Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Portainer CE through 2.44.0 exposes root-level Docker host access to any authenticated low-privileged user via a URL path normalization flaw in the Docker proxy endpoint. The authorization middleware evaluates a non-canonical request path (e.g., percent-encoded slashes, double slashes, or traversal sequences) differently from the proxy layer that ultimately forwards it to the Docker daemon - allowing crafted requests to bypass all access controls while executing with full Docker API privileges. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Privilege escalation in Windows Win32K via a heap-based buffer overflow enables a locally authenticated attacker to gain SYSTEM-level access across a broad range of Microsoft operating systems from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-122) requires only standard user privileges and no user interaction, making post-compromise escalation straightforward for any attacker who has already obtained local access. No public exploit has been identified at time of analysis, but the Microsoft Security Response Center has issued a patch and the wide affected product surface warrants urgent remediation.
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke arbitrary Upgrade and filesystem export methods - including OS command execution, file mutation, and process termination - by supplying attacker-controlled function names to the `upgrade-func` and `handleFs` WebSocket handlers. The root cause is the absence of allowlist validation in `src/app/server/dispatch-center.js` and `src/app/server/fs.js`, where client-supplied `func` strings were passed directly to dynamic method calls, including paths exploitable via JavaScript prototype chain traversal. No public exploit or CISA KEV listing exists at time of analysis; CVSS 8.8 reflects the high impact and low complexity once a valid authenticated session is held.
Out-of-bounds read (CWE-125) in Microsoft Office enables local code execution across a broad range of Office product editions on both Windows and macOS. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack requires no privileges but does require a victim to open a crafted file, consistent with a malicious document delivery scenario. A patch has been released by Microsoft; no public exploit code or CISA KEV listing has been identified at the time of analysis, though the full CIA impact (C:H/I:H/A:H) and breadth of affected products make this a high-priority patching target for enterprise environments.
Heap-based buffer overflow in Microsoft Office enables local code execution with high impact across confidentiality, integrity, and availability. Affecting Office 2016 through 2024, including LTSC and Microsoft 365 variants on both Windows and macOS, the vulnerability is triggered when a user opens a specially crafted document - requiring no privileges but mandatory user interaction (CVSS AV:L/UI:R). Patch is available from Microsoft; no public exploit identified at time of analysis.
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.
Local privilege escalation in Microsoft .NET Framework exploits a relative path traversal flaw (CWE-23), enabling an unprivileged local user to gain elevated system rights through user interaction. The vulnerability affects .NET Framework on Windows and is rated CVSS 7.8 (High), with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel via an untrusted pointer dereference (CWE-822) enables a low-privileged, locally authenticated attacker to gain full SYSTEM-level control with high confidentiality, integrity, and availability impact. Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) makes this a reliable second-stage privilege escalation primitive for adversaries who have already achieved local access through any initial foothold.
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbitrary OS commands on a connecting user's machine. The root cause is server-controlled folder names being interpolated without quote-escaping into shell commands — both `du -sh '${folder}'` in `src/app/lib/fs.js` and equivalent calls in `src/client/components/sftp/file-info-modal.jsx` — allowing a crafted single-quote-bearing folder name to break out of the intended shell quoting context. No public exploit has been identified at time of analysis; a vendor-released patch exists in v3.15.120.
Unrestricted file upload in Cockpit CMS versions up to and including 2.6.0 allows any authenticated user to upload PHP scripts via the asset upload endpoint, achieving remote code execution as the web server process. The root cause is the default wildcard (*) value for the allowed_uploads configuration combined with storage of uploaded files in a web-accessible directory - a textbook CWE-434 condition. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier of entry (any authenticated account) makes this a high-priority remediation target for internet-facing deployments.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems.
Use-after-free in Blink, Google Chrome's rendering engine, allows remote unauthenticated attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. All Chrome releases prior to 151.0.7922.137 are confirmed affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score and memory corruption class reflect serious exploitation potential.
Remote code execution within Chrome's renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.137 due to a use-after-free flaw in the HTML subsystem. An unauthenticated remote attacker can exploit this by inducing a victim to visit a crafted HTML page, triggering heap corruption that results in arbitrary code execution scoped to the sandboxed renderer process. No public exploit code has been identified at time of analysis, and EPSS stands at a low 0.31% (23rd percentile), suggesting limited attacker uptake despite the high CVSS score of 8.8.
Use-after-free in Chrome's V8 JavaScript engine (versions prior to 151.0.7922.137) enables remote code execution inside the browser sandbox when a victim visits a crafted HTML page. The vulnerability carries a CVSS 8.8 score reflecting its network-reachable, low-complexity attack path requiring only a single user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Chromium security team rated severity as High and issued an emergency stable-channel update.
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticated attacker to cause the server to issue HTTP requests to arbitrary URLs, exposing internal services, cloud metadata endpoints, and credentials accessible from the Command Center's privileged network position. All versions of Commvault Cloud are indicated as affected per wildcard CPE, with Commvault releasing a resolved maintenance release per advisory CV_2026_07_5. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the CVSS 4.0 score of 8.8 with no authentication or precondition requirements makes this a high-priority remediation target in enterprise environments.
