Session hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legitimate user's active session and escalate to remote code execution running with the privileges of the 'zammad' service account. Exploitation requires passive user interaction (CVSS UI:P) - a logged-in agent or admin must load attacker-influenced content - but no prior credentials or privileges (PR:N), so the practical barrier is the narrow vulnerable version window rather than authentication. The same defect exists in Zammad 7.0.0-7.1.3 but is not exploitable there due to environmental conditions; the reporter's CVSS v4.0 base of 9.4 carries an E:A (Attacked) exploit-maturity metric, though no CISA KEV entry or confirmed public exploit code appears in the supplied data, so no public exploit is confirmed at time of analysis.
Local privilege escalation in Zammad lets an attacker who already controls the unprivileged 'zammad' service account elevate to root on the host, affecting every release from 1.5.0 up to but not including 7.1.0-alpha (including the then-current alpha). The vendor labels this critical with a CVSS 4.0 score of 9.4 and a network/unauthenticated-looking vector (AV:N/PR:N, E:A), but the description confines the attacker to an already-present local/service-account context; our independent assessment therefore re-scores it as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. a high-impact but post-foothold escalation rather than a pre-auth remote compromise. No public exploit code has been identified at time of analysis, and CVE-2026-102490 does not appear in CISA KEV, so the vendor vector's E:A exploit-maturity metric cannot be corroborated here.
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.
Unauthenticated arbitrary file read in DeepWiki-Open (all builds through commit d92819a) allows remote attackers to retrieve any file readable by the API process by sending a single GET request to /codemap/file with a non-URL repo_url value containing an absolute path. Both the CVSS v4.0 score (8.7) and the independent assessment rate it AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact, so any network-reachable instance with the endpoint exposed is at risk. No public exploit code or active exploitation telemetry has been identified at time of analysis, and real-world impact is bounded by the privileges of the service account and the product's modest deployment footprint.
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP tool run arbitrary operating-system commands on the host by manipulating the tool's url argument, which is passed unsanitized into a shell command used for source extraction. Publicly available exploit code exists (referenced in the project's issue tracker), and the flaw is fixed in version 0.11.8; there is no indication of confirmed active exploitation in CISA KEV. The CVSS v4.0 score is 8.6 (with an assessed CVSS v3.1 equivalent of 8.8), reflecting high confidentiality, integrity, and availability impact, though the vector requires authorized tool access (PR:L) and real-world risk is bounded by the project's very small deployment footprint and whether the MCP tool endpoint is remotely reachable.
Reuse of a caller-supplied options mapping in PyJWT 2.11.0 through 2.13.0 can silently leave registered-claim verification disabled on subsequent decode calls, allowing a correctly signed but otherwise invalid token to be accepted. When an application first calls decode() or decode_complete() with a mutable options mapping containing verify_signature set to false, PyJWT._merge_options() mutates that same mapping in place, writing verify_exp, verify_nbf, verify_iat, verify_aud, verify_iss, verify_sub, and verify_jti to false; if the application then reuses that identical mapping for a later call after flipping verify_signature to true, the stale false flags persist and expired, not-yet-valid, wrong-audience, wrong-issuer, or wrong-subject tokens are accepted even though signature verification is nominally on. This is a conditional integrity flaw rather than a signature bypass, it is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) but only in applications that reuse a mutable options mapping, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Unauthenticated remote code execution in the SiteSkite WordPress plugin through version 2.1.8 lets any remote attacker run arbitrary code on an affected site with no credentials, no user interaction, and no special configuration required (CVSS 10.0, vector PR:N/UI:N/AC:L, scope changed). The underlying weakness is a CWE-94 code injection flaw, and because the plugin is a niche one, the realistically exposed population is small and exploitation is more likely to be opportunistic scanning than broad mass exploitation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the intrinsic severity is high - a single successful request can hand an attacker full control of the WordPress installation and its host context.
