Unauthenticated remote code execution in Cognition before 0.13.0 lets any network-reachable attacker create a session through POST /sessions and post a message through POST /sessions/{id}/messages, driving the Deep Agents ReAct loop to execute attacker-supplied shell commands via the default local execution backend. Default deployments are exposed because the REST/SSE API ships without authentication and the agent sandbox backend defaults to local execution; publicly available exploit code exists, and the main limiting factor is whether operators placed the API behind an authenticating reverse proxy or configured a non-local sandbox backend. Vendor-released patch: 0.13.0.
Authenticated expression injection in Camunda 7 (7.24.0 through 7.24.13 and 7.23.0 through 7.23.16) lets a user who can reach the ad-hoc task-query API bypass the enableExpressionsInAdhocQueries restriction and execute arbitrary OS commands as the engine service account. The validator does not inspect sub-query expression maps in TaskQueryDto.orQueries, so a crafted JUEL expression can trigger Java reflection and Runtime.exec. Publicly available exploit code exists; the vendor has released fixed versions 7.24.14 and 7.23.17, and CISA KEV status is not indicated.
Relay-based impersonation in the CCC-Attestation attested-tls-poc reference implementation (all versions through commit 731ca82) lets an attacker who holds an extracted attested-TLS private key forward a relying party's attestation nonce to a genuine attester and replay the returned, valid Evidence on the attacker's own connection, thereby masquerading as the attested workload and intercepting data meant for it. The root problem is that early attestation Evidence is never cryptographically bound to the TLS connection, so possession of the key plus a position on the relay path is sufficient; CVSS 4.0 scores this 9.1 with AC:H, AT:P and PR:N, meaning no credentials are needed but attack requirements (key control, relay placement) are present. Publicly available exploit code exists in the form of the published ProVerif formal models and relay-attack artifacts, while no CISA KEV entry indicates confirmed active exploitation.
Unauthenticated remote command execution is possible in MLJAR Mercury 3.0.0 through 3.2.3 because a missing comma in the BLOCKED_PATTERNS list merges the /lab and /api/terminals regular expressions into a single pattern, so requests to /api/terminals no longer match the anonymous-endpoint blocklist and are proxied straight to Jupyter Server's terminal API. An attacker with network access to a Mercury instance that serves dashboards to anonymous users can therefore open an interactive operating-system shell and run commands with the privileges of the Mercury process (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C). All severity signals agree - network reachability with no credentials or user interaction, scope change into the underlying Jupyter Server, and high confidentiality/integrity/availability impact - and the only limiting factor is that the instance must be reachable and running an affected version; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote code execution affects the camel-hazelcast component of Apache Camel 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0, where two self-built Hazelcast bootstrap paths create instances without the default JavaSerializationFilterConfig added for CVE-2026-43865. A route using ReplicatedHazelcastAggregationRepository without an injected hazelcastInstance, or a client-mode endpoint built by HazelcastDefaultComponent#getOrCreateHzClientInstance() when neither a ClientConfig nor hazelcastConfigUri is supplied, will accept and deserialize arbitrary Java objects published into the backing cluster, letting an attacker who can write into that cluster execute code before Camel ever processes the exchange. Hazelcast clusters ship without authentication or TLS by default, so the write prerequisite is often met in practice; no public exploit code or CISA KEV entry was identified at time of analysis, but the vendor has published fixed releases and the missing-filter condition requires no unsafe opt-in by the deployer.
Supply-chain malware in Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC can compromise WordPress sites that activated the affected plugin, exposing credentials and enabling persistent backdoor access. The vendor-confirmed incident is limited to that roughly 11-hour distribution window and requires plugin activation; running version 3.0.123 obtained outside the window is not sufficient to establish compromise. Rank Math released version 3.0.124 as the clean replacement, and no public exploit was identified at time of analysis in the provided data.
Remote code inclusion in the HivePress WordPress plugin (versions through 1.7.32) lets an authenticated low-privileged user execute arbitrary code on the server, since the injection flaw is reachable over the network with low complexity and no user interaction in a changed-scope context. Because HivePress powers marketplace and listing sites that frequently allow open vendor or user self-registration, the PR:L barrier is often trivial to clear in real deployments. No public exploit code or CISA KEV entry was identified at time of analysis, but the severity (CVSS 9.9) and low prerequisite make it a high-priority patch target; sites that disable public registration materially reduce exposure.
Authenticated attackers with low privileges can upload dangerous files, including PHP web shells, to WordPress sites running the MapSVG plugin through version 8.16.1, potentially achieving remote code execution. The vulnerability is an unrestricted file upload (CWE-434) that requires a valid low-privileged account but no user interaction, and the CVSS vector indicates high confidentiality, integrity, and availability impact with scope change. No public exploit identified at time of analysis, yet the high CVSS score and web-shell outcome make this a high-priority issue.
