a remote, unauthenticated attacker impersonate any user by exploiting the ssoCredentials path of the SignIn handler (server/router/api/v1/auth_service.go), which matches a federated identity solely on an attacker-controllable identifier (e.g. email or username) instead of the identity provider's stable subject claim. Any deployment that has an OIDC/OAuth SSO provider enabled is affected, and a successful attack yields full control of the targeted account, including potentially administrative accounts. The flaw carries CVSS 9.8 and CWE-287; there is no public exploit identified as weaponized at time of analysis, though a referenced GitHub gist appears to be a researcher write-up, and EPSS is low at 0.22%.
Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).
CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-privileged GUI user to impersonate any other user, including admins, by supplying a crafted 'Grpc-Metadata-USER' header, resulting in full account takeover. The flaw stems from the gRPC/GUI layer trusting a client-supplied identity header instead of the authenticated session. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the fix is trivial to reverse-engineer once the header name is known.
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat the 9.6 as high potential rather than confirmed active abuse.
Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. No public exploit identified at time of analysis, though the CVSS 9.4 rating and 'total' technical impact make this a high-priority patch target.
Remote code execution in Fooocus (lllyasviel/Fooocus) versions 2.5.5 and earlier allows an attacker who can reach the web UI to run arbitrary Python by supplying crafted image metadata that the server passes to eval(). Anyone able to load or import an image whose embedded generation metadata contains malicious Python expressions can achieve full code execution on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix pull request (PR #4207) and a GitHub Security Lab advisory (GHSL-2024-196) both confirm the flaw.
Arbitrary code execution in the PapersGPT for Zotero plugin (versions ≤0.6.1) lets an attacker who controls or tampers with LLM responses run JavaScript in Zotero's chrome-privileged context. Text returned from the LLM endpoint is passed unsanitized into window.eval() in views.ts, so a poisoned PDF (prompt injection), a man-in-the-middle on the API channel, or a malicious custom endpoint can achieve full RCE. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV, but an upstream fix removing the eval sinks is available.
SQL injection in Win Men Intermational's Travel Agency Management System lets unauthenticated remote attackers inject arbitrary SQL to read, modify, and delete backend database contents. Rated CVSS 4.0 9.3 (Critical) with a fully network-exploitable, no-privilege, no-interaction vector, it was disclosed via Taiwan's TWCERT/CC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in MaxKey identity/SSO server (versions 0 through 4.1.11) lets unauthenticated attackers mint valid JWTs using a hard-coded, publicly known signing secret shipped in application-maxkey.properties and present them to the /sign/login/jwt/trust endpoint to obtain a fully authenticated admin session. Because affected builds ship with JWT login enabled by default (LOGIN_JWT defaulting to true), an attacker can set an arbitrary subject claim to impersonate any user, including administrators, gaining control of SSO application configuration and downstream application secrets. No public exploit identified at time of analysis and no CISA KEV listing, but the trivial exploitation path and VulnCheck advisory make this high priority.
Remote code execution in Streambert (Electron desktop streaming/download app) versions before 2.5.0 lets a compromised renderer process coerce the trusted main process into fetching and executing an arbitrary binary through an unvalidated auto-updater URL. Any attacker who first gains control of the renderer - for example via malicious streamed web content or an XSS-style flaw - can escalate that foothold into full code execution on the host. Fixed in 2.5.0; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Federation-based metadata takeover in PeerTube before 8.2.2 lets a malicious remote ActivityPub server rewrite videos it does not own on a victim instance. Because processUpdateActivity/processUpdateVideo never verify that the signing actor's host matches the host in the target video's id (videoObject.id), any federated peer can push an Update that overwrites another server's video title, description, visibility, stored media file, and HLS playlist URLs. No public exploit or CISA KEV listing is identified at time of analysis, but the flaw is remotely reachable without authentication on the victim and carries a 9.3 CVSS with a scope change.
Broken access control in Craft CMS 5.0.0-RC1 through 5.10.5 lets a control-panel user holding only the viewCategories permission permanently reorder and re-parent categories through the structures/move-element action, despite lacking saveCategories. Because category URIs are derived from structure position, an attacker can silently change category URLs and those of all descendants and corrupt taxonomy-driven navigation menus. Reported by VulnCheck with no public exploit identified at time of analysis; the flaw is an integrity-only bypass fixed in 5.10.6.
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operations without passing the intended authorization checks, per Commvault security advisory CV_2026_07_9. The flaw carries a CVSS 4.0 base score of 9.2 with high impact to confidentiality, integrity, and availability, and affects Commvault Cloud deployments across the CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale X components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining unsanctioned command execution across the backup-management control plane. Because CommServe orchestrates the entire Commvault environment, a successful bypass can cascade to Webservers, Command Center, Media Agents, Clients and HyperScale X, threatening confidentiality, integrity and availability of protected data. Rated CVSS 4.0 9.2 (critical) by Commvault; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary local file read in Stanford NLP's DSPy 3.3.0b1 lets an attacker who controls or influences language-model completions exfiltrate host files by returning an Image or Audio typed output whose url field contains a local filesystem path. When JSONAdapter or ChatAdapter parse the completion, the framework reads and base64-encodes the referenced file and embeds it in the next outbound prompt to the attacker-controlled model endpoint. Reported by VulnCheck with a CVSS 4.0 base of 9.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from path traversal in the server-import and admin file-upload features that lets an authenticated user write files to arbitrary filesystem paths accessible to the application. By planting a file in an executable or auto-loaded location, a low-privileged authenticated attacker can escalate to code execution in the context of the Crafty Controller process. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier lets remote attackers read sensitive data and write arbitrary files through a Zip-Slip path-traversal flaw during archive extraction, which can be leveraged to plant executable content and achieve code execution. The issue was disclosed by SonicWall PSIRT (SNWLID-2026-0011) and carries a CVSS 9.1 (Critical) rating. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'.