Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in SPIP CMS versions prior to 4.4.21 lets unauthenticated attackers run arbitrary PHP/OS commands by abusing the template engine's X-Spip-Filtre header handling. A newline injected into a GET parameter forces analyse_resultat_skel() to treat an attacker-supplied header() call as a template filter chain, and a working Metasploit module (intval|_request|system) already achieves full command shell access. The CVE description claims in-the-wild exploitation in August 2026; publicly available exploit code exists, making this a top-priority patch.
SQL injection in the GeoTools Java geospatial library (gt-jdbc-postgis module) lets remote unauthenticated attackers execute arbitrary SQL against PostGIS-backed layers via the OGC Filter jsonArrayContains function. Affected builds run from 30.5 up to the fixed 33.6, 34.5, and 35.1 releases, where the function's value argument is written into generated SQL without escaping. No active exploitation is listed in CISA KEV and no public exploit is identified, though the upstream fix commit and regression tests publicly demonstrate the injection payload structure.
Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. A complete working proof-of-concept is published in the GitHub advisory; publicly available exploit code exists, though the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls a JSONata expression to break out of the query engine and run OS commands via Node's child_process. The flaw stems from the lookup function reaching inherited prototype members (setters/getters, constructor, valueOf) to obtain process.getBuiltinModule and call execSync, executing code with the host process's privileges. Publicly available exploit code exists in the GHSA advisory, and CVSS 4.0 rates it 9.3 (Critical); there is no evidence of active exploitation.
Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls a JSONata expression break out of the evaluation context and run OS commands with the host process's privileges. The flaw stems from a bypassable hasOwnProperty check in environment.lookup that permits prototype-chain traversal to reach process.getBuiltinModule('child_process'). A working proof-of-concept is published in the vendor GHSA advisory, and vendor patches (1.8.8 and 2.2.1) are available; no CISA KEV listing has been identified.
Compile-time PHP code injection in the Phalcon (cphalcon) PHP framework's Volt template compiler (versions 5.15.0 and earlier) lets an attacker who can influence Volt template source achieve remote code execution. The Volt `join` filter emits the separator and array arguments as raw, unescaped bytes into the generated PHP, so quote-breaking content escapes the `join('…')` call and is written into the cached compiled template that is then require()'d at render time. Publicly available exploit code exists (a working PoC that runs shell_exec is published in the GHSA advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.
Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute arbitrary OS commands via the NTP timezone configuration CGI endpoint by supplying unsanitized shell metacharacters in the `timestr` parameter. The CVSS 4.0 vector scores 8.6 with full high-impact ratings across confidentiality, integrity, and availability on both the vulnerable device and subsequent systems, reflecting potential for complete device takeover. A public proof-of-concept exploit is available on GitHub, materially lowering the skill threshold for exploitation with no confirmed patch at time of analysis.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Stored XSS in YOURLS 1.5.1 through 1.10.3 enables unauthenticated attackers to inject arbitrary JavaScript into per-link statistics pages by sending a crafted HTTP Referer header to any existing short URL - no account or special access required for the poisoning step. When an administrator or public stats-page visitor subsequently opens the affected short URL's statistics page, attacker-controlled code executes in the YOURLS origin, granting access to the API signature token, admin-visible session data, and privileged same-origin actions. No CISA KEV listing or independently confirmed public exploit exists at time of analysis, though the GHSA advisory includes a functional proof-of-concept payload that makes weaponization trivial.
Cross-site scripting in Defuddle prior to 0.19.1 allows an attacker who controls content on a domain handled by a site extractor (X/Twitter, Substack, YouTube) to inject event-handler attributes or javascript: URLs into extracted HTML output. Three site extractors interpolate page-derived values - image alt/src attributes, og:image metadata, and video descriptions - into template literals without HTML escaping, and the resulting HTML is returned by buildExtractorResponse() without passing through the main pipeline's DOM-based sanitization. A vendor-released patch is available in version 0.19.1; no public exploit has been identified at time of analysis.
Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. A working proof-of-concept is documented in GHSA-26w5-6g95-gj28; the vulnerability is not in CISA KEV and no public exploit kit has been identified at time of analysis.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Unauthenticated resource exhaustion in Keystone CMS (Node.js) prior to version 6.5.3 allows any remote GraphQL client to bypass the configured `graphql.maxTake` record-count limit by supplying a negative `take` value, since the comparison `(take ?? Infinity) > maxTake` evaluates to false for negative integers regardless of their magnitude. The bypass applies to both top-level list queries and relationship sub-queries, enabling an attacker to force the server to retrieve an unbounded number of database records and exhaust service resources. No public exploit code has been identified at time of analysis, though the fix and advisory are publicly available.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the advisory description alone, and replaying the request sustains the outage indefinitely.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator in a WordPress Multisite network to take over arbitrary accounts-including the Network Administrator-due to missing authorization checks on user management operations. A publicly available proof-of-concept exists per WPScan, and a vendor patch has been released at version 3.6.1. No active exploitation is confirmed by CISA KEV at time of analysis, though POC availability substantially lowers the bar for abuse by any authenticated sub-site admin.
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenticated Shop Managers to install and activate arbitrary WordPress plugins via the Dokan admin REST API. The plugin's capability check on these endpoints validates only for WooCommerce management capability rather than the required Dokan plugin-installation capability, granting Shop Managers an escalated privilege not intended for their role. With publicly available exploit code and a vendor-released patch, this warrants immediate remediation on any WordPress site running Dokan with untrusted shop manager accounts.
SQL injection in the Link Whisper Free WordPress plugin (all versions before 0.9.7) enables authenticated users holding the Editor role or above to execute arbitrary SQL queries against the underlying WordPress database, with potential scope change to data beyond the plugin's own tables. Reported by WPScan with a publicly available proof-of-concept, this raises the practical exploitability despite the elevated privilege requirement. No CISA KEV listing indicates active mass exploitation has not been confirmed at time of analysis; a vendor-released patch (0.9.7) is available.
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Author role to read sensitive database contents by injecting arbitrary SQL via an unvalidated search parameter in a media-library query handler. The scope-changed CVSS vector (S:C) reflects that exploitation can reach data beyond the plugin's immediate database scope, and a publicly available proof-of-concept exists per WPScan's disclosure. No public exploit identified at time of analysis for active exploitation, though the POC lowers the bar for abuse against any WordPress installation running the unpatched plugin.
Stored shortcode injection in the ProfilePress WordPress plugin before 4.17.1 allows unauthenticated attackers to persist shortcodes in two unfiltered profile fields, which WordPress then executes when any visitor loads the public profile page. The impact is limited to information disclosure - exposing a targeted user's email address, login date, and registration date - but the attack requires no elevated privileges and no special configuration beyond default plugin deployment. A publicly available exploit exists per WPScan's disclosure; patch version 4.17.1 is confirmed available from the vendor.
Server-side request forgery in Microsoft's Azure SQL Database cloud service lets an unauthorized network attacker coerce the service into making backend requests that result in privilege elevation, with a maximum CVSS base score of 10.0 driven by a scope change (S:C). The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, and the CWE-918 classification confirms the root cause is unvalidated server-issued requests. No public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.
Cross-tenant session hijacking in Nezha Monitoring (v1.14.13-1.14.14 and v2.0.0-2.0.9) lets any authenticated low-privilege RoleMember attach to another user's live WebSocket terminal or file-manager session and gain interactive shell access and full file read/write on the monitored target server. The flaw stems from stream UUIDs at GET /ws/terminal/:id and GET /ws/file/:id being validated only for existence, never bound to their creating user, so an attacker who learns a live UUID from access logs, referer headers, browser history, or telemetry breadcrumbs achieves cross-tenant remote code execution. Fixed in v2.0.10; no public exploit identified at time of analysis, though the upstream commit and its regression tests fully disclose the mechanism.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Build-time malicious code execution in the arrayref Rust crate version 0.3.10 allows an attacker to run arbitrary code on any developer or CI machine that compiles a project depending on it. The compromised release pulls in a rogue transitive dependency that beacons to a command-and-control server and accepts arbitrary command execution, making this a confirmed supply-chain compromise disclosed by the Rust Security Response WG and RustSec (RUSTSEC-2026-0260). No public standalone exploit is needed because the crate itself is the payload; not currently listed in CISA KEV.
