Monthly
Unauthenticated remote code execution in WeRSS (we-mp-rss) through 1.5.3 allows any attacker who can reach the public GET /rss/{feed_id} endpoint to run arbitrary OS commands as the service account. The flaw is a server-side template injection (CWE-95) in the template parser: by supplying a non-built-in ext value together with a {{=expression}} template, an attacker uses object-subclass traversal to bypass the eval denylist and reach command execution, with no authentication, user interaction, or non-default configuration required. Reported CVSS is 9.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N) and our independent assessment confirms remote, unauthenticated exploitation with high confidentiality, integrity and availability impact, rating this a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code was identified at time of analysis, though a public technical writeup of the exploitation chain and a VulnCheck advisory are referenced.
Python code injection in SGLang 0.5.10 through 0.5.22 allows unauthenticated remote attackers to escape an eval() sandbox in the _evaluate_filter() helper and execute arbitrary Python in the scheduler process. Exploitation is strongly gated: the optional debug dumper server must be explicitly enabled by setting the DUMPER_SERVER_PORT environment variable, which is what exposes the unauthenticated /dumper/configure endpoint; default deployments do not enable it. Once the endpoint is reachable, a crafted filter expression is stored and runs on the next forward pass, giving full code execution with high confidentiality, integrity, and availability impact; no vendor-released patch has been identified at time of analysis, and no public exploit code was identified at time of analysis.
Command injection in Dokku before 0.38.25 allows a user with authenticated app-level Dokku access and remote SSH access to store shell-substitution payloads through the docker-options plugin, and also via dokku run -e/--env values and --ttl-seconds; on the next build, deploy, or run, Bash eval interprets the stored value and executes arbitrary commands as the dokku OS user. Exploitation is privilege-gated, requiring valid app-level credentials and SSH access rather than being remote-unauthenticated, and no public exploit was identified at time of analysis despite the CVSS 9.0 severity.
Eval injection in NVIDIA Isaac Lab allows a local attacker who can supply crafted input - such as a malicious experiment configuration, task/environment definition, or command-line parameter - to achieve arbitrary code execution, information disclosure, data tampering, and denial of service once a user opens, loads, or runs the content. The flaw is rated CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: no privileges are required (PR:N) but the victim must interact with the malicious input (UI:R), the attack path is local (AV:L), and impact is scoped to the invoking user (S:U), so no privilege escalation is implied. The CPE entry is a wildcard with no version boundary and no fixed version is published in the available data, so all Isaac Lab releases should be treated as potentially affected; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Authenticated low-privilege tenant users of iFlytek Astron Agent prior to 1.1.2 can run arbitrary Python as root inside the core-workflow container by submitting a workflow Code node, because the shipped default configuration routes dynamic code execution to an unsandboxed LocalExecutor that exposes the full set of Python builtins. From that foothold the attacker can read shared service and database credentials and use them to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services (CVSS 9.9, scope-changed, CWE-95). Exploitation requires a valid tenant account plus the ability to create or run a workflow containing a Code node; no public exploit identified at time of analysis, and the vendor-released patch is version 1.1.2.
Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access.
Arbitrary PHP code execution on the scanning host is possible with PHPCSUtils versions 1.0.0-alpha1 through 1.2.2, because the abstract sniff helper AbstractArrayDeclarationSniff::getActualArrayKey() resolves array-key values through eval() instead of a safe parser. Exploitation requires a host to run PHP_CodeSniffer over attacker-supplied PHP source with a sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey() - most notably PHPCSExtra's Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes - which is exactly the situation in CI pipelines that lint untrusted pull requests or on developer machines reviewing third-party code; the crafted key 'system'('id') is evaluated during the scan. The CVSS 3.1 vector scores this 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating no privileges are required but that the vector is local and needs a person or pipeline to actively invoke the scan; no public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.2.3.
Arbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticated, remote attacker run attacker-controlled code inside the hMailServer service process with the service account's privileges by sending a password containing a backslash immediately followed by an apostrophe in any SMTP AUTH, POP3, or IMAP logon that names an existing active account. The flaw is only reachable in a non-default configuration - event scripting enabled (off by default), the script language set to JScript (default is the unaffected VBScript), and a relevant handler (OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed) defined - and equivalent paths exist through a malicious remote POP3 server's message UID or a malicious remote SMTP server's rejection reply. The vendor's CVSS of 9.8/AV:N/AC:L understates the practical barrier because it does not model those required non-default settings; our assessed vector is AV:N/AC:H/PR:N/UI:N, no public exploit has been identified at time of analysis, and the vendor-released patch is version 6.3.4.
MONAI through 1.6.0 lets a user who can supply or tamper with a bundle's metadata achieve code execution by abusing an eval()-based sandbox in _get_fake_spatial_shape() (monai/bundle/scripts.py). The vulnerable function screens shape expressions with a helper that walks the AST and only rejects ast.Name nodes outside the 'p'/'n' allowlist, so payloads assembled purely from constants and attribute, subscript, or call nodes - such as "(1).__class__.__bases__[0].__subclasses__()" - pass validation and then reach eval(), enabling object-introspection chains that escape to arbitrary code execution. The path is reachable through the non-default bundle 'verify_net_in_out' CLI verification flow (_get_real_input_data / verify_net_in_out), so exploitation is limited to authenticated local users (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, CVA:H) who run that verification on an untrusted or modified bundle; default MONAI workflows that never verify untrusted bundles are not exposed, and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution in WeRSS (we-mp-rss) through 1.5.3 allows any attacker who can reach the public GET /rss/{feed_id} endpoint to run arbitrary OS commands as the service account. The flaw is a server-side template injection (CWE-95) in the template parser: by supplying a non-built-in ext value together with a {{=expression}} template, an attacker uses object-subclass traversal to bypass the eval denylist and reach command execution, with no authentication, user interaction, or non-default configuration required. Reported CVSS is 9.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N) and our independent assessment confirms remote, unauthenticated exploitation with high confidentiality, integrity and availability impact, rating this a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code was identified at time of analysis, though a public technical writeup of the exploitation chain and a VulnCheck advisory are referenced.
