Code Injection
Monthly
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. The vulnerability is confined to the legacy expression engine (isolated-vm-bridge.ts and ExpressionBuilder.ts); the vm expression engine is unaffected. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 is achievable by any authenticated user who can author workflow expressions. The root cause is a sandbox escape in the PrototypeSanitizer AST hook: because the sanitizer references itself via dynamically scoped `this`, a crafted class field named `__sanitize` rebinds the sanitizer function, after which the expression freely invokes the JavaScript `Function()` constructor and executes arbitrary Node.js code on the backend. No public exploit has been identified at time of analysis, but the Function constructor escape technique is well-documented in the JavaScript security research community, lowering the barrier to independent rediscovery.
Local privilege escalation in Auth0 AD/LDAP Connector versions up to and including 6.5.0 allows a low-privileged local user to modify the connector's configuration file due to improper permission handling during service startup processing. When the connector service restarts - whether scheduled, OS-triggered, or manually - the tampered configuration value is evaluated, resulting in code execution with the privileges of the service account running the connector. No public exploit code has been identified at time of analysis, but the straightforward local exploitation path (AC:L) and high impact to a service that often holds privileged Active Directory credentials make this a meaningful risk in environments running on-premise Auth0 connector deployments.
Eval injection (CWE-95) in Adobe ColdFusion 2023 (≤Update 23) and ColdFusion 2025 (≤Update 12) enables unauthenticated, network-based arbitrary code execution without user interaction. User-supplied input reaching a dynamic code evaluation function is processed without sanitization, allowing injected CFML or Java expressions to execute server-side as the application user. The CVSS scope-change metric (S:C) indicates the impact can extend beyond the ColdFusion process itself; Adobe PSIRT issued formal advisory APSB26-119. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Adobe ColdFusion 2023 (update ≤23) and ColdFusion 2025 (update ≤12) allows a low-privileged, authenticated attacker to inject directives into dynamically evaluated code (CWE-95, 'Eval Injection') and execute arbitrary code in the context of the current user without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable, low-complexity flaw with a scope change, meaning code executes beyond the initially authorized security context. No public exploit is identified at time of analysis, but ColdFusion RCE flaws are historically high-value targets and are frequently weaponized quickly after disclosure.
Code injection in Microsoft Remote Desktop Client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) enables an unauthenticated network attacker to execute arbitrary code on the connecting client machine. The vulnerability is triggered when a user connects to an attacker-controlled RDP server that delivers malicious server-side responses exploiting CWE-94 code generation flaws in the client. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Microsoft Dynamics 365 Customer Engagement V9.1 (versions below 9.1.0048.0004) is achievable by authenticated network attackers through a code injection vulnerability (CWE-94). An attacker holding a low-privilege account can submit a crafted request that causes the server to generate and execute attacker-controlled code, resulting in full confidentiality, integrity, and availability compromise of the affected instance. Microsoft has released a patch via the MSRC update guide, and no public exploit code has been identified at time of analysis.
Code injection in Adobe Animate allows a low-privileged attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. Both the 2023 and 2024 major release lines are affected, covering all versions up to and including 23.0.16 and 24.0.14 respectively. SSVC assessment indicates no current exploitation activity, but the technical impact is rated total due to full C/I/A compromise and a scope change beyond the vulnerable component.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.
Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. No public exploit has been identified at time of analysis, though Hitachi has released fixed maintenance versions.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.
Bilibili Desktop through v1.18.0 achieves full system command execution and credential theft by combining two design-level failures: TLS certificate verification is disabled process-wide (accepting any certificate, including attacker-controlled), and remote JavaScript configuration is fetched and executed without code-signing or integrity validation. Any on-path network adversary - via rogue Wi-Fi, ARP spoofing, or a compromised gateway - can intercept these fetches, present a forged certificate, and inject arbitrary JavaScript that runs in the app's renderer context with direct access to the privileged IPC bridge, enabling OS-level command execution or session-token exfiltration. A public proof-of-concept repository exists (GitHub: LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce); no vendor-released patch has been identified at time of analysis.
Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration.
CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. The vendor has released patches in versions 12.60.0 and 13.10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation to root/SYSTEM in IXON VPN Client before 1.4.7 lets an attacker inject arbitrary configuration directives via a CRLF (improper neutralization, CWE-93) flaw: the client's local configuration interface accepts changes without authenticating or verifying the requester's origin, writes those values to a file, and a privileged subprocess later consumes them. By embedding line-ending sequences the attacker smuggles additional directives that run with elevated privileges. Because the malicious config persists across client restarts and OS reboots while the VPN keeps functioning normally, the compromise is stealthy with no user-visible change. No public exploit identified at time of analysis; no CISA KEV listing.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
Remote code execution in LaVague 0.2.35, an LLM-driven web-automation agent framework, arises because PythonFromMarkdownExtractor.extract_as_object evaluates language-model output that is derived from attacker-influenced web page content. An attacker who controls or poisons a page the agent visits can use indirect prompt injection to coerce the model into emitting Python that is then eval'd and executed on the operator's host with no human review. Reported by VulnCheck (CWE-94); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted git repository containing a malicious `.aider.conf.yml` configuration file. The tool unconditionally reads this file at startup and passes `test-cmd` and `lint-cmd` values directly to Python's `subprocess` with `shell=True`, with no user confirmation, no LLM involvement, and no API key required. Confirmed present on version 0.86.2 and the 0.86.3.dev main branch per the VulnCheck advisory; no vendor-released patch has been identified at time of analysis, and no public exploit code has been identified beyond the mechanism documented in the public GitHub issue.
Arbitrary command execution in goose v1.37.0 allows an attacker to embed shell commands inside recipe stdio extension definitions and retry.check fields that are silently executed under the victim user's OS privileges. The built-in recipe security scanner does not inspect these fields, providing a false safety guarantee and a clear bypass path. No public exploit is identified at time of analysis, but exploitation is low-complexity once a target user loads a malicious recipe.
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Remote code execution in DocsGPT 0.15.0 and earlier arises from its custom-prompt feature, which passes user-supplied prompt content into Jinja template rendering with no sanitization or sandboxing. An unauthenticated attacker can submit crafted template expressions to achieve server-side template injection (SSTI) that escalates to full RCE on the host running the chatbot backend. VulDB has published an entry and a public writeup/PoC repository exists, though the flaw is not listed in CISA KEV and SSVC records exploitation status as 'none'.
Remote code execution in esoTalk v1.0.0g4 arises from configuration comment injection that allows attacker-controlled input reaching ETMemberModel, ETMemberController and ET.class.php to be persisted into a PHP configuration file and subsequently interpreted as code (CWE-94). Documented only in a third-party Notion writeup with no public exploit tool; EPSS is low at 0.19% (9th percentile). No public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary OS command execution in GeoNetwork before 4.4.12 and 4.2.17 arises because the Saxon XSLT processor that renders formatters runs without FEATURE_SECURE_PROCESSING and with Java extension functions (ALLOW_EXTERNAL_FUNCTIONS) enabled. A user privileged enough to upload a formatter can supply a malicious .xsl stylesheet that invokes java.lang.Runtime.exec() or java.lang.ProcessBuilder, running commands as the GeoNetwork process user. No public exploit is identified at time of analysis, though the vendor GHSA advisory and public reporting describe the technique in detail.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the intended host to userinfo and redirect the parsed authority to an attacker-controlled hostname, bypassing downstream re-validation because both fast-uri and Node.js's built-in URL parser silently accept the malformed output as well-formed. Applications in the Fastify ecosystem that build URIs from parts — passing untrusted data into the port field of a URI object through serialize, normalize, or equal — on fast-uri versions before 2.4.6, 3.1.7, or 4.1.4 are affected. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; vendor-released patches are available across all three active release lines.
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat.
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis.
Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 through 3.2.x when pipeline() is used over aggregate cluster or replication connections. Because AbstractAggregateConnection::write() re-splits an already-serialized RESP buffer on CRLF instead of respecting RESP length prefixes, attacker-controlled keys or values containing carriage-return/line-feed bytes are re-parsed as additional Redis commands, enabling shard-wide cache deletion, targeted data reads/writes, or node disruption on clusters and denial-of-service on replication setups. Fixed in 3.3.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by supplying element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029). The QName_exact regex in lib/grammar.js is compiled with JavaScript's multiline flag, causing the ^ and $ anchors to match per-line rather than over the full string - a name whose first line is a valid QName passes validation while subsequent lines carry injected markup, bypassing both the default serialization path and requireWellFormed: true. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no prerequisites reflects the high-integrity impact when an application passes attacker-controlled input to createElementNS, createAttributeNS, createDocumentType, or createAttribute.
XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely close the <!DOCTYPE ...> declaration and inject arbitrary sibling markup into serialized XML output. The gap exists because XMLSerializer.serializeToString() under requireWellFormed: true validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim, violating the XML Name production consistently enforced for the other fields. Affected packages are @xmldom/xmldom prior to 0.8.15 and 0.9.12, and all versions of the legacy unscoped xmldom (0.6.0 and earlier) for which no vendor-released fix will be issued; no public exploit code or CISA KEV listing has been identified at time of analysis.
XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during serialization, enabling injection of arbitrary attributes — including event handlers — into browser-consumed XML/HTML output. Applications using @xmldom/xmldom before 0.8.14 or 0.9.11, or any version of the legacy xmldom package (≤0.6.0), are affected when attacker-controlled data reaches Element.setAttribute() and the result is serialized via XMLSerializer.serializeToString(). No public exploit is identified at time of analysis, but the vulnerability class is well-understood and the injection mechanism is straightforward for any attacker who can influence attribute name input.
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allows an authenticated user with limited privileges to execute arbitrary code at root privilege level, achieving full appliance compromise. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms that exploitation requires only local authenticated access with low-level credentials and no user interaction, with the resulting code execution crossing a privilege boundary into a root context. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote code execution in Klemsan KIO (Klemsan Internet Objects) versions prior to v1.9 allows attackers to inject and execute arbitrary code against the network-facing application. The flaw, reported by TR-CERT (Turkey's national CSIRT), carries a CVSS 9.8 and requires no authentication or user interaction, giving full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial attack profile makes it a high-priority patch.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Remote code execution in lllyasviel Fooocus 2.1.854 through 2.5.5 allows any user who can upload an image to execute arbitrary Python code on the hosting server. The vulnerability stems from the `get_list` function in `modules/meta_parser.py` passing a `styles` field extracted from image EXIF metadata directly to Python's `eval()` without sanitization or sandboxing. A detailed technical writeup exists at mrbruh.com/fooocus and the vulnerable code path is publicly visible in the repository; no confirmed active exploitation has been identified at time of analysis, and EPSS stands at 0.24% (15th percentile).
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests.
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious repository to exfiltrate arbitrary files outside the repository boundary through submodule metadata. When Repository::submodules() processes a worktree .gitmodules that is a symlink, std::fs::read() transparently follows it to an attacker-chosen target, and the resulting bytes are parsed as submodule configuration, exposing attacker-controlled name, path, and url values. A proof-of-concept is publicly confirmed in the GHSA advisory; no CISA KEV listing was present at time of analysis.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. No public exploit exists and no active exploitation is confirmed; EPSS stands at 0.18% (7th percentile), reflecting the niche attack surface.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.
Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting sandbox and execute arbitrary code, gaining more access to the instance than intended. ServiceNow rates this maximum severity (CVSS 4.0 base 10.0) and has patched hosted instances while shipping fixes to self-hosted and partner deployments across the Zurich, Australia, Xanadu, and Yokohama release families. No public exploit identified at time of analysis and ServiceNow states it is not aware of malicious exploitation, though the unauthenticated, network-reachable nature makes prompt patching essential.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Safe Import filter, which fails to mark the shareTemplate relation as dangerous. An attacker distributes a crafted export archive containing a malicious EJS template; when a user imports it and subsequently publishes the note, the public share renderer passes raw EJS content to ejs.render() in the server's Node.js process, executing attacker-controlled JavaScript with full access to the filesystem, network, and Node.js runtime. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed public advisory significantly lowers the barrier to exploit development.
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-supplied plugin to run in the host process at import time. Because the plugin signature policy defaulted to WARN, an unsigned or unverifiable non-built-in plugin was compiled and executed before the runtime sandbox was installed, with only a bypassable AST denylist as a gate. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw yields full code execution as the invoking user once a malicious plugin is loaded.
