Stored XSS in Shaarli versions prior to 0.16.3 enables administrator account takeover through a low-effort social engineering chain requiring only that an administrator bookmark an attacker-controlled URL. The permalink handler in BookmarkListController.php writes raw bookmark titles into the HTML <title> element without HTML escaping, and Shaarli's built-in metadata fetcher copies remote page titles verbatim - meaning an attacker who controls a webpage's title silently plants a persistent payload the moment any admin bookmarks that URL. The injected script then executes in the Shaarli origin for every subsequent visitor to the permalink, including the administrator on first save, creating a one-shot session-hijacking path; no public exploit has been identified at time of analysis.
Password change authorization bypass in WeGIA before 3.9.2 allows any authenticated user to permanently take over their own account - or one they hold temporary session access to - without supplying the existing password. The `alterarSenha` method is unconditionally excluded from permission checks in `controle/control.php`, and manipulating the `redir` parameter routes password-change requests through `verificarSenhaConfig()` rather than the credential-verifying `verificarSenha()`, stripping the old-password requirement entirely. No public exploit code has been identified at time of analysis, though the mechanically simple parameter manipulation lowers the practical bar significantly.
SQL injection in BigBlueButton's breakout room management exposes the application database to arbitrary query execution by authenticated moderators. Versions prior to 3.0.23 are affected via the `refreshBreakoutRoomsVisibleForUsers` method in `BreakoutRoomUserDAO.scala`, where `meetingId` and `userId` were interpolated directly into SQL using Scala's raw `#$` string operator without parameterization. No public exploit or CISA KEV listing has been identified at time of analysis, but the patch is confirmed in release v3.0.23 with commit-level evidence.
Server-side request forgery in Microsoft Azure Virtual Machines enables a low-privileged authenticated attacker to forge internal network requests, ultimately achieving privilege escalation with full confidentiality, integrity, and availability impact across a changed scope. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:H/I:H/A:H) confirms the vulnerability reaches beyond the Azure VM component itself, potentially compromising adjacent Azure services or internal metadata infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released a patch via MSRC.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.
CSRF vulnerabilities in Frappe Framework's OAuth2 consent flow allow network-accessible attackers to trick authenticated users into unknowingly approving OAuth grants or to reuse authorization state across unintended clients, exposing user data and permitting actions within granted scopes. Three weaknesses combine: the consent approval endpoint accepted GET requests, the consent template lacked CSRF token protection, and active OAuth token lookups were not scoped to the requesting client_id. Versions prior to 15.114.0 and 16.x prior to 16.26.0 are affected; vendor-released patches are available and no public exploit has been identified at time of analysis.
Heap buffer overflow in hank-ai/darknet's convolutional layer initialization corrupts process memory when a crafted .cfg model configuration is loaded, because layer weight and output buffer sizes are derived from unchecked 32-bit integer multiplication of configuration-supplied fields, allowing the product to wrap to zero or a small value. Darknet versions through 6.0 are affected, and no valid .weights file is required to trigger the flaw - the .cfg alone is sufficient. A publicly available proof of concept demonstrates both an out-of-bounds read under AddressSanitizer and glibc allocator metadata corruption in a release build, confirming that exploitation does not require deep reverse engineering.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the WP w3all phpBB WordPress plugin (versions ≤ 3.0.5) allows any authenticated subscriber to extract sensitive data from the underlying database via unsanitized query input. The CVSS scope change metric (S:C) combined with high confidentiality impact (C:H) indicates the injection can reach beyond the plugin's own data - potentially exposing phpBB user credentials, private messages, or WordPress core tables. No public exploit code or CISA KEV listing is identified at time of analysis; however, the low authentication barrier (subscriber-level) makes this accessible to any registered WordPress user.
SQL injection in WordPress Persistent Login plugin (versions 3.1.0 and earlier) can be triggered by a subscriber-level authenticated user, allowing extraction of sensitive database records including user credentials and site configuration data. The vulnerability carries a scope change in the CVSS assessment (S:C), indicating that injected queries can reach database content beyond the plugin's immediate context. No public exploit or CISA KEV listing has been identified at the time of this analysis, but the low attack complexity and wide deployment of WordPress as a platform make this a meaningful risk for any site running this plugin.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is confirmed in v8.18.3.
Path traversal in DigiDoc4 (versions 4.0.0 through 4.10.x) enables arbitrary filesystem writes when a user opens a specially crafted ASiC container file. The underlying libdigidocpp library parsed `full-path` entries in container manifests without validating traversal sequences such as `..`, allowing embedded files to be extracted outside the intended directory. No public exploit has been identified and no CISA KEV listing exists; the CVSS 4.0 score of 8.4 reflects high local confidentiality and integrity impact contingent on active user interaction.
Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener to corrupt heap memory, achieving full confidentiality, integrity, and availability impact. Release builds compiled with -DNDEBUG silently remove the EVUTIL_ASSERT length guard, causing memcpy to write a kernel-supplied 110-byte sockaddr_un into the 28-byte conn_address union field and overwriting the adjacent dns_request heap pointer. No public exploit has been identified at time of analysis, but the absence of privilege requirements and low attack complexity make this accessible to any local process with filesystem access to the socket path.
Heap out-of-bounds write in GraphicsMagick's Photo CD (PCD) decoder enables heap memory corruption when processing a maliciously crafted PCD image. The DecodeImage() function in coders/pcd.c unconditionally advances its output pointer (q++) on every decoded Huffman delta without validating it against the end of the heap-allocated luma or chroma plane buffers, so an attacker-controlled PCD file can drive the pointer arbitrarily past the allocation boundary and overwrite adjacent heap memory. Any application invoking gm convert, gm identify, or linking against libGraphicsMagick while processing untrusted PCD files is at risk; no public exploit is identified at time of analysis.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Prototype pollution in the gettext-converter npm library's js2i18next() function enables an attacker who can supply crafted translation data to write arbitrary values onto Object.prototype, corrupting the shared prototype chain for the entire Node.js runtime. All versions of gettext-converter below 1.3.3 are vulnerable when the consuming application passes PO or i18next JS translation objects from an untrusted or user-controlled source to the function. Impact ranges from denial of service through malformed object behavior to potential downstream logic bypasses, depending on how polluted properties interact with application code. No public exploit is identified at time of analysis and no CISA KEV listing exists; vendor-released patch is confirmed at version 1.3.3.
Server-side request forgery in @platejs/docx-io prior to 53.3.2 allows network-accessible attackers to exfiltrate internal network content by supplying crafted HTML to the htmlToDocxBlob function. When attacker-controlled HTML containing img tags referencing internal URLs is processed server-side, the converter fetches those resources and embeds the response bytes into the generated DOCX, creating a response-disclosure channel to internal network infrastructure. No public exploit code has been identified at time of analysis, but the attack technique is well-understood and requires no specialized tooling beyond crafted HTML.
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor relay or client by triggering a failed CONFLUX_SWITCH cell send. The root cause is CWE-252: the return value of relay_send_command_from_edge() is silently ignored - a send failure that internally marks the circuit for close and deallocates the active conflux leg goes undetected, leaving the caller to write through the now-freed leg pointer. The result is a NULL write to freed heap memory and an immediate process crash. No public exploit code exists and EPSS is very low (0.19%), but the attack is unauthenticated, low-complexity, and network-reachable, making it a realistic DoS primitive against any Tor node running 0.4.8.1-alpha through 0.4.9.8.
GitHub App credential exfiltration in OpenShift Pipelines-as-Code allows unauthenticated network attackers to steal GitHub App JWTs by manipulating the webhook endpoint's trust in the untrusted X-GitHub-Enterprise-Host HTTP request header. Affected installations (v0.43.0-v0.47.x and several earlier branches) generated and dispatched a signed GitHub App JWT to an attacker-controlled host before validating the webhook signature or verifying that the Enterprise host matched the repository URL in the signed payload. This gives the attacker a time-limited window to mint GitHub App installation access tokens against the real GitHub API, with the scope of damage bounded by the permissions granted to the GitHub App. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated primary attack path against the default webhook endpoint makes this a meaningful operational risk for any exposed installation.
Confidential Containers isolation in Kata Containers can be subverted by a malicious host operator via insufficient path validation in genpolicy's CreateContainer mount and storage rule enforcement. Affected deployments include Red Hat OpenShift Container Platform 4 running Kata Containers with genpolicy enabled for Confidential Containers guest protection. An operator-level attacker can mount arbitrary container-rootfs paths over sensitive host locations or inject attacker-controlled content into the guest, breaking the core confidentiality and integrity guarantees that Confidential Containers are designed to provide. No public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Chrome's Workers implementation allows a remote attacker to bypass the web origin policy and gain unauthorized access to cross-origin data and resources. Exploitation requires a chained attack: the attacker must first compromise the Chrome renderer process through a separate vulnerability, then use social engineering to get the victim to interact with a crafted HTML page. Google has released Chrome 151.0.7922.173 to address this flaw; no public exploit code or active exploitation has been identified at time of analysis, and SSVC signals exploitation:none with a low EPSS of 0.34%.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Missing authorization enforcement in Apache InLong's StreamSource component allows any authenticated user - regardless of role - to logically delete all stream sources across the platform. Versions 2.0.0 through 2.3.x are affected; the root cause is CWE-552, where the StreamSource API performs no access-control check before executing the delete operation. No public exploit code is currently known and the vulnerability is absent from CISA KEV, but the extremely low exploitation barrier - a single valid account - makes this a serious risk for any multi-tenant or shared InLong deployment.