Privilege escalation in Authentik Security authentik through 2026.5.6 allows any holder of a source-scoped SCIM provisioning token to seize superuser control over the entire Identity Provider and permanently lock out all legitimate administrators. The root cause is the SCIM group ingest function's failure to validate whether the requesting token's source scope has authority over the target group - when an attacker provisions a SCIM group whose name matches an existing administrator group, authentik silently adopts and replaces that group's membership without authorization checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS score of 8.8 and the total-takeover impact warrant immediate remediation.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Privilege escalation in Authentik Security authentik through version 2026.5.6 allows an attacker holding a source-scoped SCIM provisioning token to take over any local account, including superuser accounts, by provisioning a SCIM user whose username matches an existing account. The SCIM user ingest function adopts pre-existing local accounts by username without enforcing scope boundaries, meaning a limited-privilege provisioning credential can rewrite or delete accounts entirely outside its intended scope. No public exploit has been identified at time of analysis, but the attack requires only network access and a valid SCIM token, making the exploitation bar low for any attacker who has obtained such a credential.
Privilege escalation in Azure SQL Database allows a locally authenticated attacker to gain elevated permissions through incorrect permission assignment on a critical resource. The flaw is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning a resource - likely a file, registry key, named pipe, or shared object - is accessible with overly permissive settings. An attacker with existing local access and low-privilege credentials could exploit this to achieve high confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.
Privilege escalation in the Windows Remote Access API via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker with low privileges to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2022/2025 hosts. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a valid local account and no user interaction, making it a reliable post-compromise escalation path. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all enumerated affected versions.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Privilege escalation in the Windows Kernel (CVE-2026-65773) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control over affected systems, with high impact on confidentiality, integrity, and availability. The flaw affects a wide swath of Windows releases - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) means a working exploit, once developed, would require minimal environmental preconditions.
Privilege escalation in Windows Schannel via a use-after-free (CWE-416) memory corruption flaw allows a locally authenticated, low-privileged attacker to elevate privileges - likely to SYSTEM - on Windows 11 and Windows Server 2025 systems. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects reliable, low-complexity exploitation requiring only a standard user account and no user interaction. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in Pimcore admin-ui-classic-bundle (all versions through 2.3) permits authenticated backend users to execute arbitrary SQL against the underlying database via the DataObject grid id column filter. The filter value is concatenated unsanitized directly into a SQL WHERE clause, bypassing parameterization entirely, enabling an attacker to exfiltrate or modify all database contents. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS score of 8.8 with full C/I/A:H impact and the straightforward CWE-89 pattern make this a meaningful risk for any unpatched Pimcore deployment.
SQL injection in CiviCRM through version 6.18.alpha1 allows authenticated staff-level users to exfiltrate the entire backend database via the contact search RLIKE clause. The vulnerability arises because user-supplied input is concatenated directly into the SQL query without sanitization, satisfying CWE-89. Sensitive records including donor, member, and organizational data are exposed to any user holding staff-level credentials. No public exploit or CISA KEV listing has been identified at the time of analysis, though the low exploitation complexity elevates real-world risk.
Remote code execution via unsafe Java deserialization affects Red Hat Infinispan's session replication path, where the JBoss Marshalling River unmarshaller processes replicated session data from cluster peers with no class allowlist or filtering. Any attacker with adjacen-network access to the Infinispan cluster replication channel can inject a crafted serialized payload exploiting standard Java gadget chains, achieving arbitrary code execution on every cluster node that deserializes the replicated data. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, though its adjacency requirement limits blast radius to attackers already positioned on the cluster network.
Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated non-administrative user to overwrite platform-wide OIDC/SSO configuration via an unprotected endpoint, enabling full credential harvesting against all platform users. The configuration endpoint applies new OIDC issuer settings without performing any administrative role check (CWE-284), meaning a low-privilege helpdesk agent can silently redirect all SSO logins to an attacker-controlled identity provider. CVSS scores 8.8 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in Adobe Commerce and Magento Open Source enables a low-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon page visit - with scope change allowing script execution beyond the vulnerable component's security boundary, potentially enabling full account or session takeover. The CVSS 8.7 High score reflects network accessibility, low complexity, changed scope, and high confidentiality and integrity impact. No active exploitation (KEV) or public POC has been identified at time of analysis; Adobe released patched August 2026 builds across all affected product lines per advisory APSB26-92.
Remote code execution in Craft CMS allows an authenticated control panel user to escape the Twig sandbox and execute arbitrary server-side PHP, even when sandbox mode is explicitly enabled via `enableTwigSandbox()`. The root cause is that the sandbox's class allowlisting propagates through the entire class hierarchy of `ElementInterface`, ultimately exposing the well-known `yii\base\Component` arbitrary function-call gadget - the identical primitive behind at least four prior Craft CMS CVEs. Affected versions are 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2; patched releases 5.10.7 and 4.18.3 are available, and no CISA KEV listing exists at time of analysis.
