Command injection in the WAVLINK WL-WN530BE1-A router (build V251117) allows unauthenticated remote attackers to execute arbitrary shell commands on the device by sending crafted requests to /protocol.csp that reach the con_check_read_finish function with malicious group_name or IP-FROM values. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are indicated as prerequisites, giving high confidentiality, integrity and availability impact. A public PoC reference exists (a GitHub write-up linked from the VulDB entry); it is not verified as working exploit code, and no CISA KEV listing is present in the supplied data, although the vuln.today decision label is act_now.
Unauthenticated OS command injection in the WAVLINK WL-WN579A3-A Initial Setup Wizard allows a remote attacker who can reach /cgi-bin/adm.cgi to execute arbitrary shell commands by supplying a crafted wlan_ssid argument to set_wzdgwMesh, with high confidentiality, integrity and availability impact (CVSS 4.0 score 9.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The issue affects the named 2026-03-10-94f93d4 firmware and is tracked as CWE-78; a public PoC reference exists, but it is not verified as working exploit code, and no CISA KEV confirmation was provided. Exposure is mainly limited by whether the device HTTP management interface is reachable from untrusted networks, and the priority label is act_now with no vendor-released patch identified at time of analysis.
Stack-based buffer overflow in the TFTP upload filename handler of D-Link DIR-505 firmware 1.10B02 lets remote attackers send a crafted upload filename to /usr/bin/tftpd and corrupt stack memory, with high confidentiality, integrity, and availability impact under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires the TFTP upload service to be running and reachable from the attacker's network position; the target is a specific retired travel-router model and firmware. No CISA KEV entry is present, but a public PoC reference exists on GitHub and has not been verified as working exploit code; the vuln.today decision label is act_now.
OS command injection in the WireGuard CLI group handler of the WAVLINK WN536AX6-A router (firmware V260507_2.0.0) lets an attacker who can reach the group-management interface inject arbitrary shell commands through the group_name argument processed by sub_41a1d8 in /bin/ioos, achieving full compromise of confidentiality, integrity and availability. The CVSS 4.0 score is 9.3 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N, but authentication requirements are not confirmed from the available data, and if an admin session or LAN-only management access is actually needed that becomes the primary limiting factor; risk is highest where the management or WireGuard interface is exposed to the WAN. A public PoC reference exists (a GitHub write-up describing the wireguard_cli_group command injection); it is not verified as working exploit code, and there is no KEV listing or other confirmation of active exploitation.
OS command injection in the WAVLINK WN536AX6-A web management interface allows remote attackers to execute arbitrary shell commands as the device's ioos process by supplying a crafted group_name value to the OpenVPN CLI configuration handler (sub_416760 in /bin/ioos). Firmware V260507_2.0.0 is the version identified as affected in the disclosure, and the CVSS 4.0 score of 9.3 with a PR:N vector treats the endpoint as reachable without authentication, although the available sources do not confirm whether a prior login to the management UI is enforced before the vulnerable handler can be reached. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the vuln.today decision label for the issue is act_now based on the convergence of the command-injection impact, the public write-up, and the absence of a shipped fix.
The Generative UI sandbox in prefab-ui 0.14.0 through 0.20.2 does not actually isolate caller-supplied Python: the Deno subprocess is launched with unrestricted --allow-read, --allow-write and --allow-net, and Pyodide's js module exposes the Deno global to sandboxed Python, so code can call Deno.readTextFileSync and Deno.writeTextFileSync as the server OS user, and can persist execution by writing a .pth file into the server virtualenv's site-packages. The documented remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox; on a FastMCP server with no authentication configured, any client that can reach the server can invoke it (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0). Exposure is narrowed by the feature being opt-in and requiring Deno on the host, but the dedicated advisory, an act_now decision label and a vendor-released fix in 0.21.0 make this a high-priority item; no public exploit was identified at time of analysis.
Path traversal in the Beta9 gateway and worker lets a tenant holding a valid workspace token deploy a function, endpoint, or task queue with a volume identifier containing '..' segments, collapsing the gateway-built host path to the worker's filesystem root and bind-mounting it read-write into the sandbox. This allows an authenticated attacker to read and write the worker's files, including other tenants' volumes colocated on the same machine; CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with scope change. Gateway 0.1.769 and worker 0.1.745 are confirmed vulnerable, with fixes released in gateway 0.1.776 and worker 0.1.756; no public exploit code was identified at time of analysis, but the vendor-supplied patch details are public and the priority label is act_now.
Sandbox file API path traversal in Beta9 worker before 0.1.756 lets a tenant holding a valid workspace token and one running sandbox read, write, list and delete arbitrary files on the hosting worker as root, including files belonging to other tenants on the same machine. The reporter's read-only proof pulled the worker pod's Kubernetes service account token through the file API via a path that did not exist inside the sandbox, and because the shipped remote-node manifests bind that service account to cluster-admin, host file access escalates to full cluster compromise, which is why the scope-changed CVSS score reaches 9.9. A proof-of-concept read is described by the reporter; no public exploit code is otherwise confirmed, the issue is not in CISA KEV, and the vendor has released a fix in worker 0.1.756. This is a genuine top-priority issue, not an inflated high-CVSS score.
Beta9 worker images before 0.1.756 execute every Buildah RUN step from a tenant-supplied image definition with chroot-only isolation, so a build submitted with an ordinary workspace token runs as uid 0 inside the worker pod's PID, network, IPC and user namespaces while retaining CAP_DAC_OVERRIDE. Because /proc/1/root resolves to the worker container's writable filesystem, that tenant build can reach the runc, buildah and runsc binaries the worker uses to launch other tenants' containers, the worker's Kubernetes service account token, and host directories mounted into the privileged pod, giving scope-changed confidentiality, integrity and availability impact (CVSS 9.9, S:C). The reporter documented a read-only proof confirming the shared namespaces and the worker's runc binary at /proc/1/root; no public exploit code is confirmed, and the vendor shipped the fix in worker 0.1.756.
Unauthenticated SQL injection in the BookIt WordPress plugin through 2.6.0.6 allows remote attackers to read data from an affected site's database, based on the assessed high confidentiality-only impact. Exploitation requires only network access to a WordPress installation with BookIt active, with no authentication or user interaction per the assessed vector, so exposure is limited to sites that have not updated past 2.6.0.6. No public exploit identified at time of analysis and no CISA KEV entry is present in the provided data, but the vuln.today decision label is act_now, so affected sites should be prioritized for remediation.