Unsafe reflection in Apache Johnzon's ClassConverter can cause the library to load and statically initialize an attacker-named class from untrusted JSON, potentially producing code execution or other harmful side effects when a suitable classpath gadget and an exposed deserialization path exist. Signals conflict sharply and should be weighed together rather than reading the 9.8 at face value: the public CVSS is 9.8 and SSVC technical impact is total, but the assessed vector uses AC:H, EPSS is 0.36% (28th percentile), no CISA KEV entry was present, and no public exploit identified at time of analysis. The issue affects Johnzon 1.0.0 to before 1.3.1 in the javax namespace and 2.0.0 to before 2.2.0 in the jakarta namespace, with fixed releases 1.3.1 and 2.2.0.
SQL injection in SLiMS (Senayan Library Management System) Bulian 9.8.0 lets any authenticated staff user extract arbitrary database contents by supplying malicious SQL identifiers in the tableName and tableFields POST parameters of the admin AJAX endpoints admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php and admin/AJAX_vocabolary_control.php. The submitted CVSS of 9.8 with PR:N conflicts with the documented requirement for a valid staff login, so the realistic exposure is a post-authentication confidentiality breach (independently assessed as C:H/I:N/A:N) rather than a pre-auth compromise. EPSS is low at 0.33% (25th percentile), there is no CISA KEV entry, and no confirmed public exploit code was identified at time of analysis, although a GitHub repository named for this CVE appears in the references and warrants triage. No vendor-released patch version is confirmed in the available data.
Command injection in GeoVision GV-ASManager's GeoWebServer.exe allows unauthenticated remote attackers who can reach the default web ports to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 and the weakness class is CWE-78, but no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data. Because the management web service is typically central to access-control operations, exposed instances should be treated as high priority while the exact affected version range and vulnerable endpoint are confirmed against GeoVision's advisory.
Remote code execution in IBM MQ Operator and IBM MQ Advanced container images is possible when a TLS-enabled channel processes a malformed TLS certificate whose distinguished name overflows a stack buffer during connection establishment. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because the certificate parsing happens before any authentication completes, so a remote attacker reaching a TLS listener on an affected queue manager needs no credentials and no user interaction; successful exploitation yields full compromise of confidentiality, integrity and availability. Exposure is bounded by configuration: only queue managers whose channels accept or require TLS (for example with SSLCIPH set) reach the vulnerable parsing path. A vendor patch is available, EPSS is low at 0.25% (15th percentile) and SSVC records exploitation as none with automatable no, so no public exploit code has been identified at time of analysis, but the priority label is act_now given total technical impact across a very broad set of shipped container image and operator versions.
Unauthenticated remote code execution in MLJAR Mercury deployments running the default tokenless configuration allows any network-reachable client to create a Jupyter kernel and send execute_request messages containing arbitrary Python, resulting in code execution as the Mercury server process user. Mercury versions through 3.2.5 are affected and 3.2.6 is the fixed release; deployments that require a token or password via MERCURY_TOKEN or --token are not exploitable through this path. The issue is assessed at CVSS 9.8, publicly available exploit code exists, but no active exploitation is confirmed (not in CISA KEV).
SQL injection in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows attackers who can reach the administrative reporting endpoint to manipulate SQL queries through the fileID parameter in admin/modules/reporting/customs/dl_detail.php, potentially exposing, modifying, or deleting library data. The supplied CVSS 3.1 vector rates this 9.8 with PR:N, but our assessed vector requires low privileges (PR:L) because the vulnerable script is under the /admin/ tree; authentication requirements should therefore be confirmed against the source. No CISA KEV entry or confirmed public exploit was identified at time of analysis.
Unrestricted file upload in Eptura Archibus lets a user with a low-privileged account submit an export report containing arbitrary JSP code with a JSPX extension and then browse to the stored file, causing the Java application server to execute attacker-controlled code. Because the upload normally requires an account, the separately disclosed authentication bypass is the key force multiplier: chaining the two removes the authentication prerequisite and yields unauthenticated remote code execution on Java/JSP-capable deployments where uploads are stored in a web-executable location. Rapid7 reports the vendor has fixed the issue; no public exploit code or CISA KEV entry was identified at time of analysis.
FlyCms through commit edfdf724 permits unauthenticated remote takeover because it retains a default super-administrator account, flycms/admin123, reachable through POST /api/auth/login with only an image captcha as a barrier. An attacker who can reach that endpoint and solve the captcha can obtain full control of site content, users, and configuration. This is a genuine high-priority default-credentials issue (CWE-1392); no CISA KEV listing or public exploit code was identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 allows remote attackers to self-enroll into the mesh and invoke arbitrary tools across every connected MCP backend node. The control plane exposes GET /info publicly, auto-enrolls any valid OIDC token holder via POST /register without claim filtering or ban checks, and ships a default policy binding sam:system:authenticated to wildcard services and targets, so a token holder can obtain a mesh credential with full read, write, and execution access. No public exploit code or active exploitation is confirmed at time of analysis, though the CVSS vector is PR:N and practical risk depends on whether the configured OIDC provider lets an attacker self-obtain a valid token; upgrading to 0.1.0-alpha.9 enforces fail-closed defaults, explicit policy-binding requirements on enrollment, and ban checks.
