Authenticated remote code execution in ImpressCMS allows administrators with access to the custom tag module to store and persistently execute arbitrary PHP code across all frontend page loads. The root mechanism is a decode-then-eval pattern: the application's renderWithPhp() method calls undoHtmlSpecialChars() on stored tag content before passing it to eval(), causing HTML Purifier sanitization to be bypassed entirely since purification operates on the encoded form. Publicly available exploit code exists on GitHub; this vulnerability has not been confirmed as actively exploited by CISA KEV at time of analysis.
OS command injection in the Baicells EG3661M LuCI web interface (firmware BaiCE_BQ6_2.0.5.3_NA) allows an authenticated remote attacker with administrative credentials to execute arbitrary operating system commands by manipulating the MaxHops, Timeout, or Size arguments passed to /cgi-bin/luci. Full confidentiality, integrity, and availability compromise of the device is achievable upon exploitation. A public proof-of-concept exploit is available on GitHub, and no vendor patch exists - the vendor did not respond to responsible disclosure, leaving affected deployments with no official remediation path.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.
Buffer overflow in the Tenda G0 router's httpd web management interface allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by submitting oversized input to the setPortMapping function via the /goform/module endpoint. All firmware builds up to version 20260625 are confirmed affected per ENISA EUVD-2026-58585. A public proof-of-concept exploit has been released on GitHub, substantially lowering the skill threshold for exploitation; no CISA KEV listing confirming active mass exploitation was present at time of analysis.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows low-privileged remote attackers to corrupt stack memory by sending a crafted `staticRouteNet` argument to the `/goform/module` endpoint, potentially enabling arbitrary code execution on the device. All firmware versions up to and including build 20260625 are confirmed affected. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk; however, no CISA KEV listing has been identified, indicating active exploitation is not yet confirmed at scale.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows network-adjacent or remote authenticated attackers to corrupt stack memory by supplying an oversized value to the portMirrorMirroredPorts argument of the formSetPortMirror function at the /goform/module endpoint. All G0 firmware builds through 20260625 are confirmed affected per EUVD-2026-58575 and NVD CPE data. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation; no CISA KEV listing has been identified, so active widespread exploitation is not confirmed at time of analysis.
Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function `set_wl_guest_iplist` at the `/goform/WifiGuestSet` endpoint fails to validate the length of the `shareSpeed` argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the `httpd` process - which typically runs as root on embedded router firmware. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the barrier to exploitation; no CISA KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis.
Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated attacker to overflow a fixed-size stack buffer in the `set_device_name` function by sending an excessively long `devName` value to the `/goform/SetOnlineDevName` endpoint of the httpd web management interface. Successful exploitation could yield arbitrary code execution on the device with the privileges of the httpd process. A public proof-of-concept exploit has been published on GitHub, elevating real-world risk despite the absence of a CISA KEV listing.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). Publicly available exploit code exists, raising active risk for any deployment where the web management interface is reachable and low-privilege credentials are obtainable.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to execute arbitrary code by supplying an oversized qosListConnecttedNum argument to the lstAdd function via the /goform/editQos endpoint. The vulnerability affects the QoS Edit component of this SOHO router and carries high impact across confidentiality, integrity, and availability - consistent with full device takeover. A publicly available proof-of-concept exploit exists on GitHub, meaningfully elevating operational urgency despite the absence of CISA KEV confirmation.
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute arbitrary shell commands on the Semaphore server host by injecting git arguments through a crafted repository git_url value. The root cause (CWE-88, Argument Injection) lies in the default cmd_git client passing user-supplied input unsanitized to the system git binary, enabling exploitation via git's --upload-pack= option to specify an arbitrary server-side command. No public exploit code has been confirmed at time of analysis, but the --upload-pack argument injection technique is extensively documented in open-source security research and requires no specialized tooling for any holder of the requisite project role.
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command execution by embedding shell metacharacters in application configuration values, which are later executed unsanitized when specific backend operations are triggered. The CWE-78 root cause and the PR:H CVSS 4.0 metric confirm exploitation is gated behind administrator-level access, restricting the realistic attacker population to insiders, compromised admin credentials, or post-escalation actors. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Tenable self-reported this via vulnreport@tenable.com and published advisory TNS-2026-22.
