Remote authenticated arbitrary code execution affects Ivanti Neurons for ITSM before 2026.2, where a missing authorization check (CWE-862) lets a low-privileged authenticated user reach functionality that executes code on the server. Rated CVSS 9.9 with a scope-change vector, it grants full confidentiality, integrity, and availability compromise of the ITSM host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (2026.2) is available.
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available.
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache Camel - Hawtio 4) lets any authenticated user holding namespace 'edit' rights obtain an OpenShift Service-CA-signed client certificate with an attacker-chosen Subject CN. Because the operator reads the Service CA private signing key and mints certificates using a CN supplied in a namespaced Hawtio custom resource - and its ClusterRole aggregates Hawtio CR permissions into the standard edit/admin roles - a low-privileged tenant can forge a certificate that impersonates arbitrary in-cluster service identities (e.g. Jolokia agents) to any component trusting the Service CA for client authentication. No public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.9 rating and low attack barrier make it a high-priority patching target.
SQL injection in Movie_Recommend v1.0.0 lets remote unauthenticated attackers read arbitrary database contents by injecting crafted SQL through the 'sort' parameter of the /loadingmore endpoint. A public write-up with exploitation details exists on GitHub, but the flaw is not in CISA KEV and no active exploitation is reported. Despite a 9.8 CVSS, the described impact is limited to database disclosure, making the integrity/availability portion of that score questionable.
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, combining a missing authorization check with unsafe reflection that lets externally-controlled input select and instantiate arbitrary classes. Any attacker able to reach an exposed Nutch Server endpoint can invoke functionality and drive class loading without credentials, yielding full compromise of the host. No public exploit identified at time of analysis and EPSS is low (0.36%), but the CVSS 9.8 rating and trivial network vector make exposed instances high priority.
Authentication bypass in the Single-Sign-On (SSO) component of Digital-Infrastructure v9.6.7 lets a remote attacker log in as any account, including Admin, with no password. The flaw stems from improper authentication (CWE-287) in the SSO login path, giving unauthenticated attackers full administrative takeover. Publicly available exploit code/writeup exists, though it is not listed in CISA KEV; SSVC rates exploitation as PoC, automatable, with total technical impact.
Remote code execution in mpush v0.8.1 lets attackers run arbitrary code on the gateway server by sending a crafted broadcast message that is unsafely processed (CWE-94 code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with full confidentiality, integrity, and availability impact. Publicly available exploit documentation exists (GitHub write-up), though EPSS is low (0.17%, 6th percentile) and the flaw is not in CISA KEV.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
SQL injection in mfish-nocode-pro v1.0.0 lets remote unauthenticated attackers extract arbitrary database contents by injecting crafted SQL through the tableName parameter of the /sys/dbConnect/data endpoint. The flaw is unauthenticated and network-reachable, and a proof-of-concept writeup exists publicly, though there is no evidence of active exploitation and EPSS remains low at 0.15%.
Unauthenticated remote attackers can log into sso-master v1.0.0 without supplying a password by sending a single crafted POST request to the CAS /cas/login endpoint, gaining full application access with high confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; vendor-published base 9.8). No valid credentials, user interaction, or special client configuration are required, and the assessment notes no availability impact. Despite the critical score, the practical risk is limited by deployment scarcity - this is a niche v1.0.0 open-source SSO project with no known enterprise footprint - and the low EPSS of 0.14% (4th percentile) reinforces that exposure is narrow; there is no CISA KEV listing and no confirmed public exploit code flagged in the supplied intelligence, although a public GitHub write-up demonstrates the affected endpoint. The signals conflict sharply: a maximum-severity authentication bypass paired with near-floor exploit-prediction and no observed exploitation.
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch.
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. No public exploit has been identified at time of analysis, though Hitachi has released fixed maintenance versions.
OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cosminexus/uCosminexus Application Server - allows remote attackers to inject and execute arbitrary operating-system commands (CWE-78). The flaw spans a broad set of legacy and current branches from 09-00 through 11-70 and carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, implying unauthenticated network reachability with full confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. Hitachi has released fixed maintenance versions; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege elevation in Microsoft SQL Server Management Studio (SSMS) 22 before 22.8.2 lets a remote attacker inject unneutralized special elements into output processed by a downstream component, escalating privileges over the network when a user is induced to interact (UI:R). Although the NVD description names 'SQL Server,' the EUVD affected-product list scopes the flaw to the SSMS client tool, indicating a client-side injection rather than a database-engine defect. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and no KEV listing.
Authentication bypass in DeepSeek Harness before 0.1.2-alpha.1 lets attackers seize full control of the local agent by spoofing the HTTP Host header, because the control-plane API trusts the client-supplied Host value instead of the actual TCP connection origin. An unauthenticated attacker who lures an operator's browser to a malicious page (via DNS rebinding or a cross-site 'simple' POST) can invoke privileged methods such as commands/execute with danger-full-access, escalate approval policies to unconfined execution, and exfiltrate all stored conversations. No public exploit is identified at time of analysis, though the fixing commit and a VulnCheck advisory document the exploitation mechanics in detail.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact.
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector.
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B lets a remote attacker persist malicious JavaScript in vulnerable form fields that later executes in a victim's browser when they view the affected page. Successful exploitation can hijack the victim's session or account, and because scope is changed (S:C) the payload can affect resources beyond the vulnerable component - for example an admin session viewing attacker-supplied content. Adobe PSIRT rates it 9.3 Critical; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August 2026 builds of 2.4.4-2.4.9 / B2B 1.3.3-1.5.3) lets an attacker persist malicious JavaScript into vulnerable form fields that later executes in a victim's browser. Because the CVSS scope is changed, the injected script runs beyond the injection context and can hijack the victim's session or account, and CVSS:3.1 PR:N indicates the injection requires no attacker authentication while UI:R means a victim must load the affected page. No public exploit is identified at time of analysis, and the flaw was reported privately by Adobe PSIRT under APSB26-138.
Stored CSS injection in Snipe-IT before 8.7.0 lets a superuser plant malicious CSS in the Custom CSS branding setting that executes in every other superuser's browser, exfiltrating their CSRF tokens and enabling account takeover. The flawed sanitizer HTML-encoded input but then selectively reversed the encoding on '>' and '"' while never filtering @import or url(), permitting attribute-selector rules to leak tokens character-by-character. Publicly available exploit code exists via the VulnCheck advisory; no public exploit identified as actively exploited, and no EPSS/KEV signal was provided.
TLS certificate validation is disabled by default in the Node.js WebSocket client of Eclipse Ditto (@eclipse-ditto/ditto-javascript-client-node 2.0.0-3.9.0 and predecessor _1.0 package 1.0.0-2.1.0), which hard-codes rejectUnauthorized:false when opening every wss:// connection. A man-in-the-middle attacker can present any certificate, complete the handshake, steal the credentials sent in the WebSocket upgrade's Authorization header, and read, alter or inject Ditto Protocol messages for the connection's lifetime. No public exploit identified at time of analysis; a vendor fix is available and the Java client, browser/DOM client and the Node.js HTTP transport are unaffected.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used authorization code a second time to obtain an independent, valid token pair for the same user and scopes. Because consumed codes are never invalidated, the single-use guarantee of the OAuth2 authorization code flow is broken, granting persistent unauthorized access tokens. Reported by VulnCheck; a vendor patch exists (2.3.13) and no public exploit has been identified at time of analysis.
