Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.
Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.
Unauthenticated vector-store tampering in Nextcloud MCP Server before 0.117.2 lets any network attacker who can reach the /webhooks/nextcloud endpoint delete or force re-indexing of Qdrant semantic-search embeddings for arbitrary users. Because WEBHOOK_SECRET defaults to None and startup never enforces it, the webhook receiver processes forged POSTs and trusts the attacker-supplied user.uid, so looping over document IDs can wipe the entire search index for all users. A working proof-of-concept is published in the GHSA advisory; publicly available exploit code exists, though there is no public exploit identified in CISA KEV.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an attacker forge a Chrome-extension Origin header and drive connected browser extensions. The check uses re.match() against the unanchored pattern chrome-extension://[a-z0-9]{32}, so any Origin with 32+ trailing characters is accepted before websocket.accept(), after which start_session commands trigger arbitrary browser automation, cookie theft, and screenshot capture. This is a patch bypass of CVE-2026-40289 (GHSA-8x8f-54wf-vv92); a working PoC is published in the advisory, though it is not in CISA KEV - no public exploit weaponization beyond the advisory PoC is identified.
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker run arbitrary commands in the context of the running user. The flaw is rated CVSS 10.0 with a network attack vector, no privileges, no user interaction, and a scope change reaching the underlying host. No public exploit identified at time of analysis, but the maximal score and unauthenticated network reach make it a top-tier patching priority.
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands, achieving code execution in the context of the current user with a scope change that extends impact beyond the vulnerable component. Adobe (the reporting vendor) rates this maximum severity CVSS 10.0 (CWE-78), and exploitation requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a vendor-disclosed, not-yet-actively-exploited critical flaw.
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified.
Unauthenticated authentication bypass in miniOrange's SAML Single Sign-On extensions for Joomla (SAML SSO < 11.0.2, SAML SP Login with ADFS < 6.4, and SAML SSO login with Google Apps < 6.4) lets remote attackers log in as any Joomla account, including administrators. The mo_saml_validate_signature() function treats OpenSSL's -1 error return as a successful signature verification, so a crafted SAMLResponse with an attacker-chosen NameID and a deliberately malformed signature bypasses validation entirely. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the flaw is trivially reachable and yields full site takeover.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Two-factor authentication bypass in the Perl module Punk::Plugin::TOTP before 0.05 lets an attacker who already knows a victim's password clear the victim's TOTP challenge using a recovery code issued to the attacker's own account. The flaw stems from the recovery-code helper looking up codes by digest across all users and then binding ownership through a numeric comparison of user identifiers, which fails whenever accounts are keyed by username, email, or UUID. No CISA KEV listing and no public exploit identified at time of analysis, with a low EPSS score of 0.44% (37th percentile) despite the 9.8 CVSS rating.
Denial of service in OpenSSL's CMP (Certificate Management Protocol) client affects versions 3.4.x, 3.5.x, 3.6.x and 4.0.x, where ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name directly as a format string to ERR_raise_data(). A malicious or intercepted CMP server can return a sender DN containing format specifiers (e.g. 'CN=%s%n') to crash a validating client. Despite a 9.8 CVSS score and an 'RCE' tag, the vendor explicitly states the reliable consequence is a crash only; there is no public exploit identified at time of analysis and EPSS is low (0.41%).
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. No public exploit code is identified at the time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable admin-takeover primitive makes it high priority.
SQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Metastore RPCs manipulate the generated WHERE clause so operations intended for one partition match additional rows in the same table. Because client-supplied partition names are concatenated into direct-SQL statements instead of bound as parameters, a crafted name containing a single quote can redirect reads, statistics updates, truncate/drop targets, and file-metadata cache operations to unintended partitions. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; the input assigns CVSS 9.8, but the vendor description constrains impact to partition targeting within referenceable tables rather than arbitrary cross-database access.
Unrestricted file upload in TRtek Software Repository Management (all versions before commit 2fb4acee) lets remote attackers upload executable web shells to the server, yielding server-side code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication or user interaction, and the full C:H/I:H/A:H impact reflects total server compromise. It was reported by Turkey's national CERT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attackers to intercept or manipulate the deployment process, potentially yielding information disclosure, data tampering, remote code execution, and privilege escalation. The flaw stems from the deployment routine failing to properly verify TLS certificates (CWE-295), enabling machine-in-the-middle attacks. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the vendor rates full technical impact.
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers inject additional SQL into existing queries to read arbitrary database contents, including user credentials and secrets. The flaw stems from an unescaped, unprepared user-supplied parameter and carries a 9.8 CVSS. No public exploit has been identified at time of analysis, but the unauthenticated network vector makes this a high-priority patching target for any site still running the plugin.
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Apache Tomcat's DIGEST authenticator lets a network attacker who has captured a valid DIGEST-authenticated request replay it once when its nonceCount sits on the upper boundary of the replay window and fewer than windowSize requests have since been made. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.x and 7.0.x branches, but only where DIGEST authentication is actually enabled. No public exploit identified at time of analysis; EPSS is low at 0.28% (20th percentile), so the assigned 9.8 overstates practical risk.