Command injection in Cockpit CMS 2.14.0 and earlier allows any authenticated user holding only the assets/upload permission to execute arbitrary OS commands as the web-server user. The FFmpeg integration passes the raw, user-controlled upload filename directly into Process::fromShellCommandline() before slug sanitization runs, meaning shell metacharacters - backticks, $(), semicolons - in the filename escape the FFmpeg invocation context. No public exploit has been identified at time of analysis, but the fix is confirmed in upstream commit 28813596f57685f63d3a48f655e8e9bd2b535cab, which migrates all FFmpeg invocations from shell-interpolated command strings to argument-array Process construction.
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed their authorized privilege level via manipulated user-supplied input processed without adequate authorization checks. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, exploitation could allow an attacker with only low-privilege credentials to read, modify, or disrupt mirrored database content. No public exploit code and no CISA KEV listing have been identified at time of analysis, though a vendor patch is available.
Privilege escalation via a deterministic use-after-free in Zephyr RTOS's dynamic kernel-object disposal path affects any firmware build compiled with both CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled. An unprivileged user thread can arm a dynamically-allocated k_timer, then release its last permission - causing unref_check() to free the timer's backing storage while the embedded struct _timeout dnode remains linked in the global _timeout_q; when the timer subsequently fires, z_timer_expiration_handler() dereferences and writes the freed - and potentially reallocated - kernel heap at ISR privilege. The bug constitutes a reliable sandbox-escape memory-corruption primitive scored CVSS 8.8 with scope change (S:C), and no public exploit has been identified at time of analysis.
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary PHP files on the server by exploiting a validation bypass in the Flex Objects plugin. The attacker crafts a ZIP archive containing PHP code, circumvents routine-name validation by substituting array notation for the expected string notation, and triggers the unZip routine to write the payload directly into the web root where it becomes immediately executable via HTTP. No public exploit has been identified at time of analysis, but the precise bypass technique disclosed in the advisory substantially lowers the barrier to exploitation for any attacker holding valid credentials.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Server-side template injection (SSTI) leading to remote code execution in the Grav CMS API plugin (getgrav/grav-plugin-api) before version 1.0.13 is reachable by any low-privilege API key holder whose key was minted on a super-admin account. The root flaw is in PagesController::guardTwigContent(), which gates Twig processing via a bare isSuperAdmin() call that ignores the api_key_scopes array, allowing a key deliberately scoped to api.pages.write to enable process.twig on page save despite admin.pages_twig being intentionally excluded from that scope. A public proof-of-concept exists per SSVC data; exploitation is classified as automatable with total technical impact, making this a high-priority patch target for any Grav deployment where the required non-default configuration is active.
Remote code execution in Grav API plugin versions before 1.0.13 is achievable by any attacker holding a scoped api.config.write API key. The ConfigController fails to enforce its super-scope gates, permitting scoped keys to overwrite scheduler.custom_jobs configuration that Grav subsequently executes via the Symfony Process component. A public exploit exists per SSVC data, the attack is rated automatable, and technical impact is assessed as total - making this a high-priority patching target despite a low EPSS score.
Force-disabling of two-factor authentication on Grav CMS user accounts is achievable through a missing scope enforcement check in the grav-plugin-api Composer package before version 1.0.13. Any holder of a low-privilege API key carrying api.users.write permission - or any scoped key on a super account - can POST to /api/v1/users/{user}/2fa/disable without supplying a TOTP code, stripping 2FA from any non-super target account and enabling direct account takeover. No active exploitation is currently confirmed (SSVC Exploitation: none; EPSS 0.34%), but SSVC rates this automatable with total technical impact, making prompt patching critical for any instance exposing the API with delegated keys.
Privilege escalation in Grav's Flex Objects plugin (through version 1.4.6, confirmed against Grav 2.0.11) allows an authenticated low-privileged admin to achieve full site takeover by exploiting a missing authorization check in FlexApiController::update(). The generic /api/v1/flex-objects/user-accounts and /api/v1/flex-objects/user-groups API endpoints omit the field-level, target, and super-admin guards enforced by the dedicated Users and Groups controllers, so an account holding only api.access, admin.login, and users.update can overwrite a super administrator's password or self-grant admin.super group membership. No public exploit is identified at time of analysis; vendor-released patch Flex Objects 1.4.7 is available.
