Monthly
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.
Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.
Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.