Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated OS command injection in the D-Link DIR-868L router running firmware 2.01b05 lets remote attackers execute arbitrary shell commands on the device by sending a crafted SOAPACTION argument to the HNAP handler exposed through /htdocs/cgibin. The flaw is remotely reachable with no credentials, no user interaction, and no non-default configuration required (CVSS v4.0 base 9.3, assessed v3.1 as AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), so any installation exposing the HNAP management interface is at risk; LAN-only deployments are largely confined to local-network exploitation, while devices with WAN-side remote management enabled are directly attackable from the internet. Publicly available exploit code exists (a detailed advisory and PoC are published on GitHub), which raises the practical urgency, though active exploitation is not confirmed by CISA KEV, and the product is an end-of-life model for which no vendor-released patch has been identified.
Unauthenticated remote code execution as SYSTEM affects Report One MyReport Updater through version 2.1.1, whose updater service exposes a gRPC endpoint on TCP port 9095 without any authentication. Any remote attacker who can route to that port can invoke the UpdateConfigReferent method to redirect the SYSTEM-privileged updater to an attacker-controlled reference server and deliver modified module archives; publicly available exploit code exists (published by Quarkslab), and successful abuse hinges on the attacker operating a malicious reference server whose module archives carry MD5 digests matching what the updater expects, which independent assessment rates as attack complexity High. Independent assessment confirms this as a genuine high-priority issue rather than a CVSS-inflated paper risk, with full confidentiality, integrity and availability impact confined to the vulnerable host.
Arbitrary file access and operating-system command execution in Stirling-PDF prior to 2.13.2 are reachable by an authenticated administrator who uploads a crafted SQL file to POST /api/v1/database/import-database on instances running the default H2 database backend with security mode enabled. DatabaseService.validateSqlContent() splits the normalized input on semicolons and accepts a statement if it merely contains an allowed keyword, so dangerous H2 constructs such as FILE_READ, CSVWRITE and CREATE ALIAS slip past the whitelist and execute when RUNSCRIPT processes the import; the demonstrated chain writes attacker-controlled startup files to a user-site location and triggers the application's Python interpreter to load them, yielding command execution as the JVM service account. The CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network reachability with full confidentiality, integrity and availability impact and a scope change, but PR:H means the attacker must already hold administrative privileges and non-H2 deployments are unaffected; no public exploit code identified at time of analysis, and the issue is fixed in version 2.13.2.
Remote unauthenticated OS command injection in TR7 ASP allows an attacker who can reach the appliance over the network to execute arbitrary operating system commands with the privileges of the vulnerable service, yielding full loss of confidentiality, integrity, and availability. Affected builds are TR7 ASP from 1.0.40.236 before 1.0.1554.2331 and from 1.6.42.239 before 1.6.1554.2331, covering both virtual-appliance and physical-appliance deployments. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the assessed vector, meaning no authentication, no user interaction, and low attack complexity; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). The primary limiting factors are version and network exposure: only the specified build ranges are affected and the appliance must be reachable by the attacker.
Unauthenticated OS command injection in TR7 Cyber Defense Inc.'s TR7 ASP appliance (both virtual and physical deployments) allows any attacker who can reach the appliance's exposed service to execute operating-system commands without supplying credentials or user interaction. The flaw is rooted in a missing authentication check for a critical function (CWE-306) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity, and availability of the appliance if exploited. All TR7 ASP installations running 1.0.40.236 up to (but not including) 1.0.1554.2331, or 1.6.42.239 up to (but not including) 1.6.1554.2331, are affected; exposure is the primary gating factor, since appliances segmented onto trusted management VLANs are far harder to reach. No public exploit code and no CISA KEV entry have been identified at time of analysis, and no EPSS score was provided with the source data.
Unauthenticated SQL injection in the e107 CMS alt_auth plugin allows a remote attacker to execute arbitrary SQL through a crafted login username whenever the plugin's otherdb or e107db authentication backend is configured against a live external database, affecting all e107 releases prior to 2.3.7. No authentication or user interaction is required once that configuration exists; the assessed impact is high on confidentiality and integrity, bounded by the privileges of the configured external database account, and failed queries can leak the generated SQL through the debug-message path to assist blind injection. No public exploit identified at time of analysis, and default e107 installations - which do not ship alt_auth enabled and do not point a backend at an external DB - are not exposed.
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.