Remote code execution in Microsoft SharePoint Server allows any authenticated network attacker to execute arbitrary code by submitting a malicious serialized object payload to vulnerable endpoints. Three major SharePoint versions are affected - SharePoint Server 2016, 2019, and Subscription Edition - all running build versions below their respective patched thresholds. No public exploit code has been identified at time of analysis, but the low privilege requirement (any valid SharePoint account) and low attack complexity make this a high organizational priority, particularly given SharePoint's widespread enterprise deployment footprint.
Remote code execution in Microsoft SharePoint Server affects authenticated network users through unsafe deserialization of attacker-controlled data. Affected versions span SharePoint Server 2019, SharePoint Enterprise Server 2016, and SharePoint Server Subscription Edition - all running build numbers below the patched releases issued by Microsoft. An attacker with a valid low-privilege account can send a crafted payload over the network to trigger arbitrary code execution on the server without any user interaction, achieving full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity, network-reachable attack surface makes this a high-priority patching target.
Privilege escalation in Microsoft SharePoint allows an authenticated low-privilege attacker to elevate to higher permissions over a network, exploiting improper authentication logic (CWE-287). Three on-premises SharePoint versions are confirmed affected - Enterprise Server 2016, Server 2019, and the current Subscription Edition - with vendor-released patches available for all. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score and full High C/I/A impact profile make this a serious priority for organizations running unpatched on-premises SharePoint.
Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.
Insecure Direct Object Reference in Chiline Cloud (Inventec Appliances) versions up to and including 4.5.9 exposes sensitive user data to unauthenticated remote attackers. By manipulating a specific request parameter - likely a user identifier or resource key - an attacker can bypass authorization checks and read account data belonging to arbitrary other users. Reported by TWCERT and catalogued under EUVD-2026-55925, no public exploit code or active exploitation has been confirmed at time of analysis, though the trivial exploitation conditions (network-accessible, no authentication, no user interaction) make this a high-priority disclosure risk.
Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.
Shell command injection in libgit2's SSH libssh2 backend (v0.27.0-v1.9.0) enables remote attackers to execute arbitrary commands on an SSH server by embedding unescaped shell metacharacters in a submodule URL. An attacker who controls a repository's .gitmodules file can induce arbitrary SSH server-side code execution under the victim's SSH user account when the victim performs a recursive clone using a libgit2-based client built with the libssh2 backend. No public exploit has been identified at time of analysis and SSVC assessment records no active exploitation, but CVSS 4.0 scores this 8.6 and technical impact is rated total.
Remote denial-of-service in the Windows Graphics Kernel allows unauthenticated network attackers to crash affected systems by triggering a null pointer dereference in kernel mode, impacting availability across Windows 10, Windows 11, and Windows Server 2022/2025. The CVSS Scope:Changed flag indicates the resulting crash propagates beyond the Graphics Kernel subsystem itself, consistent with a full system halt (BSOD). No public exploit has been identified at time of analysis, and Microsoft has released patches establishing fixed build numbers for all confirmed affected versions.
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any org in the deployment by exploiting a misplaced permission check. The server incorrectly validates the ORG_ADMIN permission against the caller's own child org rather than the ROOT org, and child org admins can self-grant this permission within their local ACL scope. An attacker with child org admin credentials can permanently delete peer orgs - including all their forensic artifacts, hunt data, and client configurations - well outside their authorized boundary.
Server-Side Request Forgery in MISP's cti-transmute tool allows unauthenticated network attackers to leverage the /fetch_misp_event and /misp_search_events endpoints as a proxy into the server's internal network by supplying a domain name whose DNS record resolves to a private or reserved IP address. The validation logic checked IP literals against blocked ranges but unconditionally trusted domain names, creating a trivially exploitable DNS-bypass gap confirmed by the upstream commit to expose full internal response bodies to anonymous callers. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the zero-prerequisite attack surface against potentially sensitive threat intelligence infrastructure makes prompt remediation essential.
OS command injection in Activepieces before 0.80.0 allows any authenticated user with flow creation or editing privileges to execute arbitrary commands as the worker process user by embedding shell metacharacters in a Code step's name. The injection occurs inside the worker's code-compilation pipeline before the code sandbox is instantiated, bypassing the intended isolation boundary entirely. An attacker exploiting this can exfiltrate environment secrets, read and write the worker filesystem, and pivot to internal services reachable by the worker process. No public exploit or CISA KEV listing is confirmed at time of analysis.
Incorrect JSON Pointer escape-sequence decoding in cJSON versions 1.5.0 through 1.7.19 allows unauthenticated network attackers to redirect RFC 6902 JSON Patch operations to unintended object keys by supplying crafted ~0 or ~1 sequences in patch paths. Any application that exposes cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to external input is vulnerable to silent data corruption, unintended key deletion, and potential authorization bypass when JSON Patch is used to gate access-controlled modifications. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface and high integrity impact (CVSS 4.0: 8.7) make this a meaningful risk for any service built on cJSON's utility layer.