Unauthenticated remote attackers can bypass authentication in Apache WSS4J (4.0.0 before 4.0.2, 3.0.0 before 3.0.6, and 2.x before 2.4.4) and forge authenticated SOAP messages by submitting a crafted unsigned SAML sender-vouches assertion that carries an attacker-controlled key, which the DOM security processor accepts as proof of identity. Any SOAP service configured to accept and validate SAML sender-vouches assertions through that processor is exposed at the network layer alone, with no credentials and no user interaction required, yielding critical confidentiality and integrity impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). At time of analysis no public exploit code and no confirmed active exploitation were identified, but the low attack complexity and the fact that the vulnerable code path is a security trust boundary make this a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk case; remediation is straightforward because vendor patches exist.
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an attacker who can reach the node over the network to run arbitrary code as an unprivileged service account by sending crafted input that triggers an out-of-bounds write. Affected builds are all versions before 38.2 as well as 39.0, 39.1 and 40.0; a fixed 38.2 release and corresponding maintenance releases are referenced in Pexip's security bulletins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but exploitation requires no authentication, no user interaction and no special conditions, and the resulting code execution is unprivileged - full host takeover would require chaining a separate local privilege-escalation bug such as sibling CVE-2026-103106.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally stored passwords - including administrative accounts - by abusing insufficient parameter validation in the password reset workflow, which lets them bypass the emailed reset-link step and set a new password themselves before authenticating as that user. The flaw is classified CWE-640 (weak password recovery mechanism) and scores CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no non-default configuration are required; any internet-reachable Kiteworks Core instance hosting local-password accounts is exploitable. Independent assessment rates this a genuine top-priority issue rather than a high-score-but-low-risk case. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, low-complexity nature warrants urgent action.
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. No public exploit code has been identified at the time of analysis, but the high impact (C/I/A:H) and remote, unauthenticated attack vector make this a genuinely high-priority flaw despite thin external signals; upgrading to the specified versions removes the vulnerability.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an authorisation bypass in the scripts debugger, a CVSS 3.1 9.8 flaw (PR:N/UI:N, scope unchanged, confidentiality/integrity/availability all High). Real-world urgency is low despite the score: EPSS is 0.36% (28th percentile), no public exploit code has been identified at time of analysis, CISA SSVC reports Exploitation: none, and there is no KEV listing. Exposure depends on deployment - the debugger endpoint being unreachable, behind an authenticating proxy, or disabled materially lowers risk - and a vendor fix is available in 2026.2.19197.
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notification signature, allowing an attacker who has captured a legitimate signature to authenticate as the associated account. Every YouTrack instance running an earlier build is affected (CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), and the root cause is an incorrect-authorization flaw (CWE-863) rather than memory corruption. The practical barrier is signature acquisition: our assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (high, not the input's 9.8 critical) because exploitation depends on capturing or observing a victim's notification signature rather than a blind unauthenticated request against a default install. No public exploit code and no confirmed active exploitation have been identified (EPSS 0.33%, 24th percentile; CISA SSVC lists Exploitation: none), and JetBrains has released a fix in 2026.2.19197.
Prompt-driven shell command execution in camel-ai CAMEL 0.2.91a1, 0.2.91a2 and 0.2.91a3 lets anyone who can influence an agent's prompt - directly as an interactive user or indirectly through content the agent ingests - run arbitrary operating-system commands, because TerminalToolkit.shell_exec performs no approval or confirmation step before executing. The independent assessment rates this high (AV:N/AC:H/PR:N/UI:N, C/I/A:H) because the agent must be deployed with the terminal toolkit enabled, whereas the unadjusted NVD vector of 9.8 assumes no such precondition; the attacker is unauthenticated per the vector (PR:N), though exploitation depends on prompt influence. Publicly available exploit code exists (a proof-of-concept gist is linked from the advisory), but there is no confirmed actively exploited status (CISA KEV), and EPSS is low at 0.25 percent (15th percentile), making this an elevated but not emergency-tier priority.
Command injection in DeepTutor 1.4.0 allows remote attackers to execute arbitrary shell commands through the ExecTool.execute function in /tutorbot/agent/tools/shell.py. The provided CVSS vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying no authentication or user interaction is required, though authentication requirements for the agent endpoint are not explicitly confirmed from the available data and should be verified against the actual deployment. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code was identified at time of analysis, and EPSS is low at 0.25% (15th percentile), reflecting that impact depends on a network-reachable instance of this niche, self-hosted product.