OS command injection in the Samsung QA-Board backend allows unauthenticated remote attackers to execute arbitrary operating-system commands on the host running the service, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The flaw, classified as CWE-78, affects all versions matched by the wildcard CPE cpe:2.3:a:samsung_open_source:qa-board:*:*:*:*:*:*:*:*, so no release line is known to be exempt. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, but the trivial remote/unauthenticated attack profile makes rapid patching the priority.
Authenticated low-privileged users of Hestia Control Panel 1.9.7 through 1.10.4 who own at least one web domain can escalate to root by injecting a single quote into a custom document-root value, which update_object_value() fails to escape before writing it to the user's web.conf file. The forged PATH field is later loaded by the root-privileged v-search-user-object script via parse_object_kv_list_non_eval() - which allows reserved shell-variable names and replaces PATH globally - and the subsequent invocation of 'column' without an absolute path executes an attacker-supplied binary placed in the injected search path, yielding arbitrary code execution as root with a scope change (S:C) and full confidentiality, integrity and availability impact. The flaw is fixed in Hestia Control Panel 1.10.5; no public exploit code was identified at time of analysis, and the realistic threat model is multi-tenant/shared hosting or a malicious insider rather than an anonymous attacker, since a provisioned panel account with web-domain capability is mandatory.
A privilege escalation in KEDA 2.20.2 and earlier lets a namespace administrator who can create TriggerAuthentication and ScaledObject resources point hashiCorpVault.address at an endpoint they control and select Kubernetes authentication without supplying a credential; KEDA then logs in to that endpoint using the operator pod's projected ServiceAccount token, handing the attacker the operator's cluster-wide permissions including broad Secret reads and workload or admission-related operations. The prior CVE-2025-68476 JWT-shape filter does not block this path because the operator token's subject is a Kubernetes ServiceAccount, so it passes the filter. Exploitation is authenticated (CVSS PR:L) and gated by tenant-level RBAC to create those CRDs, but it is most dangerous in multi-tenant clusters where namespace admins are untrusted relative to the cluster-scoped operator; there is no public exploit code identified at time of analysis, and the issue is fixed in 2.21.0 via audience enforcement plus an outbound Vault-address allowlist.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
OS command injection in the Video-stitch Node.js library (ArsalanDotMe) before 2.0.0-beta.1 allows unauthenticated remote attackers to run arbitrary shell commands with the privileges of the Node.js process by supplying file names containing shell metacharacters to the concat(), cut(), or merge() functions. The vulnerable code interpolated those values unquoted into shell-executed ffmpeg command lines (shelljs.exec) in lib/videoconcat.js and lib/videocut.js, so exposure is realized whenever an embedding application routes untrusted data into the output/clip name or fileName parameters; applications that only pass trusted, internally generated file names are not exploitable. CVSS 4.0 rates this 9.3 (Critical) with PR:N and UI:N, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 2.0.0-beta.1.
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.
Unauthenticated PHP object injection in e107 CMS before 2.3.7 lets a remote attacker who can reach install.php execute arbitrary PHP functions with the web server's privileges, resulting in full server compromise (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw arises because the installer decodes the attacker-controlled previous_steps POST parameter and feeds it to unserialize() without restricting allowed classes, and because install.php remains reachable after a normal installation. No public exploit code was identified at time of analysis and CISA KEV does not list this issue, but the advisory documents a complete, directly usable gadget chain (GuzzleHttp\Psr\7\PumpStream → paths.hash → site_path callable coercion) that makes reliable exploitation realistic for any deployment that left the installer endpoint exposed; sites that deleted or access-restricted install.php after setup are the main mitigating factor.