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. This is classified CWE-506 (embedded malicious code); no public exploit tooling is published because the malware itself is the payload, and it is not listed in CISA KEV.
Build-time arbitrary code execution in the internment 0.8.7 crate for Rust: this specific published version was trojanized as part of the August 2026 arrayref/proc-macro1 Rust supply-chain campaign, pulling in a rogue transitive dependency that registers with a command-and-control server and executes attacker-supplied code on the developer or CI machine that compiles any project depending on it. Any Rust build that resolves internment 0.8.7 is affected, and because the payload runs during `cargo build` rather than at application runtime, compromise occurs before the target program is ever executed. No CISA KEV listing or public proof-of-concept is documented in the provided data, so this is tracked as embedded malicious code (CWE-506) rather than a confirmed in-the-wild exploit chain.
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile); a vendor patch is available across stable trees.
OS command injection in the Datiphy Data Management Center API endpoint (versions v8.3.0 through v8.5.1) lets an authenticated administrator run arbitrary operating-system commands as root, escalating application-level admin rights into full host compromise. Rated CVSS 4.0 9.4 (Critical) and reported by ZUSO ART, the flaw yields high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.
Arbitrary file write and recursive directory deletion in SiYuan note-taking application before v3.7.4 stems from missing validation of the packageName parameter in the Bazaar marketplace install and uninstall endpoints. An authenticated administrator can supply directory-traversal sequences to write files to any filesystem location (install) or recursively delete arbitrary directories (uninstall), enabling remote code execution and destructive impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remote attacker to pre-set a shop member's session identifier via a user-supplied request parameter, then silently hijack the authenticated session once the victim logs in through an attacker-crafted request. Because the plugin neither generates a fresh session ID on authentication nor rejects externally supplied session tokens, the attacker's chosen token becomes the victim's authenticated session. A publicly available POC exists via WPScan, and no KEV listing is present, though the combination of no required attacker privileges and a low-complexity exploit path elevates practical risk for any live Welcart storefront.
Cleartext exposure of Wi-Fi credentials in DJI consumer and prosumer drones lets an attacker within Bluetooth range recover the drone's Wi-Fi SSID, PSK, and trusted-client UUID by passively sniffing unencrypted DUML-over-BLE messages exchanged during a normal DJI Fly connection or QuickTransfer handoff. This affects a broad range of current DJI models (Neo, Flip, Air 3/3S, Avata 2/360, Mavic 3 family, Mavic 4 Pro, and Mini 2 through Mini 5 Pro) below specific firmware versions. Recovered credentials grant the attacker access to the drone's internal Wi-Fi network and the ability to decrypt the operator's Wi-Fi traffic; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in Datiphy Data Management Center versions 8.3.0 through 8.5.1 lets a remote, unauthenticated attacker place files anywhere on the host by abusing the upload API endpoint, which fails to constrain attacker-supplied file names or paths. Because uploaded content can escape the intended upload directory using relative or absolute path sequences, an attacker can overwrite critical files or drop executable payloads, threatening integrity and availability of the appliance. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and lack of any authentication or user-interaction requirement make this straightforward to weaponize.
Cross-user memory disclosure and tampering in Headroom's LLM proxy (versions before 0.36.1) lets a caller read or overwrite any user's stored LLM memory by simply naming another user's identifier in the client-supplied x-headroom-user-id request header. The proxy trusts this header as the authenticated identity across the chat-completion and websocket data-plane paths in headroom/proxy/handlers/openai.py, with nothing binding the value to the actual caller. The console script binds loopback by default, but the shipped docker-compose.yml publishes the proxy on 0.0.0.0 with no required proxy token, so a stock Docker deployment exposes these routes to the network unauthenticated. Reported by VulnCheck; no public exploit identified at time of analysis.
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log into the management platform using shipped default administrator credentials, granting full control over the database-activity-monitoring console. Rated CVSS 4.0 9.3 (critical) with a fully network-reachable, unauthenticated vector, though no public exploit identified at time of analysis and no CISA KEV listing exists. Because the console governs database auditing and policy, compromise undermines the very security telemetry it is meant to provide.
