Unpatched Critical/High Flaws Dominate Amid Active PHP and Edge-Device RCE

Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.

Use-after-free in PHP's per-request global state handling lets unauthenticated remote attackers achieve arbitrary code execution against persistent workers that reuse memory across requests - PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. Exploitation is high complexity (CVSS:4.0 9.2 with AC:H/AT:P): it needs a 'producer' operation that leaves request-owned state published after an interruption such as a fatal error, uncaught exception, timeout or OOM, followed by a later request to the same worker whose early operation consumes the stale pointer before normal initialization resets it. The vendor documents a confirmed mod_php RCE path (PHP 8.5 with fatal_error_backtraces enabled) and a confirmed session upload progress lifecycle; a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none, and the priority decision is act_now because affected PHP branches are patched and technical impact is total.

Unauthenticated remote code execution in PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12 arises when an attacker drives a worker into an out-of-memory condition while request memory is only partially initialized, leaving freed/reused structures that the request shutdown path then processes. Exploitation is confirmed practical against Apache mod_php with default input and memory limits in normal multi-worker prefork setups, and publicly available exploit code exists; the vendor and distros (Ubuntu USN-8948-1) have released fixed builds. With a 9.2 CVSS score, a public PoC, and an act_now priority decision, this warrants immediate patching, though reliability varies with build, extensions, frontend behavior and allocator layout, and no complete PHP-FPM exploit has been demonstrated.

Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vulnerable compilation path, potentially allowing an unauthenticated network attacker to run arbitrary code on the GitLab server. The flaw is an integer overflow (CWE-190) affecting a broad version range from 7.0 through 19.5.1; exploitation is conditional on reaching the relevant regex-compilation functionality, and our assessment rates attack complexity as high despite the advisory CVSS of 10.0. Publicly available exploit code exists, but no CISA KEV designation is indicated in the provided data.

Unauthenticated OS command injection in Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 lets remote attackers execute arbitrary commands as root by forging an IP-FROM: 127.0.0.1 header to bypass login and supplying a crafted file_id parameter to /protocol.csp?opt=ovpn_file with type=del. Publicly available exploit code exists, and the VulnCheck advisory plus a public write-up describe the flaw; no CISA KEV confirmation was provided. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making this a high-priority exposure when the management interface is reachable.

Authentication bypass in the asVereinbase WordPress plugin before 1.1.8 allows unauthenticated remote attackers to log in as any user, including an administrator, because the plugin accepts an empty stored password or second-factor value as a match. Affected are WordPress sites running the plugin at versions below 1.1.8; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no special configuration or user interaction is required. A public PoC reference exists but is not verified as working exploit code, and the EPSS score is low at 0.19% (8th percentile) even though the vuln.today decision label is act_now, so the severity and priority signals are split and should be read together.

Unauthenticated remote code execution in PiFlow 2.0.0-2.0.1 allows network attackers to drive the DeepAgents chat agent through POST /chat or POST /chat/stream and invoke the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list. Publicly available exploit code exists, and successful exploitation can expose LLM API keys and database credentials present in the process environment. This is a genuine high-priority risk for exposed deployments where the chat agent feature is enabled and reachable, with no CISA KEV entry indicated in the supplied data.

Stack-based buffer overflow in the TOTOLINK EX200 Wi-Fi range extender (firmware 5.2.3c.7200) lets remote, unauthenticated attackers crash or potentially execute code on the device by sending a crafted HTTP request to the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi with an oversized Comment parameter. Publicly available exploit code exists (a GitHub proof-of-concept write-up is linked from the VulDB record), and the CVSS 4.0 base score of 9.3 reflects full confidentiality, integrity and availability impact with PR:N/UI:N/AC:L - no credentials or user interaction required. The practical constraint is reachability: the flaw is only exploitable if the extender's web management interface is exposed to the attacker, so the real-world risk is highest on devices whose administrative UI is reachable from the WAN or from an untrusted network segment rather than the typical isolated LAN-side deployment.