Privilege escalation in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 allows an authenticated API key holder with api.users.write scope to silently bypass the scope-cap enforcement and self-elevate to super-administrator. The flaw lies in UsersController's create() and update() methods, which validate scope caps only for api.users.write actions but fall back to a bare isSuperAdmin() check - reading access.api.super from the parent account rather than the key's own scope - when granting super privileges, allowing a limited key on a super account to mint or promote unrestricted admin accounts. A proof-of-concept exists per SSVC assessment, CISA rates exploitation as automatable with total technical impact, and a vendor-released patch is available at version 1.0.13.
Privilege escalation in the getgrav/grav-plugin-api plugin before 1.0.13 allows an authenticated attacker holding only a minimal api.access-scoped key on a super account to mint a full-access, unscoped super key by exploiting missing scope-subset enforcement in createApiKey. The self-target path of requireApiKeyPermission() enforces only the baseline api.access scope, while the new key's scopes are taken verbatim from the attacker-controlled request body with no validation that they fall within the caller's granted scopes. Submitting an empty scopes array produces a key with unrestricted super privileges, directly enabling further attack chains including configuration-write-to-RCE. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS is 0.30% (23rd percentile). Vendor-released patch version 1.0.13 is available.
Improper access control in File Browser before 2.63.20 allows authenticated users operating through proxy or hook authentication to escape their isolated directory scope and access the server root, exposing all other users' files for reading, modification, deletion, and sharing. The flaw specifically targets the createUserDir isolation mechanism, which is bypassed during auto-provisioning in proxy and hook authentication paths - leaving multi-tenant or shared File Browser deployments fully compromised at the data layer. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS 4.0 score of 8.7 reflects the high impact once a valid upstream credential is obtained.
Privilege escalation in getgrav/grav-plugin-api versions 1.0.6 through 1.0.11 allows any holder of a scoped, read-only API key to perform super-admin write operations - including rewriting group ACL maps to elevate arbitrary accounts to super-admin. The flaw exists because four privileged write endpoints (GroupsController, AccountsConfigController, PreferencesController, DashboardWidgetController) authorize via an isSuperAdmin() early-return that entirely skips requirePermission(), the only function that enforces scope caps on API keys. A leaked CI or monitoring key with a minimal scope such as api.pages.read is sufficient to achieve full administrative compromise. No public exploit code has been identified at time of analysis, and a patch is available in version 1.0.13.
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to place files at any location on the underlying IBM i system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/I:H) confirms network-reachable exploitation without authentication, with a scope change indicating impact beyond the Db2 Mirror application itself - reaching OS-level paths. No public exploit or KEV listing has been identified at time of analysis, and an EPSS of 0.59% (46th percentile) suggests low observed exploitation activity despite the high CVSS base score.
Unauthenticated firmware flashing in Netis NC63 routers (firmware V3.0.0.3327) allows any attacker on the same network segment to permanently compromise the device by uploading arbitrary firmware without credentials. Two compounding flaws enable this: the embedded Boa web server grants access to any URL path containing '.cgi' regardless of session cookie validity, and the netis.cgi CGI dispatcher reads but never enforces the authentication state before invoking the firmware update handler. Firmware images are accepted if they pass only a forgeable additive checksum and static product string checks - no cryptographic signature verification is performed. A public proof-of-concept exploit exists on GitHub (ozcanpng/CVE-2026-73673), and no vendor-released patch has been identified at time of analysis.
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standard payroll permissions to read salary and banking details belonging to employees of entirely separate companies within the same multi-tenant instance, and to create payroll records attributed to those foreign employees. The flaw exists at the query layer: the payroll listing endpoint omits a company_id scope constraint, and payroll creation validates employee identifiers for global database existence rather than for membership in the caller's own company. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier makes this an urgent priority for any multi-tenant deployment.
Privilege escalation in Grav Plugin API before 1.0.13 allows an attacker controlling a minimal api.users.write API key - issued under a super admin account - to craft invitation records that embed super-admin access flags, which are written verbatim to any account that accepts the invitation. The root cause is CWE-269 improper privilege management: InvitationsController's strip-super and accept-groups decisions evaluate isSuperAdmin() against the owning account rather than against the API key's declared scope, so a deliberately restricted key silently retains the owner's super-admin authority for these checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in Emlog 2.6.20 and earlier exposes the database to full compromise through the queryDatabase function in ai.php, a component of the platform's AI feature set. The CVSS 4.0 vector (PR:H) confirms exploitation requires high-privilege authenticated access, yet the resulting impact is rated High across confidentiality, integrity, and availability of the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in iCagenda, a Joomla event calendar extension by icagenda.com, affects all versions prior to 4.0.11 and allows authenticated backend operators with iCagenda access permissions to execute arbitrary SQL through an unescaped numeric filter parameter. Successful exploitation yields full database confidentiality, integrity, and availability compromise - enabling data exfiltration, modification, or destruction of the underlying Joomla database. No public exploit or CISA KEV listing has been identified at time of analysis, and the PR:H requirement limits the realistic attacker pool to trusted insiders or compromised admin accounts.