Arbitrary code execution in Devika v1.0 allows unauthenticated remote attackers to run attacker-controlled code with the privileges of the Devika process by getting malicious content into the agent's LLM output path, which Runner.execute passes directly to the interpreter. Exploitation presupposes a running instance whose web interface is reachable over the network, since the agent interface ships without authentication and the runner applies no sandbox; instances bound to localhost or used by a single operator on a workstation degrade to local/operator-level impact. Publicly available exploit code exists and CISA's SSVC framework rates the issue fully automatable with total technical impact, although EPSS is low at 0.23% (13th percentile) and there is no CISA KEV confirmation of active exploitation.
Code execution in camel-ai's CodeExecutionToolkit (versions 0.2.91a1, 0.2.91a2, and 0.2.91a3) lets remote, unauthenticated attackers run arbitrary Python through the SubprocessInterpreter with no approval or confirmation boundary. The attacker must be able to influence the agent's model output - for example via prompt or task injection - so that the LLM emits executable Python, and the host application must have opted into the code-execution toolkit and routed untrusted input to it; exposure is therefore conditional rather than default, which is reflected in the independent assessment's High attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) versus the vendor's 9.8 AV:N/AC:L rating. Risk weighting is tempered by a low EPSS of 0.22% (11th percentile), no CISA KEV listing, and no vendor-released patch identified at time of analysis, though a public GitHub issue and a third-party gist describing the flaw are referenced.
Unauthenticated code injection in Devika v1.0 allows an attacker who can reach the backend service to run arbitrary code with the privileges of the Devika process, because the Runner.run_code function in src/agents/runner/runner.py executes supplied input without adequate validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects a remotely reachable, no-authentication, no-interaction path, but practical risk is bounded by deployment: Devika is normally run as a local developer tool bound to localhost, and the network-facing exploitation implied by the vector applies only when an operator has deliberately bound the backend to a routable interface (for example 0.0.0.0) or runs it in a shared multi-user environment. EPSS is low at 0.21% (roughly the 10th percentile) and no public exploit was identified at time of analysis, with no CISA KEV entry; a public GitHub issue and an external gist are the only public artifacts referenced alongside the MITRE and ENISA EUVD (EUVD-2026-90411) records.
Code injection in DataElement BiSheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated network attackers to execute arbitrary code and fully compromise affected deployments through the backend validation endpoint src/backend/bisheng/api/v1/validate.py. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a remote, low-complexity, no-authentication attack that yields complete loss of confidentiality, integrity, and availability. Exploitation is not confirmed as active (not in CISA KEV), no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and no fixed version is confirmed in the available data; a GitHub gist referenced in the record may contain further technical detail.
Unauthenticated remote code execution is possible in DB-GPT 0.7.5 and 0.8.0 through the combination of two first-party REST endpoints: a crafted skill uploaded via /api/v1/skills/upload can subsequently be invoked and executed by the /api/v1/chat/react-agent flow, which loads and runs the stored skill without adequate validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated network-reachable attacker with no victim interaction can achieve full confidentiality, integrity, and availability impact, and the SSVC assessment rates technical impact as total with automatability confirmed; publicly available exploit code exists (SSVC Exploitation: poc) but there is no CISA KEV listing, so confirmed active exploitation in the wild is not established. Despite the severe base score, EPSS is only 0.20% (9th percentile), reflecting the practical requirement that both the skills-upload and react-agent features be reachable and exposed - instances bound to localhost, placed behind authentication, or on isolated networks are far less exposed.
Improper access control in DB-GPT v0.8.0 allows attacker-supplied code to run directly on the host: when the sandbox API cannot resolve its intended isolated runtime, it silently degrades to LocalRuntime instead of failing closed, so submitted code is executed outside the isolation boundary the deployment expected. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-284) and affects any instance that exposes the sandbox/code-execution API and relies on it to contain untrusted code; exploitation conditions require that the API be reachable and the intended runtime be unavailable or misconfigured. There is no confirmed actively exploited (CISA KEV) status and no public exploit identified at time of analysis, and EPSS is low at 0.20% (9th percentile), so the practical risk signals conflict sharply: a critical-severity, unauthenticated-per-vector code-execution path paired with minimal observed exploitation activity and a narrow, version-specific exposure window.