Python code injection in SGLang 0.5.10 through 0.5.22 allows unauthenticated remote attackers to escape an eval() sandbox in the _evaluate_filter() helper and execute arbitrary Python in the scheduler process. Exploitation is strongly gated: the optional debug dumper server must be explicitly enabled by setting the DUMPER_SERVER_PORT environment variable, which is what exposes the unauthenticated /dumper/configure endpoint; default deployments do not enable it. Once the endpoint is reachable, a crafted filter expression is stored and runs on the next forward pass, giving full code execution with high confidentiality, integrity, and availability impact; no vendor-released patch has been identified at time of analysis, and no public exploit code was identified at time of analysis.
Command injection in Dokku before 0.38.25 allows a user with authenticated app-level Dokku access and remote SSH access to store shell-substitution payloads through the docker-options plugin, and also via dokku run -e/--env values and --ttl-seconds; on the next build, deploy, or run, Bash eval interprets the stored value and executes arbitrary commands as the dokku OS user. Exploitation is privilege-gated, requiring valid app-level credentials and SSH access rather than being remote-unauthenticated, and no public exploit was identified at time of analysis despite the CVSS 9.0 severity.
Eval injection in NVIDIA Isaac Lab allows a local attacker who can supply crafted input - such as a malicious experiment configuration, task/environment definition, or command-line parameter - to achieve arbitrary code execution, information disclosure, data tampering, and denial of service once a user opens, loads, or runs the content. The flaw is rated CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: no privileges are required (PR:N) but the victim must interact with the malicious input (UI:R), the attack path is local (AV:L), and impact is scoped to the invoking user (S:U), so no privilege escalation is implied. The CPE entry is a wildcard with no version boundary and no fixed version is published in the available data, so all Isaac Lab releases should be treated as potentially affected; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Authenticated low-privilege tenant users of iFlytek Astron Agent prior to 1.1.2 can run arbitrary Python as root inside the core-workflow container by submitting a workflow Code node, because the shipped default configuration routes dynamic code execution to an unsandboxed LocalExecutor that exposes the full set of Python builtins. From that foothold the attacker can read shared service and database credentials and use them to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services (CVSS 9.9, scope-changed, CWE-95). Exploitation requires a valid tenant account plus the ability to create or run a workflow containing a Code node; no public exploit identified at time of analysis, and the vendor-released patch is version 1.1.2.
Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access.
Arbitrary PHP code execution on the scanning host is possible with PHPCSUtils versions 1.0.0-alpha1 through 1.2.2, because the abstract sniff helper AbstractArrayDeclarationSniff::getActualArrayKey() resolves array-key values through eval() instead of a safe parser. Exploitation requires a host to run PHP_CodeSniffer over attacker-supplied PHP source with a sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey() - most notably PHPCSExtra's Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes - which is exactly the situation in CI pipelines that lint untrusted pull requests or on developer machines reviewing third-party code; the crafted key 'system'('id') is evaluated during the scan. The CVSS 3.1 vector scores this 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating no privileges are required but that the vector is local and needs a person or pipeline to actively invoke the scan; no public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.2.3.
Arbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticated, remote attacker run attacker-controlled code inside the hMailServer service process with the service account's privileges by sending a password containing a backslash immediately followed by an apostrophe in any SMTP AUTH, POP3, or IMAP logon that names an existing active account. The flaw is only reachable in a non-default configuration - event scripting enabled (off by default), the script language set to JScript (default is the unaffected VBScript), and a relevant handler (OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed) defined - and equivalent paths exist through a malicious remote POP3 server's message UID or a malicious remote SMTP server's rejection reply. The vendor's CVSS of 9.8/AV:N/AC:L understates the practical barrier because it does not model those required non-default settings; our assessed vector is AV:N/AC:H/PR:N/UI:N, no public exploit has been identified at time of analysis, and the vendor-released patch is version 6.3.4.
MONAI through 1.6.0 lets a user who can supply or tamper with a bundle's metadata achieve code execution by abusing an eval()-based sandbox in _get_fake_spatial_shape() (monai/bundle/scripts.py). The vulnerable function screens shape expressions with a helper that walks the AST and only rejects ast.Name nodes outside the 'p'/'n' allowlist, so payloads assembled purely from constants and attribute, subscript, or call nodes - such as "(1).__class__.__bases__[0].__subclasses__()" - pass validation and then reach eval(), enabling object-introspection chains that escape to arbitrary code execution. The path is reachable through the non-default bundle 'verify_net_in_out' CLI verification flow (_get_real_input_data / verify_net_in_out), so exploitation is limited to authenticated local users (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, CVA:H) who run that verification on an untrusted or modified bundle; default MONAI workflows that never verify untrusted bundles are not exposed, and no public exploit code was identified at time of analysis.