Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote unauthenticated OS command injection in the Haiwell IoT Cloud HMI Gateway (version 3.40.1.12) lets attackers run arbitrary operating-system commands as root through the 'Net Check' function's cmdPing Socket.io event on the /setting endpoint. The CVSS 3.1 base score is 10.0 with a scope change, reflecting full compromise of the device with no authentication or user interaction. No public exploit has been identified at time of analysis, and the flaw is documented in CISA ICS advisory ICSA-26-225-02.
Unauthenticated remote code execution in MindsDB Minds Platform (version 26.1.0 and earlier) lets any network-reachable attacker run arbitrary OS commands on the host by chaining two unprotected API endpoints. The attacker first sets a controlled LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submits a crafted prompt to POST /api/v1/responses/ that steers the Anton agent into calling its scratchpad tool, which passes attacker-influenced Python directly into exec() with no sandbox. Reported by VulnCheck with a maximum CVSS 4.0 score of 10.0 and CWE-94; no public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication make it high priority.
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to run arbitrary code by exploiting external control of a file name or path (CWE-73). The flaw carries a CVSS 9.8 rating with a network attack vector and no privileges or user interaction required, and IBM has published a fix. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read or modify sensitive information by exploiting improper validation of request URI path segments. Because the flaw is reachable over the network without credentials or user interaction, an attacker can defeat access controls on the replication/administration interface and reach protected functionality or data. No public exploit has been identified at time of analysis, but the maximal CVSS 9.8 rating and the low attack complexity make this a high-priority patching target.
SQL injection in SiYuan's backlink/mention search (kernel/model/backlink.go) lets unauthenticated attackers execute arbitrary SQL against the self-hosted note-taking application through v3.7.2. Because the search routine escapes only double quotes and leaves single quotes intact, a crafted keyword or malicious stored block metadata breaks out of the SQL string literal on the primary read-write siyuan.db handle, enabling cross-notebook read and write. VulnCheck reports the flaw (CVSS 4.0 base 9.9); no public exploit identified at time of analysis, and it is fixed in v3.7.4.
Authentication bypass and re-installation abuse in Emlog 2.6.26 and earlier lets a remote unauthenticated attacker POST to install.php with action=reinstall, which deliberately skips the already-installed guard because that check only runs when the action is not 'reinstall'. By supplying attacker-chosen database and admin credentials, the attacker overwrites config.php via file_put_contents and provisions a new administrator account, achieving full takeover of an already-live site. No public exploit has been identified at time of analysis and no vendor-released patch is available, though the flaw is trivially reachable against default installations.
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Language commands on the IBM i host because special elements in a command are not properly neutralized (CWE-78). The CVSS 3.1 base score is 9.8 with a fully network-facing, no-privilege, no-interaction vector, meaning an unauthenticated remote attacker can achieve high-impact code execution. There is no public exploit identified at time of analysis and EPSS is modest at 0.47% (39th percentile), but the combination of unauthenticated network reach and full CIA impact makes this a high-priority patch.
Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.
Unauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1) lets remote attackers seize any existing account, including administrators. The wpm_register() function verifies the registration cookie only against the GET reg parameter while trusting the POST mergewith and wpm_id parameters, so an attacker who supplies a victim's numeric user ID as mergewith causes wp_update_user() (plus a direct $wpdb query) to overwrite that account's username, password, email, and name with attacker values while suppressing WordPress notification emails. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority issue for any site running the plugin.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; note the vendor description says 'unauthenticated' while the published CVSS vector carries PR:L, an unresolved discrepancy affecting who can actually trigger it.
Authentication bypass in Roskus Prospero Flow CRM before 5.15.9 lets unauthenticated remote attackers log in as any employee onboarded through the standard HR flow using only that employee's email address. The employee save controller assigns a hard-coded fallback password of "changeme" (CWE-798) because the onboarding form exposes no password field, leaving newly created accounts with a universally known credential. No public exploit code or CISA KEV listing is identified at time of analysis, but the flaw is trivially reproducible from the public fix commit, and the CVSS 4.0 base score is 9.3 (Critical).
CVE-2026-73251 concerns built-in TLS certificate-chain verification involving CA bundles, reported by Ubuntu. The available intelligence is critically sparse - no description of the actual flaw, no CVSS vector, no CWE classification, and no references have been provided. No meaningful synthesis of attacker capability, affected versions, or exploitability is possible from the supplied data alone. Security teams should treat this record as preliminary pending vendor disclosure.
Authentication bypass in Laravel Socialite's Facebook provider (versions before 5.29.0) lets unauthenticated remote attackers replay captured OIDC id_tokens because getUserByOIDCToken() in FacebookProvider.php validates signature, aud, and iss but never checks a session-bound nonce. An attacker holding any valid, unexpired id_token minted for the same Facebook App ID can submit it to the backend's userFromToken() endpoint and be logged in as the victim, achieving full account takeover. Reported by VulnCheck and assigned CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not on CISA KEV.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
Unauthorized disclosure of private content in SiYuan (siyuan-note) versions before v3.7.4 lets anonymous, unauthenticated clients subscribe to the WebSocket broadcast channel on the publish surface and receive real-time editing events for every document, including password-protected and explicitly forbidden ones. Reported by VulnCheck and documented in the vendor's GHSA advisory, the flaw is a missing authorization (CWE-862) check on broadcast sessions rather than a memory-corruption bug. No public exploit identified at time of analysis, but the trivial network-only access path and 9.2 CVSS 4.0 score make this a high-priority confidentiality issue for any exposed publish deployment.
SQL injection in the iCagenda event-management extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through the mod_icagenda_calendar calendar module, which is reachable via Joomla's com_ajax endpoint without any session, CSRF token, or user account. Affected versions run from 4.0.0 through 4.0.11, and the CVSS 4.0 base score of 9.2 (Critical) reflects high confidentiality impact with additional integrity and availability effects. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial reachability makes it a strong patch priority.