Remote code execution in AgentScope 1.0.18 and 1.0.19 allows remote attackers to execute arbitrary Python in the service environment: when a RealtimeAgent session has execute_python_code registered as an available tool, the agent's _acting path forwards a model-produced tool call straight to Toolkit.call_tool_function with no approval prompt and no sandbox boundary, so a remote WebSocket user who can reach the endpoint and steer the agent can obtain code execution with the service's privileges. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) no authentication is required, and the SSVC assessment records that publicly available exploit code exists (exploitation: poc), so the vulnerability is automatable with total technical impact; EPSS is low at 0.20% (9th percentile), indicating limited observed exploitation activity so far. Exploitation is conditional on the deployment exposing the execute_python_code tool in a RealtimeAgent session and on the WebSocket interface being network-reachable - instances that do not register that tool are not vulnerable via this path.
Broken access control in AgentGPT 1.0.0 allows authenticated remote callers to read or modify resources belonging to other tenants by supplying an arbitrary object or tenant identifier to the externally reachable agentRouter tRPC endpoint, which performs data access without owner, tenant, workspace, or membership checks. The independent assessment scores this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting high confidentiality and integrity impact but no availability impact and a required authenticated session, contradicting the original PR:N/A:H vector. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low (0.19%), so exploitation is most plausible in multi-tenant or multi-user deployments where identifiers can be guessed or enumerated.
PHP object injection in the WordPress plugin Nested Pages (wp-nested-pages, by Hook & Filter) in versions up to and including 3.3.2 lets an attacker who holds at least a Contributor-level account on the affected site submit crafted serialized data that is passed to PHP's unserialization logic, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, to code execution, data theft, or full site compromise. The reported base score of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the vendor's own 'Contributor PHP Object Injection' designation; the authoritative assessment re-scores the issue as AV:N/AC:H/PR:L/UI:N, reflecting that a low-privileged authenticated WordPress account is a hard prerequisite and that RCE depends on gadget availability rather than being guaranteed. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; exploitation is realistically limited to sites where open registration or loosely managed Contributor accounts give an outsider a foothold.
Unauthenticated attackers can reach the Tugtainer Agent's Docker management API and gain effectively full control over containers and the underlying Docker host, because the agent's request-signature check in agent/auth.py returns success whenever Config.AGENT_SECRET is left empty - which is the shipped default. All Tugtainer versions prior to 1.30.4 are affected (CPE cpe:2.3:a:quenary:tugtainer with a wildcard version), though exploitation requires the agent's port (default 127.0.0.1:8001) to be network-reachable, meaning deployments that place the agent on a separate host or otherwise expose it without setting a secret are the realistic victims; deployments that keep the agent internal or set AGENT_SECRET are not reachable. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the issue is fixed in vendor release 1.30.4, which rejects such requests with HTTP 401.
Unauthenticated SQL injection in Trex MES (all versions through 2026-09-29) lets a remote attacker reach the application over the network and inject arbitrary SQL into backend database queries, with the reported impact escalating to execution of operating-system commands. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any network-reachable instance of the MES web interface is directly in scope; the practical exposure limit is that this is niche manufacturing-execution software typically deployed on internal or OT-adjacent networks rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor patch version is specified in the available intelligence, so defenders should treat network isolation of the MES interface as the primary risk control while awaiting vendor guidance.
Unauthenticated SQL injection in Dolusoft SOPLOG affects every release before 2026.9.4.1, allowing a remote attacker who can reach a SOPLOG instance to inject arbitrary SQL into the application's backend queries, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N combined with high confidentiality, integrity, and availability impact producing a 9.8 Critical score. Because the vector carries PR:N and UI:N, no credentials, user interaction, or special configuration are required against a default deployment, so the practical limiting factor is exposure and prevalence rather than technical prerequisites - realistic risk is confined to organizations that actually run SOPLOG, and VPN-only, WAF-fronted, or non-internet-facing instances are substantially harder to reach. No public exploit identified at time of analysis, and the specific vulnerable parameter or endpoint has not been disclosed, which currently prevents defenders from scoping a precise detection or virtual-patch signature.
