Unauthenticated SQL injection in Flowring Agentflow 4.0 lets remote attackers run arbitrary SQL commands against the application database through the id parameter of the /WebAgenda/SMBAjaxConfigProcess.do endpoint, giving full read/write access to back-end data as returned by the vulnerable query. Only deployments running a build older than the 2025/08/08 fixed release and exposing the WebAgenda API to the network are affected; the CVSS 4.0 base score of 9.3 and the parallel CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C/I/A:H) both reflect that no authentication, user interaction, or non-default configuration is required. No public exploit code has been identified at time of analysis, but the report originates from ZUSO ART and the endpoint is trivially reachable wherever WebAgenda is internet-exposed, so the practical risk for unsegmented deployments is high.
Remote code execution in Flowring Agentflow 4.0 is possible through the /WebAgenda/download/uploadFile.jsp endpoint, where authenticated low-privilege users can upload a file of dangerous type that the server then executes. Affected deployments are builds prior to 2023/03/24, and exploitation requires a valid application session but no victim interaction; no public exploit has been identified at time of analysis, though the technical impact is severe and warrants urgent patching.
The EVbee DC-80 firmware ships with a hardcoded root password, allowing unauthenticated remote attackers to log in via SSH and gain full control of the device. All units share the same static credential, which can be recovered from firmware analysis, and no special configuration is needed. This is a high-severity flaw (CVSS 9.3) with no public exploit code identified at time of analysis.
Unauthenticated network attackers can exploit a directory traversal flaw in the file-upload feature of Hitachi Energy RTU500 Series CMU firmware to write or overwrite arbitrary files on the device filesystem, potentially modifying device data or disrupting operation. The issue has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), reflecting high integrity and availability impact with no confidentiality impact. This is a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact, but no public exploit code or confirmed active exploitation was identified at time of analysis, and practical exposure is limited by the typical OT network isolation of RTU500 substation devices.
Unauthenticated remote code execution affects ModelTC LightLLM through version 1.2.0 when it is run in a multimodal deployment configuration, which starts an embed-cache RPyC service bound to all network interfaces with pickle deserialization enabled. Because the service performs no authentication and accepts attacker-controlled serialized objects through its exposed cache methods, any remote party that can reach the RPyC port can execute arbitrary code with the privileges of the LightLLM service (CVSS 4.0 base score 9.3; AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact). Exposure is configuration-dependent: non-multimodal deployments do not start this service, and instances whose port is bound to loopback or blocked by firewall rules on the host or network are not remotely reachable. No public exploit code has been identified at time of analysis, and the issue has been reported publicly by VulnCheck (also tracked in the project's GitHub issue #1596), so the primary risk is rapid weaponization against internet-facing multimodal inference deployments that have not been patched or isolated.
Remote code execution in LightLLM through 1.2.0 allows unauthenticated attackers to run arbitrary code on the host when the server is launched with the --enable_profiling flag, because that flag starts a router profiler service that exposes an RPyC listener with pickle deserialization enabled and no authentication (CVSS 4.0 base 9.3; CWE-502). The flaw is not reachable in a default deployment since profiling must be explicitly enabled, but once it is on, any network-reachable attacker can push crafted serialized objects onto the profiler command queue and gain high-integrity, high-availability code execution without credentials or user interaction (PR:N/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently driven by the non-default profiling configuration and network reachability of the RPyC port rather than by active exploitation.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
User-mode-to-kernel privilege escalation in Eclipse ThreadX lets a loaded, memory-protected TXM module register an arbitrary function pointer as the global trace-full callback, which privileged kernel code then invokes directly with no pointer validation and no privilege-dropping trampoline when the trace buffer wraps. Affected builds are those compiled with the non-default TX_ENABLE_EVENT_TRACE option and running modules in TXM_MODULE_USER_MODE with TXM_MODULE_MEMORY_PROTECTION; an invalid pointer crashes the kernel (denial of service), while a pointer into the module's own code has been observed executing with kernel privilege (CONTROL.nPRIV = 0), producing a scope-crossing compromise of the RTOS kernel by a local, low-privileged attacker. Exploitation requires the attacker to already control executing code inside a loaded module plus the non-default trace build flag, and no public exploit code has been identified at time of analysis.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACKET control block structures via a maliciously crafted masked WebSocket frame, potentially leading to code execution or denial of service. The vulnerability, tracked as CVE-2026-102761 with a CVSS 4.0 score of 9.3, affects all versions of NetX Duo per the CPE. No public exploit code has been identified at time of analysis, and no KEV status is reported.