Unauthenticated remote libp2p peers can bypass Biscuit capability policy enforcement in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 and 0.1.0-alpha.2 through the /libp2p-http ingress server, invoking arbitrary registered backend services including command/stdio-backed MCP servers, A2A, and inference endpoints. The defect is a missing-authentication and missing-authorization flaw in StartIngressServer (cmd/sam-node/node.go): unlike the MCP stream handler, the ingress path routes requests to backend handlers without verifying a Biscuit token or mesh enrollment. CVSS 4.0 scores this 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released a fixed version.
Unauthenticated resource exhaustion in the Grav API plugin (grav-plugin-api) before 1.0.42 allows any remote attacker who can reach GET /api/v1/translations/{lang} to make the plugin cache a full ~560 KB translation dictionary for each well-formed language code, potentially filling disk or APCu; separately, authenticated accounts with api.pages.write can bypass target/destination page rules in the sync and batch copy endpoints to overwrite translations or create pages that page-level rules deny. The plugin is an optional add-on rather than part of a default Grav install, which limits exposure, and no public exploit has been identified at time of analysis.
Grav CMS 2.0.15 through 2.1.x (before 2.2.2) allows authenticated users with page-edit permission to bypass the Flex form callable allowlist and invoke arbitrary public static methods such as Folder::delete, Folder::move, and Utils::download. By renaming a Flex form field using the replace-name@ syntax, an editor can smuggle data-*@ directives past validation, enabling directory deletion, file overwrite, and arbitrary file reads. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated editor account rather than anonymous access.
Authorization bypass in Craft CMS 5.0.0 through 5.10.x allows an authenticated holder of a narrowly site-scoped GraphQL token to create entries in other sites and to delete entries, categories, tags and assets shared across sites. The bypass exists because the requireAllowedSite() check applied to GraphQL queries is not enforced on mutation resolvers, so an attacker can simply supply a siteId outside the token's scope and have the write succeed. Only multi-site installations with the GraphQL API and mutation-enabled, site-scoped tokens are exposed; single-site installs and read-only GraphQL schemas are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is integrity and availability only (no confidentiality loss), but deletion of shared elements can corrupt content consumed by multiple sites.
Heap buffer overflow and stale-heap disclosure in Pillow's compressed TIFF save path can crash the process and potentially enable code execution when an application writes TIFF data to an in-memory stream such as io.BytesIO. Affected are Pillow versions 2.0.0 through 12.x (fixed in 13.0.0) that use libtiff and process attacker-influenced out-of-line TIFF tags or retained ICC profiles; file paths and targets with real file descriptors are not affected. The flaw requires a specific combination of compressed saving, seek-past-end behavior, and controlled tag data (AC:H/AT:P), and no public exploit code has been identified at time of analysis.
Missing authorization in CheckCle through 1.6.0 leaves the bundled PocketBase collections publicly accessible, allowing unauthenticated remote attackers to read, modify, and delete monitoring records and extract secrets such as server_token and alert_configurations values. Because the flaw is present in the default shipped schema, any instance with a reachable API endpoint is exposed out of the box; successful abuse can disable alerting, alter status pages, or erase monitoring data. No public exploit was identified at time of analysis, but the default-configuration exposure and high impact justify urgent patching.
Argument injection in Pillow's EPS decoding path (EpsImagePlugin.Ghostscript) lets a caller-controlled input filename be parsed as a Ghostscript option, and in the worst case escalates to arbitrary command execution. All Pillow releases from 2.6.0 up to but not including 13.0.0 are affected when Ghostscript is installed and the host application passes an unsanitized, attacker-influenced filename into Image.open() for EPS input; no authentication is required per the CVSS vector (PR:N), though exploitation depends on that application-level precondition. Making the path absolute before it is placed after Ghostscript's -f flag closes the issue, and the vendor shipped that change in 13.0.0 (commit a2c3631); no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap buffer overflow in Pillow's JPEG decoder (all versions prior to 13.0.0) lets a crafted 8-bit lossless SOF3 JPEG corrupt heap memory, crash the process, and potentially achieve code execution when an application requests downscaling through draft() or thumbnail(). Exploitation is unauthenticated but conditional: the Pillow build must be linked against libjpeg-turbo 3.x, because libjpeg-turbo 2.x and IJG builds reject the SOF3 input outright, and the application must actually call draft()/thumbnail() on attacker-supplied images - a common pattern in upload/thumbnail pipelines, which is the realistic exposure surface. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 4.0 score of 9.2 reflects high confidentiality/integrity/availability impact, tempered by the AC:H rating derived from the narrow build-configuration prerequisite.
Heap-based buffer overflow in Pillow before 13.0.0 can corrupt memory and potentially enable arbitrary code execution when an application with the optional olefile dependency opens or thumbnails a crafted OLE2 FlashPix (FPX) image. The flaw is reachable by unauthenticated remote attackers who can supply malicious image input, but exposure is limited to deployments that have installed olefile and process untrusted FPX content; no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). The vendor-released patch is Pillow 13.0.0.