OS command injection in the thumbnail Python package through version 1.5 allows attackers who control a filename passed to generate_thumbnail() to execute arbitrary shell commands with the privileges of the Python process. The vulnerable code concatenates user-influenced values (input, output, width, height, quality, trim) directly into os.system() calls invoking ffmpeg, convert or unoconv, so shell metacharacters such as ';', backticks or $(...) in a filename break out of the intended command. The package is a library with no network listener of its own, so real-world reachability depends on the consuming application exposing untrusted filenames - classically a file-upload feature - and on ffmpeg/convert/unoconv being installed for the relevant code branch; where those conditions hold, no authentication or user interaction beyond submitting the malicious filename is required. An upstream fix exists in pull request #9, and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows any remote attacker to read and modify the underlying database by sending a single POST request to web/html/socio/sistema/cadastro_cobranca.php. The codigo parameter is folded into the WHERE codigo= clause of an UPDATE statement without parameter binding, and supplying a quoted string defeats MariaDB's implicit numeric conversion on the VARCHAR column, permitting arbitrary SQL execution without a session. Exposed records include user credential hashes and billing entries in the cobrancas table; the issue is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows remote attackers to execute arbitrary SQL against the underlying database by sending crafted POST data to the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. Because the endpoint uses extract($_REQUEST) and interpolates user-supplied values directly into a raw INSERT statement, an attacker can read, modify, or delete billing, member, employee, permission, and credential data, or drop database tables, without authentication or user interaction. The vendor fixed the flaw in 3.8.6 with prepared statements and input validation; no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in WeGIA prior to 3.8.6 lets any remote attacker who can reach the application read, alter, or destroy its MySQL database through the billing endpoint web/html/socio/sistema/cadastro_cobranca.php. Because that endpoint is reachable without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and passes the valor, valor_pago, id_pessoa, id_socio and id_sociotipo parameters straight into UPDATE, INSERT and SELECT statements, an attacker can exfiltrate billing records and credential data or truncate tables to cause application-wide data loss. No public exploit code was identified at time of analysis and there is no CISA KEV entry indicating active exploitation, but the low attack complexity and lack of authentication make prompt upgrading to 3.8.6 the priority action.
PHP object injection in the itthinx Affiliates WordPress plugin (all versions through 7.0.1) allows remote, unauthenticated attackers to reach a code path that deserializes attacker-controlled input via unserialize(), which can lead to full object injection against the affected site. The supplied CVSS 3.1 vector scores it 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), while our independent assessment applies AC:H because meaningful exploitation depends on the presence of a usable PHP POP gadget chain in the plugin, WordPress core, or another installed plugin/theme; without such a chain the practical effect is usually limited. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but sites running Affiliates 7.0.1 or earlier alongside components that expose gadget chains face materially elevated risk.
Authentication bypass in Progress MOVEit Transfer's LDAP module allows unauthenticated remote attackers to skip a critical authentication step, carrying CVSS 9.8 impact on confidentiality, integrity, and availability when LDAP external authentication is enabled and the web interface is network-reachable. Affected releases are before 2025.1.6 and 2026.0.0 before 2026.0.4; fixed builds are 2025.1.6 and 2026.0.4. Exploitation signals conflict sharply: despite the critical score, no public exploit has been identified at time of analysis, EPSS is 0.46% (38th percentile), and CISA SSVC lists exploitation as 'none' while assigning total technical impact.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.
Insufficient session expiration in Progress MOVEit Transfer (versions before 2025.1.6, and 2026.0.0 through 2026.0.3) allows an attacker who obtains a still-valid session artifact - a token captured in transit, left behind on a shared or public workstation, or never revoked after logout or a credential change - to keep using that session beyond its intended lifetime, exposing managed file transfer data and functionality. No account of the attacker's own is required (CVSS PR:N), but exploitation is gated on a valid, reachable leftover token existing, which is why our independent assessment scores it AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N rather than the vendor's 9.8 - the flaw does not by itself yield code execution or availability impact. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.31% (23rd percentile), so real-world risk is materially lower than the headline score suggests. Patches are available from Progress.
OS command injection in nodejs-whisper through 0.3.1 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by supplying a crafted audio file path. The vulnerable convertToWavType() function builds an ffmpeg command as a string, interpolating the caller-provided path between double quotes before handing it to shelljs exec(); a filename containing $() command substitution or a closing double quote breaks out of the quoted argument and is interpreted by the shell. An upstream fix exists in pull request #259, but no tagged patched release has been independently confirmed, and no public exploit code was identified at time of analysis - real-world exposure is limited to applications that pass attacker-influenced, unsanitized filenames into the transcription/convert entry points while ffmpeg is installed on the host.
OS command injection in the whisper-node npm package through version 1.1.1 allows remote, unauthenticated attackers to run arbitrary shell commands with the privileges of the embedding Node.js process whenever an application passes attacker-controlled data into whisper()'s filePath argument or the whisperOptions.language (and potentially modelPath) options. The vulnerable code path is the default in all versions up to and including 1.1.1, with no special configuration required, although real-world exposure is gated by how the library is used: whisper-node is a library, not a network service, so only applications that feed it untrusted input are remotely exploitable, and impact is bounded by the Node.js process privileges. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the upstream fix appears in GitHub PR #64 but a released patched version could not be independently confirmed from the available data.