A stack-based buffer overflow in the web management interface of the Shenzhen Dbit T-CPE301K 4G mini WiFi router allows an attacker who already holds a session on the device to crash the router and force a reboot by sending an HTTP POST to /js/common/do_cmd.js with an excessively long parameter. The published CVSS 4.0 score of 9.3 treats this as remote, unauthenticated, and full impact to confidentiality, integrity, and availability, but our independent assessment scores it under CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. an authenticated, availability-only denial-of-service, because exploitation requires network reachability to the management interface plus a valid session on the endpoint, and the confirmed outcome is a crash and restart rather than code execution. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is further limited by the small deployment footprint of this consumer/SOHO-class router; a vendor patch is available per the INCIBE advisory.
Authentication bypass in Dockhand before 1.0.40 allows unauthenticated remote attackers to force redeployments of git-backed stacks by sending unsigned webhook requests when a stack's webhook secret is null or unset; the guard fails open and accepts the request. The immediate impact is denial of service through repeated git clone and docker compose operations, while full host compromise is possible only if the attacker also has write access to the tracked git branch to inject a malicious docker-compose.yml with privileged bind mounts. No public exploit identified at time of analysis, and the independent assessment rates exploitation complexity as high for the RCE chain, with the DoS path requiring only network reachability and stack ID enumeration.
Command injection in the Node.js shell-quote library (formerly published as shell-quote on npm) allows an attacker who controls a string placed after a { comment } token to break out of the generated shell command and execute arbitrary shell input. The flaw affects the quote() function before version 1.11.0: a line terminator (\n, \r, U+2028 or U+2029) inside a later string terminates the '#' comment emitted for the comment token, causing the remainder of that string to be interpreted as shell syntax - for example quote(['echo','ok',{comment:'x'},'a\nid;#']) executes id under sh, bash, dash, ksh and zsh. It is also reachable through the quote(parse(untrustedCommand).concat(untrustedArg)) idiom, because parse() emits a mid-word comment token for inputs such as a URL fragment (http://example.com/#frag). This is a genuine command-injection flaw (CWE-78) in a foundational Node.js utility; the vendor CVSS 4.0 score of 9.2 reflects the potential for full shell execution, though our independent CVSS 3.1 assessment is AV:N/AC:H (the vulnerable calling pattern is a prerequisite and is not present in a bare default install). No public exploit was identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit includes test cases that demonstrate the triggering payload shapes. Vendor-released patch: shell-quote 1.11.0.
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, allowing whoever controls the remote TLS VPN peer to push malicious configuration data that the connecting Firebox executes with root privileges, compromising the appliance's confidentiality, integrity, and availability (CVSS 3.1 base 9.2, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exposure is conditional rather than blanket internet-facing: the Firebox must be configured as a BOVPN Over TLS client and must actively initiate a session to an attacker-operated or attacker-compromised server, so a successful attack implies a malicious or hijacked peer relationship rather than an opportunistic scan-and-exploit against any Firebox. No credentials on the Firebox are required (PR:N) and no interactive user action is needed once the client connection is made; there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though the confirmed root-level impact on a perimeter security device justifies treating this as a high-priority patch item.
Command injection in IBM Guardium Data Protection 12.2 allows an authenticated, highly privileged CLI user to execute arbitrary operating-system commands as root, escaping the restricted certificate-export shell (scope change) and fully compromising confidentiality, integrity, and availability. The flaw is CWE-78 (OS command injection) in the certificate export CLI path and carries a vendor CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated behind privileged CLI authentication, and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has released a vendor patch.
Unauthenticated attackers able to reach the firmware-update endpoint of Hitachi Energy RTU500 series CMU devices can upload arbitrary firmware through a crafted POST request, gaining control over device functionality without any credentials or user interaction (CVSS 9.1, CWE-306). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no public exploit identified at time of analysis, but the PR:N/UI:N vector means any reachable instance of the affected interface is directly exploitable. Because the impact is rated integrity-high and availability-high with no confidentiality impact (C:N), the realistic outcome is persistent unauthorized firmware that alters or disrupts the device rather than data theft.
Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.
Memory corruption in Mozilla Firefox's WebGPU graphics component (versions prior to 157) can be triggered when a user loads attacker-controlled web content that drives the vulnerable rendering path, yielding a buffer overflow with high confidentiality and availability impact. The flaw is remote, requires no authentication, and exploitation depends on the victim rendering a malicious page, so practical attacks rely on phishing, malvertising, or a compromised site rather than zero-click delivery. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.15% (4th percentile), though the vendor's 9.1 CVSS rating and a patch in Firefox 157 indicate a serious memory-safety defect that should be prioritized for browser fleet updates.