Broken access control in Apache InLong's manager component exposes Data Node management endpoints to any authenticated user, regardless of their assigned role or privilege level. Versions 2.0.0 through 2.3.x are affected, allowing any valid manager account holder to create, modify, or delete Data Node definitions that underpin the platform's data pipeline infrastructure. The CVSS 8.1 High rating reflects high integrity and availability impact; no public exploit or CISA KEV listing exists at time of analysis.
Private HPKE key material leaks from `netty-incubator-codec-ohttp-hpke-classes-boringssl` through two deterministic code paths: the `toString()` methods of `BoringSSLAsymmetricCipherKeyPair` and `BoringSSLAsymmetricKeyParameter` unconditionally render raw private key bytes, and `BoringSSL.EVP_HPKE_KEY_init_or_throw()` embeds `Arrays.toString(privateKeyBytes)` in a thrown `IllegalArgumentException`. Applications that log key-pair objects or persist exception messages - behavior that is standard with Java logging frameworks such as Logback and Log4j - will write complete HPKE private key material to log storage. No public exploit has been identified at time of analysis beyond the functional proof-of-concept included in the GitHub advisory GHSA-2mc4-j865-9q4r; a vendor-released patch is available as version 0.0.23.Final.
OS command injection in Laravel Backpack CRUD's Stats::makeCurlRequest method allows unauthenticated remote attackers to execute arbitrary OS commands as the web server user by supplying a crafted HTTP Host header. All four maintained branches are affected: 4.1.x before 4.1.72, 5.x before 5.6.2, 6.x before 6.8.13, and 7.x before 7.0.36. No public exploit code or CISA KEV listing exists at time of analysis, but the only in-code guard is a 1-in-100 probabilistic gate that provides no meaningful protection against a determined attacker who can retry requests.
Arbitrary file deletion in Laravel Backpack CRUD (all 5.x, 6.x < 6.8.12, 7.x < 7.0.35) allows any authenticated low-privilege user - such as a content editor - to delete files outside the scope of the record they are editing by injecting arbitrary disk-relative paths into the `clear_<attr>[]` request parameter. The root cause is that `HasUploadFields::uploadMultipleFilesToDisk` passes attacker-supplied paths directly to `Storage::disk()->delete()` without intersecting them against the filenames actually stored in the database for that record. No confidentiality impact exists (files cannot be read), but an attacker can destroy any file reachable under the configured storage disk root, including other records' attachments and shared operational assets. No public exploit or KEV listing has been identified at time of analysis.
Local File Inclusion in the Golo Framework WordPress plugin before version 1.7.5 allows unauthenticated remote attackers to read arbitrary local files from the server - including wp-config.php containing database credentials - and potentially achieve code execution via PHP file inclusion mechanisms. The flaw stems from CWE-98: user-controlled input is passed unsanitized to PHP include/require statements, exploitable over the network without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network-accessible attack surface and CVSS 8.1 score make this a meaningful risk for any WordPress installation running the affected plugin.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacker who can induce a victim to pair a malicious Bluetooth device. The root cause is a heap-based buffer overflow (CWE-122) in the AVRCP_Br_Response_Parser function, which fails to validate the length of attacker-controlled data before copying it into a heap allocation. Successful exploitation yields arbitrary code execution at the device level; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in `l2_reassemble_sdu` stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. No public exploit or CISA KEV listing has been identified at time of analysis, but the ZDI advisory (ZDI-26-474) and a Sony firmware update advisory are both publicly available.
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged code execution to escalate to root via the device's crash dump handler. The handler passes user-controlled input directly to an OS system call without sanitization (CWE-78), enabling arbitrary command execution at the highest privilege level. Disclosed by ZDI as ZDI-26-477 (ZDI-CAN-29061); no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF image, affecting GIMP 3.2.2. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122), granting full code execution in the context of the GIMP process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a fix commit is available on the GNOME GitLab repository.
Remote code execution in Aeon 1.3.0 is triggered when a user loads a maliciously crafted dataset file via the load_rehab_pile_dataset function, which called numpy's np.load() with allow_pickle=True - enabling full Python pickle deserialization of attacker-controlled content. Reported by Zero Day Initiative (ZDI-CAN-28749 / ZDI-26-468) and tracked as EUVD-2026-63433, the vulnerability carries CVSS 7.8 with full confidentiality, integrity, and availability impact limited by local attack vector and required user interaction. No public exploit has been identified at time of analysis, and an upstream patch commit is available but a tagged release version has not been independently confirmed.
