Critical Watch

Kedro remote code execution affecting all versions before 1.3.0 with active threat intelligence signals allows unauthenticated attackers to execute arbitrary commands in data science pipelines via environment variable poisoning.

goshs arbitrary file write with active threat intelligence allows unauthenticated remote attackers to overwrite any file via path traversal in this commonly-used Go HTTP server tool.

Unauthenticated remote code execution in Progress ShareFile Storage Zones Controller with public exploit and known threat actor activity represents immediate risk to enterprises using this widely-deployed enterprise file sharing solution.

Actively exploited (CISA KEV) remote code execution in Progress ShareFile Storage Zones Controller with public exploit requires immediate patching across enterprise environments using this common file sharing infrastructure.

Stack-based buffer overflow in Cesanta Mongoose affects a widely-used embedded web server library found in numerous IoT devices and embedded systems, with public exploit available and patch released.

Out-of-bounds write in LibRaw, a library used by many image processing applications and services, allows denial of service via malformed images with public exploit available though patch is released.

Remote code execution in a Contact Form 7 spam protection plugin affects WordPress sites where authenticated editors can achieve RCE, relevant given WordPress powers over 40% of websites.

Remote code execution in Google Chrome with public exploit and known threat actor interest affects hundreds of millions of users, requiring immediate patching to version 146.0.7680.178 or later.

Critical unauthenticated database cluster compromise in Canonical Juju allows complete data exfiltration from cloud infrastructure management systems used widely in enterprise Linux environments.

Unauthenticated remote code execution with public exploit in MetInfo CMS versions 7.9-8.1 enables complete server compromise without any user interaction.

Path traversal in Sanster IOPaint allowing unauthenticated arbitrary file read/write/delete with public exploit poses significant risk to organizations using this AI image editing tool.

Unrestricted file upload in Shandong Hoteam InforCenter PLM with public exploit allows unauthenticated remote code execution in enterprise product lifecycle management systems.

Critical unauthenticated remote code execution in Everest Forms Pro WordPress plugin (CVSS 9.8) affects a popular premium plugin with likely thousands of installations, allowing attackers to execute arbitrary PHP code without authentication.

Critical unauthenticated HTTP proxy abuse in FastGPT (CVSS 10.0), an increasingly deployed AI Agent platform, allows attackers to relay arbitrary requests through victim servers, enabling internal network pivoting and SSRF attacks.

Critical SQL injection with remote code execution potential in SciTokens Python library (CVSS 9.8), widely used in scientific computing and grid authentication infrastructures, allows unauthenticated attackers to compromise token validation systems.

High severity authenticated remote code execution in Tenda CH22 router (CVSS 7.4) with public exploit code poses risk to small office/home office networks where default credentials are commonly unchanged.

Unauthenticated command injection in Totolink A3300R router (CVSS 6.9) with public exploit code enables complete device compromise on consumer routers that may be deployed in small business environments.

MLflow is a widely-used machine learning platform in enterprise data science environments, and this critical RCE vulnerability with CVSS 10.0 allows remote code execution during model deployment, posing significant risk to ML infrastructure.

nginx-ui is a management interface for nginx web servers, and this unauthenticated configuration takeover vulnerability allows attackers to modify web server configurations remotely, directly impacting organizations using this management tool.

Totolink A3300R routers with authenticated command injection and public exploits represent a risk to organizations using these devices for network infrastructure, allowing full system compromise.

Additional command injection vector in the same Totolink A3300R firmware enables authenticated attackers to execute arbitrary commands via UPnP configuration, compounding the risk for affected router deployments.

Critical command injection in a GitHub Actions workflow that allows unauthenticated attackers to execute arbitrary code on CI/CD runners through issue comments, posing supply chain risk to any organization using this workflow or similar patterns.

Stack-based buffer overflow in mxml library (up to version 4.0.4) affects a widely-used XML parsing library that may be embedded in numerous applications, though impact is limited to local authenticated attackers and a patch is available.

Code injection with arbitrary code execution in PandasAI, a widely-used Python data analysis library with significant enterprise adoption, allows unauthenticated remote attackers to compromise systems through the Chat Message Handler with public exploit code available.

Unrestricted file upload leading to remote code execution in localGPT affects organizations deploying local LLM solutions for privacy-sensitive AI applications, with public exploits available and no authentication required.