Missing authorization checks in the MediaWiki TemplateSandbox extension let unauthenticated remote users reach functionality that should be constrained by access-control lists, yielding a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact. Exposure is limited to wikis that have the optional TemplateSandbox extension installed and enabled; a default MediaWiki core installation is not affected, and the fixed releases are 1.46.1, 1.45.5, and 1.43.10 for their respective branches. No public exploit code has been identified at time of analysis (EPSS 0.15%, 3rd percentile) and CISA SSVC records exploitation as none, although the issue is rated automatable with total technical impact, so the risk is serious but not yet observed as active.
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD (versions 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets unauthenticated remote attackers complete SSH authentication by submitting the literal username "*" with the password "*", because LDAP filter metacharacters from user-supplied credentials are not escaped before being embedded in the search filter. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw is trivially reachable but only on servers that both embed the MINA SSHD library and have deployed and configured sshd-ldap for password or publickey authentication; stock MINA SSHD deployments without that optional component are entirely unaffected, and no public exploit code was identified at time of analysis. Apache ships fixes in 2.20.0 and 3.0.0-M6, which apply proper RFC 4515 escaping.
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD allows unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to pass password authentication checks when an SSH server is configured to use LdapPasswordAuthenticator, yielding high confidentiality and integrity impact (rated 9.1 critical). Affected builds are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5; servers that rely on sshd-core's built-in password mechanisms, or that do not use sshd-ldap at all, are not affected. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing), but real-world exposure is sharply limited by the non-default optional component and the explicit LDAP authenticator configuration required - the raw 9.1 score is driven by impact rather than by a broad exploitable population.
An authentication bypass in Apache MINA SSHD's sshd-core library (versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) allows remote, unauthenticated attackers to skip signature verification during public-key or hostbased SSH authentication, potentially granting an attacker a valid session. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 critical) reflects high confidentiality and integrity impact, but exploitation is gated by a non-default precondition: the server operator must have written explicit custom code enabling the library's 'asynchronous authentication' mechanism and applied it to public-key or hostbased authentication. Apache rates this implementation choice as presumed rare, and servers that do not opt into asynchronous authentication - or that use it only with password or keyboard-interactive auth - are not exposed. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing).
MetaMCP through 2.4.22 leaks live MCP session identifiers and namespace UUIDs from its unauthenticated GET /metamcp/health/sessions endpoint, and because the session store is keyed solely on the client-supplied mcp-session-id header, an unauthenticated remote attacker can replay a stolen ID to impersonate another tenant's transport session. The attacker can then enumerate and execute the victim tenant's private MCP tools and exfiltrate data using the credentials the victim has forwarded to those tools, rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-639). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but all exploitability signals - unauthenticated network reach, no user interaction, and a directly replayable session credential - indicate genuine high risk for multi-tenant deployments exposed to untrusted networks.
SQL injection in Bytebase DBHub 1.2.0 allows unauthenticated remote attackers to submit crafted SQL statements that the /utils/sql-parser.ts component fails to classify correctly, bypassing the MCP server's parser-level read-only enforcement so the statement reaches the backend database and can expose sensitive database information. Only version 1.2.0 is confirmed affected, and there is no public exploit code identified at time of analysis and no CISA KEV confirmation of active exploitation; no EPSS score or vendor-published fix version was present in the available intelligence. The vendor rates this Critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), whereas independent assessment places the confidentiality impact higher and integrity/availability lower (C:H/I:L/A:L), and notes that real-world exposure is substantially reduced where the DBHub MCP server is run locally or behind a trusted MCP client rather than being network-reachable.
Arbitrary code execution in Das U-Boot allows an unauthenticated attacker on the adjacent network segment to hijack the bootloader by replaying duplicated last-fragment IPv4 packets against stale IP reassembly state. Only builds compiled with the non-default CONFIG_IP_DEFRAG=y option and actively using U-Boot's network stack (for example TFTP or PXE netboot) are exposed, and the attacker must hit the narrow boot-time window while the bootloader is running, so the practical attack surface is narrower than the CVSS 9.0 base score implies. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; the vendor has released a fix in version 2026.07 (commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa).
Remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allows an unauthenticated, remote attacker to execute code or tamper with/disclose information on affected appliances by exploiting a missing integrity check on code the product downloads, affecting versions prior to 5.34.00.16 and prior to 5.36. Realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position or a spoofed/compromised download source - which is why our assessment adjusts the vendor's 9.8 score to AC:H while retaining PR:N and UI:N. A vendor patch is available (5.36.00.16; 5.34.00.16 for the 5.34 branch), and there is no evidence of active exploitation or public exploit code; EPSS is 0.11% (1st percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no'.