Stack-based buffer overflow in GIMP 3.2.2's TIF file parser enables remote attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a specially crafted TIF image file, making this a socially-engineered attack delivered via malicious webpage or email attachment. Reported by the Zero Day Initiative (ZDI-26-456/ZDI-CAN-29399), a fix commit has been pushed to the upstream GNOME GitLab repository, though no independently confirmed patched release version is available at time of analysis.
Heap-based buffer overflow in GIMP's TIF file parser (CWE-122) enables remote code execution on affected installations when a user opens a crafted TIFF image. Confirmed affected version is GIMP 3.2.2 per EUVD-2026-63451, with the flaw originating from missing length validation before copying attacker-controlled data to a heap buffer. Discovered and reported by Zero Day Initiative (ZDI-26-455 / ZDI-CAN-29398); no public exploit or CISA KEV listing has been identified at time of analysis, though an upstream patch commit exists on GNOME GitLab.
Remote code execution in GIMP 3.2.2 is achievable when a user opens a crafted APNG file, triggering an integer overflow before buffer allocation in the APNG parser (CWE-190). Disclosed by Zero Day Initiative as ZDI-CAN-29401/ZDI-26-462 and tracked as EUVD-2026-63458, the flaw yields full C/I/A compromise within the GIMP process. No active exploitation is confirmed (not listed in CISA KEV), but a fix commit is available on GNOME GitLab; no officially tagged patched release has been independently confirmed at time of analysis.
Remote code execution in GIMP 3.2.2 is achievable via a specially crafted TIF image file that triggers an integer overflow in the application's TIFF parser, causing an undersized heap allocation and subsequent memory corruption. An attacker who convinces a user to open a malicious file or visit an attacker-controlled page that delivers such a file can execute arbitrary code with the privileges of the victim's user account. No public exploit identified at time of analysis, though the ZDI origin (ZDI-26-461, formerly ZDI-CAN-29405) represents a technically verified, researcher-confirmed vulnerability with well-characterized root cause.
Remote code execution is possible in GIMP 3.2.2 through a maliciously crafted SGI image file, exploiting an integer overflow in the application's SGI file parser. An unauthenticated remote attacker can deliver the file via email or web and, upon the victim opening it, execute arbitrary code within the GIMP process context with the privileges of the logged-in user. No active exploitation has been confirmed (not in CISA KEV), though ZDI's coordinated public disclosure via ZDI-26-459 lowers the barrier to weaponization; an upstream patch commit exists but a formally tagged fixed release has not been independently confirmed.
Remote code execution in GIMP 3.2.2 is achievable by an attacker who can convince a target user to open a specially crafted TIF file, triggering an integer overflow during buffer allocation in the TIFF parser that leads to heap corruption and arbitrary code execution in the context of the current user process. Disclosed by the Zero Day Initiative under ZDI-26-458 (ZDI-CAN-29406), the flaw is rooted in missing validation of user-supplied size data before heap allocation. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog; however, an upstream fix commit is available in the GIMP GitLab repository.
Remote code execution via maliciously crafted TIF files affects GIMP 3.2.2, allowing an attacker to execute arbitrary code in the context of the running GIMP process with full user-level privileges. The root cause is a CWE-190 integer overflow in the TIFF file parser where attacker-supplied image metadata bypasses size validation before a heap allocation, enabling memory corruption and code execution. Reported by Zero Day Initiative as ZDI-CAN-29403 and tracked under ENISA EUVD-2026-63453; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in GIMP 3.2.2 is triggered when a victim opens a specially crafted PSD file, exploiting an integer overflow in the PSD parser that occurs before buffer allocation. Tracked by Zero Day Initiative as ZDI-CAN-29395 and rated CVSS 7.8, the flaw allows an unauthenticated remote attacker to execute arbitrary code within the GIMP process context after inducing the target to open a malicious file. No public exploit identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Remote code execution in GIMP 3.2.2 is possible when a user opens a specially crafted HDR image file, with the underlying flaw residing in the GEGL image processing library that GIMP depends on. The integer overflow in HDR buffer size computation (CWE-190) produces an undersized heap allocation that an attacker can leverage to execute arbitrary code in the context of the victim's GIMP process. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed; the ZDI advisory (ZDI-26-453) assigns this a High severity rating of CVSS 7.8.
Remote code execution in Hugging Face PyTorch Image Models (timm) version 1.0.24 is triggered when a user loads a crafted model checkpoint file, exploiting unsafe deserialization of untrusted data. The vulnerability, discovered by ZDI (ZDI-CAN-27987) and tracked as ZDI-26-523, allows an attacker who can deliver a malicious checkpoint to achieve full code execution in the context of the victim's process with no special system privileges required. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the attack surface is practically significant in ML/AI workflows where downloading pretrained checkpoints from public sources is routine.
Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.
Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.