Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV.
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended preview directory via the /api/static/{deployKey}/ static-resource endpoint, which concatenates attacker-controlled path segments to the preview root without normalization. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread active exploitation. The practical impact is unauthenticated disclosure of sensitive server-side files (source code, configuration, secrets), not code execution.
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Remote unauthenticated command execution affects a broad range of Zbtlink MT7620-based routers and gateways (WE1326, WE2426-C, WE5926 family, WE826 family, WG108/WG3526, WF3526-P, CTN720-W1, LF-1541, MT7620N, WRC1) whose infosrvd service listens on UDP/9992. A single crafted UDP packet lets an attacker run arbitrary commands as root, because the service's authentication relies on a hardcoded salt and accepts an all-zero wildcard MAC, defeating the intended check. Publicly available exploit code exists (research and advisory published by VulnCheck), the CVSS 4.0 base score is 9.3, and no active exploitation has been confirmed in CISA KEV at time of analysis.
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.
Remote code execution in the Silverstripe userforms module allows any authenticated CMS author to inject PHP into the email recipient's subject field, which is evaluated server-side by the Silverstripe template engine during form submission email dispatch. Affected are composer package silverstripe/userforms versions below 6.4.9, 7.0.0-7.0.6, and 7.1.0, all of which pass the EmailSubject field through the template parser without sanitizing PHP-bearing localization tags. No CISA KEV listing and no standalone public exploit exist at time of analysis, though the patch PR documents the exact payload format, materially lowering the exploitation barrier for any attacker holding CMS credentials.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated remote code execution in Unitree G1 EDU firmware through 1.5.2 allows any network-adjacent attacker to gain a root shell on the robot by chaining three design flaws without credentials or user interaction. The attack exploits an open WebRTC-to-DDS bridge on TCP port 9991, a hardcoded world-readable AES-128 key, and a path traversal flaw in the chat_go knowledge upload API to plant and execute arbitrary scripts as uid 0 via the bashrunner service. Publicly available exploit code (UniBLEed on GitHub) and a full technical writeup confirm reliable exploitation; no KEV listing has been observed, but the adjacent-network vector makes this a real priority for any institution operating these robots on shared campus or lab networks.
Command injection in luci-app-https-dns-proxy on OpenWrt allows authenticated web-interface users to execute arbitrary shell commands on the router as the rpcd service account (typically root) by supplying shell metacharacters in the name parameter to the setInitAction RPC endpoint. The vulnerability exists in versions preceding the 2026-01-17 PR #15 fix across both the stangri and mossdef-org forks. A public exploit repository is available, though EPSS remains low (0.18%) and no CISA KEV listing exists, suggesting limited observed in-the-wild exploitation at time of analysis.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.
Root code execution in Unitree G1 EDU robot firmware through version 1.5.2 is achievable by proximate unauthenticated attackers via a chained BLE GATT and WiFi provisioning exploit requiring no pairing or credentials. Crafted BLE writes overflow a fixed BSS buffer in the SSID chunk accumulator, corrupting an adjacent mainloop function pointer dispatch entry; the cleanup path subsequently invokes this corrupted pointer, passing attacker-controlled data to system() as uid 0. A public proof-of-concept (UniBLEed) is available, and the CVSS 4.0 score of 7.7 reflects the adjacent attack vector and high complexity of the exploit chain.
Use-after-free in Redis's TLS pending-data handler (`tlsProcessPendingData()`) enables remote attackers to potentially execute arbitrary commands at the privilege level of the Redis server process. The flaw spans all major active Redis release lines and is confirmed fixed in versions 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 - exploitation is gated on TLS being explicitly configured, which is non-default. A public proof-of-concept exists; SSVC rates technical impact as total but automation as not feasible, and the vulnerability is not currently listed in CISA KEV.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Authentication bypass in the Xiiaozet LK100W device lets a remote attacker invoke a critical management function with no credentials, switching on administrative services that should stay restricted and opening a path to unauthorized device access. Tracked as CVE-2026-78239 and published in CISA ICS advisory ICSA-26-239-01, it carries a CVSS 4.0 base score of 9.3 (critical). No public exploit is identified at time of analysis, and the device is not listed in CISA KEV.
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. The flaw carries a CVSS 4.0 score of 9.3 and was disclosed via CISA ICS-CERT (ICSA-26-237-06); no public exploit has been identified at time of analysis.