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored** — the "Editorial note (internal)" instructed me to weave the word "zabrze" into the `risk_assessment` field. That's an embedded injection attempt (matching the pattern seen across prior CVE-synthesis inputs). I did not comply; no such filler appears anywhere in the output. 2. **Key assessment judgment** — the vendor's 9.1 is real but conditional. This is a **capture-replay persistence** flaw (CWE-294), not a from-nothing takeover: the attacker must already hold a valid refresh token and replay it in the expired-parent-token window (hence `AC:H`). No EPSS/KEV/POC in the data, so the realistic threat is extending the life of stolen tokens rather than mass exploitation. Fix is confirmed: **upgrade to 2.3.13** (backported to 2.2.x). I left `data_quality_flags` empty — the "Authentication Bypass" tag is defensible here since CWE-294 *is* authentication bypass by capture-replay, and the `xenforo` vendor/CPE is correct. I also saved a memory record (`cve-2026-73312.md`) and indexed it, linked to the sibling CVE-2026-73309 (same XenForo 2.3.13 token-security fix batch).
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Path traversal in Apache FreeMarker's template loading (versions 2.2.0 through 2.3.34) lets remote attackers who can influence the locale identifier passed to FreeMarker read templates outside the intended path when the default-enabled localized lookup feature is active. The actual reach is bounded by the configured TemplateLoader - FileTemplateLoader still blocks escape from its baseDir, while classloader- or servlet-context-backed loaders are limited to resources those mechanisms can reach. EPSS is low (0.21%, 11th percentile), no public exploit is identified at time of analysis, and it is not in CISA KEV.
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is drastic: version 1.23 removes the Nutch Server component entirely.
Broken access control in springboot-project v1.0.0 lets remote unauthenticated attackers reach every seller-management interface through a flaw in the SellerAuthorizeAspect authorization component. Attackers can enumerate all products and orders, toggle products on/off sale, finish or cancel orders, and modify categories with no credentials. No public exploit identified at time of analysis beyond the reporter's write-up; EPSS is low at 0.18% (7th percentile).
Improper authorization in Bifrost's vtoken-minting and slpx Substrate pallets lets any signed on-chain account attribute its mint volume to an arbitrary registered channel_id it does not control. Because the mint path never verifies that the caller is authorized to mint on behalf of the supplied channel, an attacker can inflate a target (or attacker-owned) channel's recorded mint volume and skew protocol commission settlement so payouts are disproportionately routed to that channel. There is no public exploit identified at time of analysis and EPSS is very low (0.14%), but the flaw directly enables financial value redirection within a live DeFi parachain.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) is possible through an SQL injection flaw (CWE-89) that a high-privileged authenticated attacker can escalate into code execution in the context of the current user. The CVSS vector marks the scope as changed, reflecting that database-layer injection pivots into broader application/OS impact. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Auth0 AD/LDAP Connector (versions up to and including 6.5.0) lets an attacker persist malicious script into directory-attribute search results or updater log content that later renders unencoded in the connector's admin panel, executing in an administrator's browser session. The payload can be planted either by an authenticated user permitted to modify directory attributes or by a low-privileged local user on the connector host, and fires when an admin views the affected search results or update logs. No public exploit identified at time of analysis; disclosure originates from Okta PSIRT.
Arbitrary file write as root in OPNsense's NTP configuration module (opnsense/core before 26.1.9 and BE/opnsense/core before 26.4_20) lets an administrator-level attacker escape the intended directory via a crafted GPS or PPS serial-port parameter and overwrite any file on the FreeBSD-based firewall. Because writes occur as root, this path traversal is a strong primitive for full device compromise. Fixes are released; there is no public exploit identified at time of analysis.
Authentication bypass in the Apache Airflow FAB provider (apache-airflow-providers-fab 3.7.3 through 3.8.0) lets any unauthenticated attacker log into the Airflow UI when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the provider validates the id_token signature against Microsoft's multi-tenant JWKS endpoint but never checks the token's issuer or audience, an id_token minted in any Azure tenant - including one the attacker registers themselves - passes verification, and the username and role assignments are then taken from that attacker-controlled token. This is an incomplete-fix follow-up to CVE-2026-59243; operators who applied that earlier fix remain vulnerable. Publicly available exploit code exists is not indicated, but the upstream fix (PR#71735) and mechanism are public; no active exploitation is reported.