Monthly
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.002) lets any WordPress user granted the plugin-defined wppa_upload capability execute arbitrary operating-system commands as the web-server user, achieving full server-side code execution where ImageMagick is the active image backend. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is reachable through the update-photo AJAX action's value parameter, and no public exploit code was identified at time of analysis; the bug is not in CISA KEV. Because wppa_upload is a plugin-level privilege that administrators can delegate to lower-privileged roles, the effective attacker pool can extend well beyond site administrators on misconfigured sites.
Unauthenticated OS command injection in the D-Link DIR-868L router running firmware 2.01b05 lets remote attackers execute arbitrary shell commands on the device by sending a crafted SOAPACTION argument to the HNAP handler exposed through /htdocs/cgibin. The flaw is remotely reachable with no credentials, no user interaction, and no non-default configuration required (CVSS v4.0 base 9.3, assessed v3.1 as AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), so any installation exposing the HNAP management interface is at risk; LAN-only deployments are largely confined to local-network exploitation, while devices with WAN-side remote management enabled are directly attackable from the internet. Publicly available exploit code exists (a detailed advisory and PoC are published on GitHub), which raises the practical urgency, though active exploitation is not confirmed by CISA KEV, and the product is an end-of-life model for which no vendor-released patch has been identified.
Command injection in MobSF v4.5.2 allows an attacker with access to the instance-and, for the /api/v1/scan path, a valid MobSF REST API key-to execute arbitrary shell commands via the /download_data/ endpoint, the /api/v1/scan REST API, or the Dynamic Analyzer ADB integration module (tests_common.py). The independent assessment scores this CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the 9.8 in the input because API-key authentication is enforced and the ADB path requires an active Android emulator or device. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.71% (52nd percentile); MobSF is typically deployed internally, which reduces remote unauthenticated exposure.
Command injection in Microsoft OneNote allows an unauthenticated remote attacker to execute code when a victim opens a specially crafted OneNote document. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise 16.0.1 per EUVD, with user interaction being the primary exploitation barrier. No public exploit was identified at time of analysis, and Microsoft has published an advisory and update path via the MSRC update guide.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in Windows Update enables an attacker who already holds a low-privileged local session to elevate to higher privileges by injecting special command elements into data processed by the Windows Update servicing component (CWE-77 command injection). This affects multiple Windows 11 releases (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core, up to the fixed builds enumerated in Microsoft’s advisory, with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing local foothold and valid low-privileged credentials, and no public exploit has been identified at time of analysis; vendor patches are available.
Command injection in Visual Studio Code 1.0.0 through 1.141.0 allows an unauthenticated remote attacker to execute arbitrary code in the context of the editor when a developer opens attacker-controlled content such as a malicious workspace, folder, repository, or project configuration file. Exploitation depends on user interaction (a victim must open the crafted project), but is otherwise low-complexity with high confidentiality, integrity, and availability impact; no public exploit code has been identified at the time of analysis. Microsoft has released a vendor fix in Visual Studio Code 1.141.1.
Unauthenticated command injection in Edimax BR-6208AC firmware version 1.32 lets remote attackers execute arbitrary shell commands on the router by submitting crafted input to the tftpsIP parameter of the /goform/formAutoFWupgrade handler, which normally accepts a TFTP server address for firmware fetch operations. The vendor was contacted about the disclosure but did not respond, and the device is an end-of-life product no longer supported by the maintainer, so no vendor-released patch is expected; publicly available exploit code exists (a GitHub proof-of-concept under an IoT vulnerability repository) and the CVSS 4.0 score of 9.3 reflects a full confidentiality, integrity, and availability impact. The vulnerability is not listed in CISA KEV (no confirmed active exploitation reported), but pre-auth reachability of the HTTP management interface - particularly if WAN administration is enabled - makes this a high-priority exposure for anyone still running the device.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Command injection in h-ui v0.0.25 and earlier allows an authenticated administrator to execute arbitrary OS commands as root by supplying shell metacharacters in the 'listen' configuration field of the administrative API. Because the application builds nftables/iptables rule strings with fmt.Sprintf and runs them through bash -c with root privileges, a successful injection yields full host compromise with high confidentiality, integrity, and availability impact. Exploitation requires valid administrative credentials plus the ability to set the listen field, so realistic risk concentrates on multi-operator or weakly-secured panels; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch has been identified.