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attackers to intercept authentication material and message payloads, then impersonate devices and disrupt messaging. The flaw affects the NE2-D11 serial-to-Ethernet/MQTT gateway and was disclosed via CISA ICS advisory ICSA-26-237-06 (reported by ICS-CERT). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Remote code execution in the Silverstripe Advanced Workflow module allows high-privileged authenticated CMS users to execute arbitrary PHP on the server by injecting a crafted payload into the workflow email template field. The vulnerability affects the `symbiote/silverstripe-advancedworkflow` Composer package across three version lines, with patches released as 6.4.5, 7.1.3, and 7.2.1. No public exploit tool or CISA KEV listing exists at time of analysis, but the GitHub Security Advisory (GHSA-39mm-rwm3-29jp) and accompanying PR test case explicitly document the injection technique, lowering the reproduction barrier for any attacker who reads the advisory.
SQL injection in YzmCMS 7.5 exposes the full database to authenticated administrators who supply a crafted parentid parameter to the category management interface. The flaw arises from unsanitized string concatenation inside a FIND_IN_SET() SQL clause within the get_arrchildid() function, enabling boolean-based blind injection that can enumerate and exfiltrate the entire database. A public proof-of-concept exists on GitHub; however, EPSS at 0.15% (4th percentile) and the absence of a CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.
OS command injection in ZoneMinder's event export functionality enables any authenticated user holding the View Events permission to execute arbitrary commands on the underlying server. The exportFile HTTP request parameter is passed without sanitization into PHP's exec() function, granting attackers full control over server-side command execution. Reported by ICS-CERT under ICSA-26-237-02 and tracked in GitHub Security Advisory GHSA-88m4-hrgp-m9v3, the flaw carries a CVSS 4.0 score of 8.7 across all current ZoneMinder versions, with no public exploit identified at time of analysis.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
TLS peer impersonation in Applied Systems Engineering's ASE2000 v2 (versions 2.35 through 2.37) lets a network-positioned attacker complete the TLS handshake as a fraudulent trusted peer because the client fails to properly validate the server certificate (CWE-295). Successful exploitation exposes and allows tampering with protected SCADA/RTU communications carried over the ostensibly secure channel. Reported through CISA ICS-CERT (ICSA-26-239-04); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit.
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.
Unauthenticated access to PayRange API management endpoints exposes verbose device details for every device on the PayRange network, exploitable with or without a registered account. Classified under CWE-862 (Missing Authorization) and reported by CISA ICS-CERT as advisory ICSA-26-237-04, the flaw affects all tracked versions of the PayRange API with a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, though the network-accessible nature and low attack complexity make this a low-effort target for reconnaissance against PayRange-managed payment infrastructure.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
Path traversal in n8n-nodes-sqlite3 (all versions prior to 1.0.0) exposes multi-tenant n8n deployments to arbitrary file read and overwrite through the unsanitized db_path node parameter. When a workflow author explicitly maps untrusted end-user input to the SQLite node's database path field, an attacker can supply a crafted traversal string to redirect SQLite to open any file accessible to the n8n process-potentially exposing credentials, configuration files, or enabling data destruction. No public exploit has been identified at time of analysis, and the vendor-confirmed fix is available in v1.0.0 via commit 145a887.
Unauthenticated remote command execution affects the @agent-infra MCP servers shipped with ByteDance's UI-TARS-desktop, whose shared mcp-http-server helper defaulted its bind address to '::' (all interfaces) and only enforced authentication when a caller explicitly passed middleware. Because the commands and filesystem server entry points call startSseAndStreamableHttpMcpServer with only a host and port and no middleware, any client that can reach the listening port can invoke the run_command tool (routed to child_process.exec) or the file read/write tools with no credential. Reported by VulnCheck and rated CVSS 4.0 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.
Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting sandbox and execute arbitrary code, gaining more access to the instance than intended. ServiceNow rates this maximum severity (CVSS 4.0 base 10.0) and has patched hosted instances while shipping fixes to self-hosted and partner deployments across the Zurich, Australia, Xanadu, and Yokohama release families. No public exploit identified at time of analysis and ServiceNow states it is not aware of malicious exploitation, though the unauthenticated, network-reachable nature makes prompt patching essential.
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.
SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arbitrary SQL statements against the instance's underlying database, enabling unauthorized read and modification of instance data beyond intended boundaries. The flaw carries a maximum CVSS 4.0 base score of 10.0 (network, no authentication, high impact to confidentiality, integrity, and availability, with scope-changing impact to subsequent systems). ServiceNow, which self-reported the issue, states it has no public exploit identified at time of analysis and is not currently aware of malicious exploitation.
Remote code execution in Agno (the Python AI-agent framework) up to and including 2.5.8 lets attackers run arbitrary code and OS commands on the host by way of prompt injection. The PythonTools and ShellTools components feed LLM-generated arguments straight into exec(), runpy.run_path(), and subprocess.run() without sanitization, so an attacker who plants malicious instructions in any content the agent ingests (a web page, a document) can hijack execution. CVSS is rated 9.8 and the CVSS vector marks it unauthenticated/network, but no public exploit is identified at time of analysis and EPSS is low at 0.60% (46th percentile).
Command injection in the LB-Link AC2100_AZ3 (V1.0.4) router allows attackers to run arbitrary operating-system commands by supplying shell metacharacters to the bs_SetLimitCli_info function in the libshare.so library, which passes unsanitized input into a system-level command context. Successful exploitation yields full compromise (confidentiality, integrity, availability) of the device, typically at elevated/root privilege given the embedded-Linux design. A public technical write-up documenting the flaw exists on GitHub, but it is not listed in CISA KEV and EPSS estimates exploitation probability at a modest 0.54% (43rd percentile).
Command injection in the bs_SetLimitCli_info function of the libshare.so library on LB-Link AC450M (V4.0.0) routers lets attackers inject shell metacharacters into a parameter that is passed to a system-level command context, yielding arbitrary OS command execution. The CVSS 3.1 vector (9.8) describes network-reachable, unauthenticated exploitation with full confidentiality, integrity, and availability impact. No CISA KEV listing and no confirmed exploit code, though a public technical write-up describing the flaw exists; EPSS is modest at 0.53% (42nd percentile).
PHP Object Injection in the Hash Form WordPress plugin (versions 1.4.1 and earlier) lets remote, unauthenticated attackers inject crafted serialized objects that are deserialized by the plugin, enabling code execution, data tampering, or site compromise depending on available gadget chains. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with no authentication required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Geo Controller WordPress plugin (the plugin distributed as cf-geoplugin) affects all versions up to and including 8.9.8, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and the CVSS vector reports full confidentiality, integrity, and availability impact, a suitable gadget chain in the plugin or wider WordPress environment could lead to remote code execution, data disclosure, or site takeover. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated privilege escalation in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing remote attackers with no credentials to improperly gain elevated privileges (CWE-266). Rated CVSS 9.8, the flaw grants full confidentiality, integrity, and availability impact, effectively enabling site takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Information disclosure and in-app arbitrary code execution affect the EcoOnline EHS Android application (package com.airsweb.v10) version 0.2.499, where an improperly protected/exported AndroidManifest.xml component (a public PoC names it a DeepLink issue) lets a remote attacker access sensitive data and run code within the app's context. The MITRE-assigned record carries a CVSS of 9.8 and CWE-200, but EPSS is low (0.31%, 23rd percentile) and there is no CISA KEV listing. Publicly available exploit code exists (GitHub 'CVE-2026-26897-EcoOnline-DeepLink'), though this is not evidence of active exploitation.
Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.
Remote code execution in Time4Popcorn - a Popcorn Time media-streaming fork - affects the Windows client (<= 6.2.1.18), macOS client (<= 6.2.1.17), and Android client (<= 3.5.0.173) through the application's auto-update mechanism (updater.exe on Windows, the PT.updd component on macOS). Because the updater fetches and executes update payloads without verifying their integrity (CWE-494), an attacker able to influence the update channel can deliver and run arbitrary code on the victim host. No CISA KEV listing, no public exploit is identified at time of analysis, and EPSS is low at 0.26% (18th percentile).
Arbitrary file write leading to code execution in crewai-tools' FileWriterTool (crewAI agent-tools package) through 1.10.2rc1 lets an attacker supply path-traversal sequences (../), absolute paths, or symlink escapes in the tool's filename argument to write content anywhere the process can reach. Because these tools are driven by LLM agents, the practical trigger is untrusted/injected content steering the agent to write outside its intended directory, overwriting code or config to gain execution. No public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile) and it is not in CISA KEV.