The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable.
Unauthenticated PHP object injection (CWE-502) in the WordPress plugin Booking Activities, affecting versions through 1.18.7.1, allows remote attackers to reach plugin endpoints and pass attacker-controlled data into PHP unserialize() with no authentication or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Potential impact includes code execution, file read/write, or denial of service, but real-world severity depends on the presence of a usable POP gadget chain in the plugin, WordPress core, or another loaded plugin/theme. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the Estatik WordPress plugin (versions through 4.3.5) allows an authenticated Subscriber-level account to elevate its privileges to higher roles, potentially achieving full site compromise. Although the published CVSS 3.1 vector lists PR:N (score 9.8), the independent assessment and the 'Subscriber Privilege Escalation' description confirm that a Subscriber account is required; such an account is trivially obtainable when open user registration is enabled, common on real-estate or listing sites. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated arbitrary file upload in the Zella WordPress theme before version 2.6.3 lets remote attackers write arbitrary files - including PHP - into the site by abusing a font upload action that performs no capability or nonce check, yielding full remote code execution with a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every WordPress installation running this theme at a version below 2.6.3 in its default configuration is exposed; no login, user interaction, or non-default setting is required. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but CISA's SSVC assessment flags the flaw as fully automatable with total technical impact, so rapid weaponization should be assumed. The vendor has released a fix in version 2.6.3.
Command injection in Deno 2.7.0 through 2.9.7 on Windows allows an attacker who controls arguments passed to node:child_process spawn/exec calls with the shell option enabled to execute arbitrary OS commands with the privileges of the Deno process. The root cause is that Deno applied cmd.exe quoting rules to every shell, so arguments escaped for cmd.exe are reinterpreted as syntax by PowerShell/pwsh, a custom bash.exe, or another POSIX-style shell running on Windows. Exploitation requires a specific, non-default developer-chosen pattern - untrusted arguments plus the shell option on a Windows host, which is why the assessed vector carries AC:H/AT:P - and no public exploit has been identified at time of analysis, although the vendor has published an upstream fix in PR 36772.
Denial of service in vLLM through 0.26.0 lets remote attackers crash or exhaust inference workers by submitting inputs containing deeply nested '{...}' or '[...]' delimiter structures that the Gemma4UnifiedParser expands recursively without any depth bound, exhausting the thread stack. The flaw is confined to the Rust parser component (rust/src/parser/src/unified/gemma4.rs) and only affects deployments that route requests or model output through the Gemma4 unified parser - typically Gemma-family model serving with tool-calling or structured-output parsing. Publicly available exploit code exists (a published GitHub gist demonstrates the nested-input trigger), and the vendor has released a fix in v0.29.1rc0 via PR #54303; no CISA KEV listing or confirmed in-the-wild exploitation was provided in the source data. Impact is availability-only (no data disclosure, no code execution), and the CVSS 4.0 vector scores it 6.9 with E:P while the independent assessment rates it CVSS 3.1 A:H.
SQL injection in AdithyaYelloju Restaurant-Management-System through commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c allows unauthenticated remote attackers to manipulate the ID argument in User/cancel.php and potentially read or alter order-related database records. Publicly available exploit code exists, and the upstream project has not responded to the issue report, but there is no CISA KEV listing or confirmed active exploitation. The independent assessment rates this as a low-priority, low-impact issue constrained mainly by the scarcity of deployed instances of this unmaintained single-developer project.
Integer overflow in the image-encoding routines of nothings/stb (stb_image_write.h, stb through version 1.16) allows remote attackers who can influence image dimensions or channel counts passed to stbi_write_png_to_mem, stbi_write_jpg_core, or stbi_write_tga_core to corrupt memory or crash the encoding process. Publicly available exploit code exists (no CISA KEV entry, so active exploitation is not confirmed), and the flaw requires an application that feeds attacker-controlled sizing into the encoder rather than simple network reachability. The published CVSS 4.0 score of 6.9 overstates practical risk: an independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N with only low integrity and availability impact and no confidentiality impact - a genuine but modest-severity issue whose real exposure depends entirely on whether the host application passes untrusted dimensions to the write functions.