SQL injection in the Paymob for WooCommerce WordPress plugin (versions before 4.1.9) allows unauthenticated remote attackers to read arbitrary data from the WordPress database - including user credentials and application secrets - by submitting a crafted payment callback request. The critical design flaw is that the unsanitized client-supplied identifier is passed directly into a SQL query before the plugin validates the payment provider's HMAC signature, entirely bypassing the intended authentication gate. Both in-band (reflected) and time-based blind extraction techniques are viable, maximizing attacker flexibility. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, though the unauthenticated, low-complexity attack vector makes this a high-priority patching target for any site running this plugin.
Reflected XSS in LimeSurvey Community Edition 7.0.5 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated administrator by delivering a crafted URL targeting the HTML editor popup endpoint. The `text` and `name` query parameters bypass a blacklist-based sanitizer and are rendered unencoded across at least four distinct output contexts - an HTML title element, a JavaScript `window.status` assignment, and multiple `document.getElementById()` calls - confirmed by the patch commit diff. No public exploit has been identified at time of analysis, but an upstream fix is available as a merged GitHub commit and a vendor patch is listed as available.
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Remote code execution in Eclipse Theia 1.69.0 and earlier allows an attacker to execute arbitrary commands with the victim's user privileges by embedding a malicious git repository configuration inside a cloned repository. Any Theia-based IDE or application including the @theia/git extension or the bundled VS Code git extension is affected, because both automatically invoke git commands such as git status upon folder open without first presenting a workspace trust prompt. This vendor-confirmed issue is fixed in version 1.70.0 via workspace trust enforcement; no public exploit code has been identified at time of analysis and it does not appear in the CISA KEV catalog.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection in @ooples/token-optimizer-mcp v5.0.1 and earlier allows any MCP client that can call the smart_user tool to execute arbitrary shell commands with the privileges of the MCP server process. The get-user-info operation interpolates the caller-controlled username argument directly into a shell command string passed to Node.js execAsync(), and the double-quoting applied by the developer does not prevent POSIX shell command substitution via $(...) or backtick syntax. A complete, working proof-of-concept is publicly available via GHSA-49mq-fc6q-3h46; no public exploit identified at time of analysis as actively exploited per CISA KEV, though the low exploitation complexity makes this a high-priority patching target.
Authorization regression in Budibase v3.39.4 enables any authenticated BASIC user to generate S3 PutObject presigned URLs for arbitrary S3 buckets, bypassing the intended BUILDER-level permission gate on the attachment upload endpoint. The regression introduced in v3.39.4 - where the route guard was changed from `authorized(BUILDER)` to `authorized(PermissionType.TABLE, PermissionLevel.WRITE)` - gives all default BASIC users access to an endpoint that was explicitly restricted to builders. Compounding the issue, the endpoint accepts an attacker-controlled `bucket` parameter without validating it against the datasource's configured bucket, allowing writes to any S3 bucket reachable by the platform's stored IAM credentials. No public exploit tool exists at time of analysis, but the official GHSA advisory publishes complete reproduction steps and the test suite confirms the behavior, making exploitation trivial for any authenticated platform user.
XXE injection in Datavane TIS v5.0.0 exposes authenticated attackers a path to SSRF and out-of-band file exfiltration against the server hosting the application. The `doEditWorkflow` endpoint accepts a `taskScript` parameter parsed by an unhardened Java `DocumentBuilderFactory` that resolves external entities and loads external DTDs, allowing a crafted XML payload to trigger outbound HTTP requests to attacker-controlled infrastructure and read local files accessible to the TIS process user, including configuration files and Derby database credentials. No public exploit has been identified at time of analysis, but VulnCheck has published a dedicated advisory and the upstream patch commit is publicly accessible, providing clear technical signal about the vulnerable code path.