OS command injection in @mborne/extract versions before 0.2.1 lets an attacker execute arbitrary shell commands with the Node.js process's privileges by supplying shell metacharacters in the archivePath or targetDir options passed to extract(). The flaw is unauthenticated (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and scored 9.3, with full confidentiality, integrity, and availability impact to the host process, though it is a library with no standalone attack surface - it is only reachable when the integrating application forwards attacker-controlled values into one of the affected extractor paths (unzip, 7z, tar-bz2, or gz; the 7z path additionally requires the 7z binary). No public exploit code was identified at time of analysis, so exploitation is contingent on the host application's input handling rather than on any inherently exposed service.
OS command injection in doc-recog through 1.1.6 allows remote attackers to execute arbitrary commands with Node.js process privileges by supplying crafted document paths containing $(...) or backtick command substitution to the recog() or tag() functions, which flow to a shell-based pdftotext exec call in DocData._readPDF. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but real-world exploitability hinges on whether a consuming application passes attacker-controlled paths into the library; if paths are hardcoded or validated downstream, the flaw is not reachable. No public exploit code has been identified at time of analysis, and the upstream fix (PR #2) switches to execFile with an argument array to eliminate shell interpretation.
OS command injection in the transcribe2texts Node.js library through version 1.0.6 lets unauthenticated remote attackers execute arbitrary shell commands with the privileges of the Node.js process by supplying crafted audioPath values to transcribeAudio(). The flaw is a library sink rather than a directly exposed service: it is exploitable only where an integrating application passes attacker-influenced data into audioPath, which is concatenated unescaped into a python3 command line and run through child_process.exec(); applications that hardcode or strictly validate that path are not exposed. The critical 9.3 (CVSS 4.0) severity reflects network-reachable, low-complexity, no-privilege, no-interaction exploitation with high confidentiality, integrity and availability impact to the host, and while an upstream fix exists, no public exploit code has been identified at time of analysis.
OS command injection in Stills (shahkashani/stills), a Node.js media-processing library, before version 25.24.2 allows crafted media file names containing shell command-substitution syntax such as $(...) or backticks to be executed as operating system commands with the privileges of the Node.js process. The flaw is reachable whenever the library shells out to ffmpeg, ffprobe, gifsicle, or convert on an attacker-influenced path, and the CVSS 4.0 vector (9.3) describes an unauthenticated, low-complexity network attack (PR:N/UI:N) yielding high confidentiality, integrity, and availability impact; our independent assessment scores it CVSS:3.1 8.8/9.8-class (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) but cautions that real-world risk is materially lower in deployments where media file names are operator- or system-generated rather than user-supplied. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (25.24.2, via PRs #29/#30 and associated commits) is available.
OS command injection in webp-converter before 3.0.0 lets unauthenticated remote attackers execute arbitrary operating system commands as the Node.js process when a host application routes attacker-controlled file names or option strings into the library’s cwebp, dwebp, gwebp, or webpmux helper functions. The flaw carries a CVSS 4.0 score of 9.3 (with an independent CVSS 3.1 assessment of 9.8), but because webp-converter is a library rather than a listening service, real-world risk depends on whether the integrating application actually passes untrusted input into the vulnerable code path; applications that use only server-controlled, fixed paths and options are not exposed. No public exploit code has been identified at the time of analysis, and the vendor has released version 3.0.0 to fix the issue.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
OS command injection in the Python library pypdftk (through version 0.5) lets attackers who control the pdf_path or out_file arguments of fill_form(), dump_data_fields(), or pdftk_cmd_util() execute arbitrary operating-system commands with the privileges of the hosting Python process. The three functions concatenate caller-supplied paths into a command string using '%s' formatting and pass it to subprocess.Popen with shell=True, so shell metacharacters embedded in a filename or path are interpreted by the shell rather than treated as literal arguments. CVSS v4.0 scores the flaw 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), and the independent assessment concurs with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but real-world reachability is bounded by the calling application - pypdftk is a library, not a network service, so exploitation requires the embedding application to forward untrusted input into those parameters, and no public exploit code has been identified at time of analysis. No CISA KEV entry exists for this CVE, and a source-level fix is available from upstream via pull request 57, which replaces string command construction with argument lists.
OS command injection in the npm package git-diff (danday74/git-diff) before 2.0.7 lets unauthenticated attackers execute arbitrary shell commands with the privileges of the Node.js process by passing crafted document strings into the gitDiff API. The library hashed each input with a shell command of the form `printf "..." | git hash-object -w --stdin` evaluated through shelljs.exec, so payloads containing $(cmd) or backtick substitutions survived the JSON.stringify escaping and were executed. The vendor has published an upstream fix that removes the shell invocation entirely, and no public exploit code has been identified at time of analysis; the assessed CVSS 4.0 base score is 9.3 (Critical) for maximal confidentiality, integrity and availability impact to the vulnerable system.
Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitrary OS commands, but only when the periodic TACACS+ authorization-refresh feature is enabled - an OS command injection flaw (CWE-78) that requires both a valid low-privileged TACACS+ account and that specific configuration to be active. The vendor rates it 9.3, while our independent assessment scores it CVSS:3.1 9.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting that exploitation is not possible by an anonymous remote attacker despite the vendor's PR:N vector. There is no public exploit identified at time of analysis, and the flaw does not trigger on devices using TACACS+ without authorization-refresh, or on devices using RADIUS or local authentication.
OS command injection on Windows in Beganovich Snappdf versions 1.1.0 through 6.0.x lets remote attackers execute arbitrary operating-system commands as the PHP process by feeding cmd.exe metacharacters (such as '&') into the URL passed to setUrl(). Because the vulnerable code path is built only when the library runs on Windows, the issue is exploitable only when the integrating PHP application runs on Windows and passes attacker-influenced data into setUrl(); a fully static or trusted URL is not exploitable. The CVSS v4.0 vector (AV:N/PR:N/UI:N) indicates the injection can be triggered remotely without authentication, giving high confidentiality, integrity, and availability impact on the host, although no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Authentication bypass in vlife through 2.0.1 enables unauthenticated remote attackers to forge HS256 JSON Web Tokens using a hardcoded signing key, granting super administrator access to any URL on affected instances. The vulnerability carries a CVSS 9.3 (CVSS:4.0) and CWE-321, with all default installations affected because the key is embedded in the open-source TokenUtil class. Exploitation requires only network reachability; no public exploit code has been identified at time of analysis.
Authenticated SQL injection in JTL-WMS lets any user holding a low-privileged session inject arbitrary T-SQL into the application's database queries, granting full read and write control over the backend Microsoft SQL Server data and opening a pivot path toward connected systems. The flaw (CWE-89) carries a CVSS score of 9.4 and is network-reachable with no user interaction, but exploitation requires valid credentials (CVSS PR:L) - fully anonymous attacks are not supported by the assessed vector, and exposure is further bounded by whether the instance is network-reachable to the attacker and whether the vulnerable code path is deployed. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a joint advisory covering this CVE together with CVE-2026-89309.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).
Unauthenticated remote code execution affects Komodo through 2.3.3 via its Periphery agent, which fails open when its core_public_keys and passkeys allowlists are left empty - the shipping default. Any attacker who can reach the agent's TCP port 8120 can present a self-generated keypair, be accepted as a trusted Core, and issue Periphery API calls that include terminal sessions and container operations, resulting in command execution on managed hosts typically as root. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality/integrity/availability), consistent with an independent assessment of CVSS 3.1 9.3; no public exploit code and no CISA KEV entry were identified at time of analysis, though the default-configuration exposure makes exploitation trivial wherever port 8120 is reachable.
Out-of-bounds array access in the Svc::GenericHub component of NASA's F´ (F Prime) framework (4.1.0 through 4.1.x, fixed in 4.2.0) lets remote, unauthenticated attackers who can deliver a crafted hub packet via fromBufferDriver supply an output-port index outside the configured port array; assert-enabled builds abort (denial of service) while builds compiled without assertions can corrupt heap memory and potentially achieve remote code execution. No public exploit code exists and no exploitation has been confirmed in the wild - exploitation presupposes attacker reachability to the hub's input channel, which in F´ deployments is typically a mission radio link or inter-process transport rather than an internet-facing service. The vendor rates this CWE-129 improper array index validation flaw CVSS 4.0 9.3 (Critical), with high confidentiality, integrity and availability impact.
Lantronix XPress-DR and XPress-DR-I (CoBos-family) devices running firmware through 8.1.0.0 expose an unauthenticated UDP configuration service on port 30718 that lets any remote attacker who can reach that port read live configuration data with a type 0xF8 query and persistently rewrite the device IP address and serial-channel forwarding records using a type 0xFD frame with an exactly 0x78-byte body, with the changes committed to EEPROM and surviving reboots. The root cause is missing authentication for a critical function (CWE-306), and no credentials, user interaction, or non-default settings are required; the only practical barriers are network reachability of UDP/30718 and the shrinking installed base after the series reached end-of-life in February 2025. The CVE record scores this 9.3 under CVSS 4.0 and our independent assessment rates it 9.8 under CVSS 3.1; no public exploit code or confirmed active exploitation was identified at time of analysis, though the attack itself is trivial to perform against any reachable device.
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.