Integer overflow in the hexwave_init() function of Nothings stb (stb_hexwave.h) corrupts allocation sizing when an application passes attacker-influenced width or oversample arguments during wave-table initialization. Exploitation is remote and unauthenticated at the library level and publicly available exploit code exists (no confirmed active exploitation), but the practical attack surface is limited: these are initialization parameters normally hardcoded by the developer, so exploitation requires an application that surfaces them to untrusted input. Impact is bounded to low integrity and availability loss, consistent with memory corruption or a crash rather than reliable code execution, and the project has not responded to the issue report, leaving no confirmed vendor patch.
Unauthenticated remote SQL injection in SourceCodester Car Driving School Management System 1.0 allows attackers to inject arbitrary SQL through the f=save_enrollment action of /classes/Master.php, potentially reading or altering data in the application's backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is reachable without credentials or user interaction, though all vulnerable-system impacts are rated Low (VC:L/VI:L/VA:L) with no subsequent-system impact, yielding a moderate 6.9 rather than a critical score. Publicly available exploit code exists (referenced via a GitHub issue and the VulDB entry), and the affected version is 1.0 of this open-source PHP application; no public exploit identified at time of analysis beyond that released proof-of-concept, and the software has no CISA KEV listing.
SQL injection in the test_id parameter of exam-delete.php in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate database queries, resulting in low-impact confidentiality, integrity, and availability loss (CVSS 4.0 6.9, medium). Publicly available exploit code exists and the attack is network-reachable with no user interaction; the published CVSS 4.0 vector rates it PR:N (unauthenticated), although our independent assessment notes the vulnerable script sits under the /admins/ administrative directory, implying a valid admin session is required in practice and that authentication requirements should be confirmed before the PR:N rating is trusted. The product is a small-footprint PHP application by SourceCodester, so real-world exposure is limited, and no CISA KEV listing indicates confirmed active exploitation.
SQL injection in the admin/table_booking.php script of AdithyaYelloju Restaurant Management System (commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) enables unauthenticated remote attackers to execute arbitrary SQL commands via the 'Name' parameter, potentially compromising data confidentiality and integrity (CVSS 4.0 score 6.9; assessed CVSS 3.1 C:H/I:H/A:L). Publicly available exploit code exists, but the affected codebase is unreleased and pinned to a single commit with no packaged versions and an unresponsive maintainer, making active exploitation unlikely in production environments.
Unauthenticated SQL injection in the Order Placement component (User/ord.php) of AdithyaYelloju Restaurant-Management-System lets remote attackers manipulate the id and name arguments passed to mysqli_query, giving them arbitrary read and partial write access to the underlying database. Publicly available exploit code exists (the issue thread linked from the CVE record), and no vendor patch is available because the maintainer has not responded to the report; the vulnerability is not confirmed as actively exploited (no CISA KEV entry). Real-world risk is driven almost entirely by product obscurity rather than defect quality - this is an unversioned, single-commit GitHub project with essentially no production deployments, so any exposed instance running the vulnerable commit is exploitable by default but few such instances are expected to exist.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows remote, unauthenticated attackers to manipulate database queries through the ID parameter of admin/delete1.php, a script the description treats as an unauthenticated action endpoint despite its location under the admin/ directory. Successful exploitation grants low-level confidentiality, integrity, and availability impact on the application's database, and publicly available exploit code exists, raising the likelihood of opportunistic scanning and abuse. The project is distributed via rolling releases with no versioned builds, the maintainer has not responded to the early issue report, so no vendor-released patch is available and every running instance should be considered affected; the practical risk is narrowed by the product's very low deployment footprint and the need for the endpoint to be reachable over the network.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the access_code parameter in /reviewer_0/admins/assessments/examproper/btn_functions.php. Per the CVSS vector, no authentication or user interaction is required, though the endpoint's location under an 'admins/' directory suggests it may be intended for authenticated administrators; a public exploit exists. No vendor-released patch has been identified at time of analysis, but the product is a niche educational PHP application with minimal enterprise deployment, so real-world risk is limited.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the 'ID' request parameter of /reviewer_0/admins/assessments/examproper/questions-view.php, altering backend database queries with partial confidentiality, integrity and availability impact (CVSS 5.5; vendor-disclosed, VulDB-tracked). Publicly available exploit code exists - a proof-of-concept is published at https://github.com/Aszadom/cve/issues/1 - but there is no confirmed active exploitation (CISA KEV). The CVSS 4.0 vector records PR:N/UI:N (no authentication or user interaction required), although the '/admins/' segment of the vulnerable path suggests the questions-view function is part of the administrative interface and may in practice require an authenticated admin session, which would materially limit realistic exploitation. No vendor-released patch was identified at time of analysis.