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAPH_RECOMPUTE handler, letting unauthenticated remote attackers gain arbitrary memory read/write and ultimately full RCE on any host exposing the distributed-inference RPC backend. An attacker stores a computation graph, frees the buffers it references, then reclaims that freed memory with attacker-controlled content before triggering re-execution against the dangling pointers. Reported by VulnCheck and fixed in b8585; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthenticated remote attackers via a flawed REST API path-matching bypass. The plugin's allowlist logic for public endpoints uses unanchored substring comparison against the full request URI rather than matching against the resolved WordPress route, meaning any attacker can craft a URI that embeds the whitelisted path segment anywhere within it to sidestep the protection gate entirely. A publicly available proof-of-concept exploit exists per WPScan, and the EPSS-relevant CVSS vector (PR:N, AC:L) confirms exploitation requires no authentication or special configuration beyond the plugin being installed with global password protection active.
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allows any remote actor to retrieve per-vendor commission configuration from an unprotected store REST endpoint without credentials. The exposed data includes commission type and, where category-based commissions are configured, per-category and default commission rates - leaking potentially sensitive business financial details for every vendor on the marketplace. A publicly available proof-of-concept exists; however, active exploitation has not been confirmed via CISA KEV.
Missing authorization on the Tamara Checkout WordPress plugin's public payment cancel/fail return URLs allows any unauthenticated remote attacker to cancel or fail arbitrary WooCommerce orders store-wide simply by enumerating sequential numeric order IDs. The plugin through version 1.9.9.20 performs no verification of the WooCommerce order key, a WordPress nonce, or any user capability before acting on the supplied ID, making mass order disruption trivial to automate. A publicly available exploit has been documented by WPScan; no KEV listing is present but the low-friction attack surface warrants prompt remediation.
Unauthenticated information disclosure in the NewPath WildApricotPress Add-on WordPress plugin (all versions through 1.0.0) exposes member-only contact fields - email addresses and phone numbers - to any anonymous internet visitor via a REST API route that omits access control enforcement. Site administrators who configure those fields as members-only visibility receive no protection because the REST endpoint bypasses the plugin's own privacy logic. A publicly available exploit exists per WPScan, and no vendor-released patch has been identified at time of analysis.
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticated remote attackers to forge Square payment webhook notifications, causing the plugin to record donations as successfully paid without any actual financial transaction occurring. The vulnerability exists in all default configurations where Square is the configured payment gateway, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept exists per WPScan reporting, though this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Payment gateway merchant account verification is entirely absent in the myCred WordPress plugin before version 3.2.5, enabling unauthenticated remote attackers to fraudulently inflate their in-site credit balances by routing payments to a gateway account they control instead of the site operator's. An attacker needs only to complete a payment of the expected amount through a supported gateway and trigger the resulting notification to the vulnerable site - no knowledge of or access to the site's merchant credentials is required. A publicly available exploit exists per WPScan reporting (EUVD-2026-63909), and a vendor-released patch in version 3.2.5 is confirmed available.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.
Domain and OAuth-credential hijacking in the Jet Admin no-code internal-tools platform lets a remote attacker create their own malicious app, bind it to a victim's configured custom domain, alter the authentication configuration, and silently reroute the victim's traffic to attacker-controlled logic. Because the takeover also copies the victim's OAuth Client ID and Client Secret into the attacker's workspace, it doubles as a credential-theft primitive against any tenant using an OAuth identity provider. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in xShop 3.0.3, an open-source Laravel e-commerce platform by 4xmen, arises from an unrestricted file-upload flaw in the admin attachment handler that accepts executable content such as .php files. An authenticated administrator can upload a crafted PHP payload and have the web server execute it, yielding full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in version 3.0.4, whose diff adds strict MIME-type validation to the upload request.
Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile) despite the 9.1 CVSS.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an authenticated user with session edit access to hijack shared/template agents and achieve command execution on the runner host. The PUT /sessions/{session_id}/agent endpoint enforces LEVEL_EDIT on the session but fails to reject a bound shared or template agent (whose agent.session_id is None), letting the attacker replace the shared agent bundle and inject a malicious stdio MCP server that later executes an attacker-controlled command. There is no public exploit identified at time of analysis, but a vendor patch (0.3.0) and the fixing commit are public.