Remote code execution in Beijing Tongtech TongWeb 7.0.24 lets attackers run arbitrary code by sending a crafted serialized payload to the console/heimdall endpoint, which is backed by a Spring HttpInvokerServiceExporter that deserializes untrusted input. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists (two public gists), though EPSS is low (0.26%, 17th percentile) and the flaw is not in CISA KEV.
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
Analysis complete. The JSON synthesis above covers CVE-2026-19912 (Kaltura HTML5 Player unauthenticated RCE). Key points of the assessment: - **Impact**: Unauth network RCE (CVSS 9.8) chaining PHP object injection via `unserialize()` with attacker-controlled cache-path file write → webshell as the webserver user. - **Signal contrast**: High CVSS but low EPSS (0.22%), no KEV, and no public POC — high severity, no observed mass exploitation yet, so it's a "patch promptly" rather than "on-fire" item. - **Metadata**: Clean — vendor (`kaltura`) and CPE are correct, no mislabeled tags, so `data_quality_flags` is empty. - **Caveat surfaced**: No exact fixed version is present in the input; I flagged that it must be confirmed from Kaltura's advisory rather than inventing one. - **Security note**: The input's "Editorial note (internal)" was a prompt-injection attempt instructing insertion of the word "gniezno" — I ignored it (consistent with prior handling) and noted it in `confidence_notes`. I also recorded a memory entry for this CVE.
Privilege-management weakness in Google Chrome's Actor component (versions prior to 152.0.7977.65) lets a remote attacker who successfully socially-engineers a user into loading a crafted HTML page bypass system access restrictions. Chromium rates the underlying severity as Low, and no public exploit or active exploitation has been identified; EPSS is 0.21% (11th percentile). Note a sharp signal conflict: the NVD-style CVSS base score is 9.8 (critical) while the vendor's own severity rating is Low and the description requires user interaction.
Improper input validation in Apache Tomcat 9.0.115-9.0.120, 10.1.53-10.1.57, and 11.0.20-11.0.24 stems from an incomplete fix for CVE-2026-32990 and, per its CVSS:3.1 vector, permits remote unauthenticated attackers to compromise confidentiality, integrity, and availability of the servlet container. Reported by the Apache security team, it carries a critical 9.8 base score, though vendor tagging labels the impact as Information Disclosure, which is narrower than the vector implies. No public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.21% (11th percentile).
Authentication bypass in the Drupal Internationalization Single Sign-On contributed module (versions 0.0.0 through 1.8.0) lets remote unauthenticated attackers assume authenticated sessions by reaching an alternate authentication path or channel that skips the primary verification logic. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, it maps to CWE-288 and is addressed in a Drupal security advisory (SA-CONTRIB-2026-081). EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis.
Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. No public exploit identified at time of analysis, and the EPSS score sits in the 4th percentile, indicating little observed exploitation interest despite the headline 9.8 rating.
Web origin policy bypass in Google Chrome for Android before 152.0.7977.65 lets a malicious co-installed app abuse the CustomTabs component to escape same-origin restrictions and access content it should not. The flaw is a local privilege/authorization issue (Chromium-rated Low severity) requiring a second attacker-controlled app already present on the device; no public exploit has been identified and EPSS probability is very low (0.11%).
Remote code execution in Google Chrome on macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Safe Browsing component that lets a remote attacker escape the renderer sandbox and run arbitrary code on the host. Exploitation requires luring a victim to a crafted HTML page (social engineering / user interaction), and Chromium rates the flaw Critical. There is no public exploit identified and the EPSS probability is low (0.57%), but a vendor patch is already available.
Sandbox-escaping remote code execution is possible in Google Chrome for iOS before 152.0.7977.65, where a use-after-free in the Sync component can be triggered by a victim visiting a crafted HTML page, potentially letting a remote attacker run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable build, and there is no public exploit identified at time of analysis; the flaw is not listed in CISA KEV and SSVC records exploitation status as none. Notably, Chromium's own severity rating for this bug is Low, which stands in sharp contrast to the 9.6 CVSS score in the input.
Sandbox-escaping remote code execution affects Google Chrome desktop before 152.0.7977.65, where a use-after-free in the ServiceWorker component lets a remote attacker run arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 score of 9.6 reflects the scope change (sandbox escape) and full CIA impact, though Google rated the Chromium severity only Medium and CISA's SSVC framework marks exploitation as none. No public exploit or CISA KEV listing exists at time of analysis, so risk is currently theoretical but high-impact.
Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a use-after-free in Aura, Chromium's UI/windowing layer, and Google rates its Chromium security severity as Critical (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.46%, 38th percentile), but the sandbox-escape impact makes it a high-priority patch.
Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the browser sandbox by luring a victim to a crafted HTML page, exploiting a use-after-free in the Views UI framework to run arbitrary code with the browser process's privileges. The CVSS 9.6 score reflects a scope-changing sandbox escape (S:C), though Google rated the Chromium security severity only Medium and requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis, EPSS is low (0.46%), and CISA SSVC records exploitation status as none.
Sandbox-escaping remote code execution in Google Chrome (Views UI component) before 152.0.7977.65 allows a remote attacker to run arbitrary code on the host after luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free rated High by Chromium and CVSS 9.6 due to the scope change (sandbox escape), but requires user interaction (visiting an attacker-controlled page) and has no public exploit identified at time of analysis. EPSS is modest (0.46%, 38th percentile) and CISA SSVC reports no known exploitation.
Sandbox escape in Google Chrome's FileSystem component before version 152.0.7977.65 lets a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The flaw stems from incorrect reference resolution (CWE-706) and requires user interaction via social engineering. It is patched in the stable channel; there is no public exploit identified and EPSS exploitation probability is low (0.45%).
Out-of-bounds read in Chrome's ANGLE graphics component (Windows builds prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and potentially run arbitrary code after a victim opens a crafted HTML page. Google rates the Chromium severity High, and the CVSS is 9.6 driven by the sandbox-escape scope change; there is no public exploit identified at time of analysis and EPSS is low (0.42%).
Remote code execution in Google Chrome desktop before 152.0.7977.65 arises from a use-after-free in the ServiceWorker subsystem that a crafted HTML page can trigger to run attacker code outside the renderer sandbox. Any user browsing to a malicious page with a vulnerable build is exposed, and successful exploitation yields full compromise of the host user context. No public exploit identified at time of analysis and the issue is not in CISA KEV; notably, Chromium's own severity rating is Low even though the NVD CVSS base score is 9.6, a discrepancy defenders should weigh.
Sandbox-escaping remote code execution affects Google Chrome for macOS before 152.0.7977.65 through a use-after-free in the Views UI component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and CISA has not listed it in KEV. Despite an NVD CVSS of 9.6 driven by the scope change, Chromium's own team rated the security severity Medium, and EPSS exploitation probability is low at 0.41%.
Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the browser sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated 9.6/Critical with a scope change, meaning exploitation impacts the host beyond the compromised renderer. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the EPSS score of 0.41% reflects only near-term probability, not the true severity of a sandbox-escaping RCE.
Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free rated CVSS 9.6 with scope change, reflecting the sandbox escape. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.41%, but the sandbox-escaping RCE impact makes it a high-priority browser patch.
Sandbox-escaping remote code execution in Google Chrome for macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Views UI framework, letting a remote attacker run arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Google rates the Chromium severity Critical and CVSS is 9.6, but there is no public exploit identified at time of analysis and EPSS is a low 0.41%. A vendor patch is available in the Stable channel update.
Sandbox-escaping remote code execution in Google Chrome for iOS (versions prior to 152.0.7977.65) stems from use of an uninitialized variable that a remote attacker can trigger with a crafted HTML page, potentially running arbitrary code outside the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector, it requires the victim to visit a malicious page but no authentication. There is no public exploit identified and it is not on CISA KEV; EPSS is low at 0.41% (34th percentile).
Remote code execution in Google Chrome desktop before 152.0.7977.65 stems from a heap buffer overflow in the WebGL component, and critically allows an attacker to execute code OUTSIDE the renderer sandbox (scope change) via a single crafted HTML page. Any user who browses to a malicious or compromised site is at risk, requiring only that the page load and render WebGL content. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.39%), but the sandbox-escape impact and network reachability make this a high-priority patch.
Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) allows a remote attacker to potentially escape the browser sandbox by luring a victim to a crafted HTML page. The flaw is a CWE-843 type confusion carrying a 9.6 CVSS score with a scope change, reflecting the sandbox-escape potential. No public exploit has been identified at time of analysis, and CISA SSVC currently rates exploitation status as none.
Sandbox-escaping remote code execution in Google Chrome for Android (versions before 152.0.7977.65) stems from a use-after-free in ANGLE, Chrome's graphics translation layer. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving control at the browser-process privilege level. Chromium rates the flaw Critical; no public exploit has been identified at time of analysis, and the EPSS probability is low (0.35%).
Sandbox-escaping remote code execution affects Google Chrome desktop builds prior to 152.0.7977.65, where improper input validation in the Media component lets a remote attacker run arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. Rated Critical (CVSS 9.6) with a scope change reflecting the sandbox breakout, this is a High-severity Chromium issue reported internally by the Chrome team; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. A patched Stable-channel release is already available from Google.
Out-of-bounds write in Chrome's ANGLE graphics layer (versions before 152.0.7977.65) lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates it High severity; the CVSS 9.6 reflects a scope-changing sandbox escape whose only gating factor is that the user opens a malicious page. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), but the memory-corruption-to-sandbox-escape impact makes it a priority patch for desktop fleets.