Unauthenticated OS command injection in HKUDS AnyTool 0.1.0 lets a remote attacker execute arbitrary shell commands on the host running the tool, because the Execute Endpoint in anytool/local_server/main.py passes attacker-controlled 'command'/'shell' arguments directly into subprocess.run. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) the endpoint requires no credentials or user interaction, so any deployment that exposes the local_server on a reachable interface - rather than loopback-only - is directly exploitable. Publicly available exploit code exists, and the project was notified via GitHub issue #6 but has not responded; no vendor patch has been identified at time of analysis. VulDB scored this 6.9 by rating impact conservatively as VC:L/VI:L/VA:L, while our independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) treats shell-level compromise of the host as high impact - treat the practical risk as higher than the published 6.9 suggests.
Information disclosure in gedelumbung HospitalManagement lets unauthenticated remote attackers obtain sensitive diagnostic output generated through the error_reporting handling in index.php, because PHP error text is emitted into HTTP responses. Exploitation requires only that the deployed instance runs with PHP error reporting/display enabled (the project's default or a common production misconfiguration) and that the attacker can remotely induce an error condition; no authentication or user interaction is needed (PR:N/UI:N). Publicly available exploit code exists (a public GitHub issue), and while CVSS 4.0 scores it 6.9 with E:P, our independent CVSS:3.1 assessment rates it as a low-severity confidentiality-only issue (C:L, no integrity or availability impact); there is no CISA KEV entry and no vendor-released patch identified at the time of analysis.
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker to bind a certificate to another user's account, compromising the confidentiality and integrity of that account's encrypted mail. In deployments where certificate-based login is enabled, this can escalate to unauthorized account access; no public exploit was identified at time of analysis. The flaw maps to CWE-306 and carries a high assessed severity, though impact is bounded to encrypted-mail confidentiality and integrity unless certificate-based login is in use.
Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a crafted media stream that causes memory corruption or a controlled software abort on the conferencing node, resulting in denial of service. Affected releases are Infinity before 38.2 and the 39.0, 39.1, and 40.0 branches; because the published vector is network-reachable with no privileges (PR:N) and no user interaction (UI:N), any host able to route media to an exposed node can attempt exploitation, though CISA's SSVC assessment rates the issue as not automatable, indicating a hand-crafted rather than commodity attack. The confirmed outcome is a controlled abort (availability impact), with memory corruption explicitly a stated potential rather than demonstrated, and the published 9.4 score is moderated in independent assessment (C:N/I:L/A:H) since confidentiality impact is not established; there is no public exploit identified at time of analysis and EPSS is low at 0.24% (14th percentile).
Improper access control in Tugtainer before version 1.30.3 causes the OIDC login flow to start even when OIDC_ENABLED=false, so a direct request to /auth/oidc/login still returns HTTP 302, sets an oidc_state cookie, and redirects the browser to the configured OIDC authorization endpoint despite the disable switch. The vendor scores this 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), but real-world impact is narrower than that score implies: exploitation requires a deployment where OIDC was fully configured (well_known_url, client ID/secret, authorization endpoint) and then toggled off, and the attacker must still complete authentication against that external identity provider to turn the initiated flow into a session. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in Tugtainer 1.30.3.