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.002) lets any WordPress user granted the plugin-defined wppa_upload capability execute arbitrary operating-system commands as the web-server user, achieving full server-side code execution where ImageMagick is the active image backend. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is reachable through the update-photo AJAX action's value parameter, and no public exploit code was identified at time of analysis; the bug is not in CISA KEV. Because wppa_upload is a plugin-level privilege that administrators can delegate to lower-privileged roles, the effective attacker pool can extend well beyond site administrators on misconfigured sites.
Unauthenticated OS command injection in the D-Link DIR-868L router running firmware 2.01b05 lets remote attackers execute arbitrary shell commands on the device by sending a crafted SOAPACTION argument to the HNAP handler exposed through /htdocs/cgibin. The flaw is remotely reachable with no credentials, no user interaction, and no non-default configuration required (CVSS v4.0 base 9.3, assessed v3.1 as AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), so any installation exposing the HNAP management interface is at risk; LAN-only deployments are largely confined to local-network exploitation, while devices with WAN-side remote management enabled are directly attackable from the internet. Publicly available exploit code exists (a detailed advisory and PoC are published on GitHub), which raises the practical urgency, though active exploitation is not confirmed by CISA KEV, and the product is an end-of-life model for which no vendor-released patch has been identified.
Command injection in MobSF v4.5.2 allows an attacker with access to the instance-and, for the /api/v1/scan path, a valid MobSF REST API key-to execute arbitrary shell commands via the /download_data/ endpoint, the /api/v1/scan REST API, or the Dynamic Analyzer ADB integration module (tests_common.py). The independent assessment scores this CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the 9.8 in the input because API-key authentication is enforced and the ADB path requires an active Android emulator or device. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.71% (52nd percentile); MobSF is typically deployed internally, which reduces remote unauthenticated exposure.
Command injection in Microsoft OneNote allows an unauthenticated remote attacker to execute code when a victim opens a specially crafted OneNote document. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise 16.0.1 per EUVD, with user interaction being the primary exploitation barrier. No public exploit was identified at time of analysis, and Microsoft has published an advisory and update path via the MSRC update guide.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in Windows Update enables an attacker who already holds a low-privileged local session to elevate to higher privileges by injecting special command elements into data processed by the Windows Update servicing component (CWE-77 command injection). This affects multiple Windows 11 releases (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core, up to the fixed builds enumerated in Microsoft’s advisory, with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing local foothold and valid low-privileged credentials, and no public exploit has been identified at time of analysis; vendor patches are available.
Command injection in Visual Studio Code 1.0.0 through 1.141.0 allows an unauthenticated remote attacker to execute arbitrary code in the context of the editor when a developer opens attacker-controlled content such as a malicious workspace, folder, repository, or project configuration file. Exploitation depends on user interaction (a victim must open the crafted project), but is otherwise low-complexity with high confidentiality, integrity, and availability impact; no public exploit code has been identified at the time of analysis. Microsoft has released a vendor fix in Visual Studio Code 1.141.1.
Unauthenticated command injection in Edimax BR-6208AC firmware version 1.32 lets remote attackers execute arbitrary shell commands on the router by submitting crafted input to the tftpsIP parameter of the /goform/formAutoFWupgrade handler, which normally accepts a TFTP server address for firmware fetch operations. The vendor was contacted about the disclosure but did not respond, and the device is an end-of-life product no longer supported by the maintainer, so no vendor-released patch is expected; publicly available exploit code exists (a GitHub proof-of-concept under an IoT vulnerability repository) and the CVSS 4.0 score of 9.3 reflects a full confidentiality, integrity, and availability impact. The vulnerability is not listed in CISA KEV (no confirmed active exploitation reported), but pre-auth reachability of the HTTP management interface - particularly if WAN administration is enabled - makes this a high-priority exposure for anyone still running the device.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Command injection in h-ui v0.0.25 and earlier allows an authenticated administrator to execute arbitrary OS commands as root by supplying shell metacharacters in the 'listen' configuration field of the administrative API. Because the application builds nftables/iptables rule strings with fmt.Sprintf and runs them through bash -c with root privileges, a successful injection yields full host compromise with high confidentiality, integrity, and availability impact. Exploitation requires valid administrative credentials plus the ability to set the listen field, so realistic risk concentrates on multi-operator or weakly-secured panels; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch has been identified.