Output-encoding text injection in jahlives openssl_encrypt before 1.4.9 lets an attacker forge the desktop GUI's irreversible-removal confirmation dialog. By embedding bidirectional-override and line-separator control characters in the recovery-slot identifier of a crafted encrypted file, an attacker can rewrite the warning text a victim sees, tricking them into approving destructive file-removal operations. No public exploit is identified at time of analysis, and the record is not in CISA KEV; the published 9.3 CVSS 4.0 rating appears inflated relative to the spoofing-only mechanism.
Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.
Privilege escalation to network-wide remote code execution in the Smush WordPress plugin (versions 3.22.1 through 4.3.2) allows any authenticated single-site administrator on a WordPress multisite network to execute arbitrary code across all sites in that network. The flaw arises because the plugin's network-wide configuration interface fails to restrict access to network administrators only, permitting lower-privileged site admins to reach settings with cross-network impact. No public exploit has been identified and SSVC confirms no active exploitation, though the technical impact is rated 'total' given successful exploitation grants full control over the entire multisite infrastructure.
Unauthenticated remote code execution affects BerriAI litellm through version 1.82.4, where the /prompts/test endpoint renders the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment. Because no authentication is required and templates are evaluated server-side, an attacker can inject a Jinja2 payload that escapes into Python and runs arbitrary OS commands on the proxy host. No public exploit identified at time of analysis and the EPSS probability is low (0.25%), but the CVSS is 9.8 and a third-party technical write-up is referenced.
Remote code execution in Bilibili Desktop v1.17.9 (an Electron-based client for the Bilibili video platform) stems from the bili-inject.js and bili-bridge.js components exposing privileged IPC/native functionality to renderer content without validating message origin. Per the published GitHub advisories, attacker-controlled web content loaded or rendered in the app can invoke these bridge APIs to run arbitrary code on the host. Rated CVSS 9.8 by MITRE, but EPSS is low (0.26%, 17th percentile); no public exploit is independently confirmed and it is not in CISA KEV.
Remote code execution in Agno (the Python AI-agent framework) up to and including 2.5.8 lets attackers run arbitrary code and OS commands on the host by way of prompt injection. The PythonTools and ShellTools components feed LLM-generated arguments straight into exec(), runpy.run_path(), and subprocess.run() without sanitization, so an attacker who plants malicious instructions in any content the agent ingests (a web page, a document) can hijack execution. CVSS is rated 9.8 and the CVSS vector marks it unauthenticated/network, but no public exploit is identified at time of analysis and EPSS is low at 0.60% (46th percentile).
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Code injection in whichllm's run and snippet CLI commands allows a network-positioned attacker who controls a HuggingFace repository to achieve full arbitrary code execution on any victim's machine by publishing a repository containing a crafted GGUF filename with Python metacharacters. The script generation function in cli.py interpolates the HuggingFace Hub API siblings rfilename field directly into dynamically generated Python source without escaping, enabling a string-literal breakout that fires injected code before any model download occurs. No active exploitation is confirmed in CISA KEV and no public proof-of-concept is referenced; vendor-released patch v0.5.16 is available and directly remediates the root cause.
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. No public exploit code or active exploitation has been identified at time of analysis, but the primitive (credential-bearing lateral identity escalation at the API gateway layer) is high-value in multi-tenant or zero-trust deployments.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
Persistent root escalation in Admin By Request (ABR) on macOS allows a low-privileged local user to inject malicious entries into the sudoers file during an ABR privilege elevation session, achieving root access that outlasts the session itself. The flaw is tracked under advisory ABR-MAC-26-02 and was flagged by Singapore's Cyber Security Agency (CSA). No public exploit or CISA KEV listing is present at time of analysis, but the nature of the impact - permanent, session-independent privilege escalation - makes this high priority for any enterprise fleet running ABR on macOS.
Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding the author role or higher to invoke arbitrary PHP functions on the server by submitting a crafted display callback that bypasses the plugin's blocked-function comparison logic. Exploitation is limited to sites where restricted display-callback mode is active - the automatic default on installations first deployed on Pods versions predating 3.1 - meaning a large subset of long-running Pods deployments are in-scope. A public exploit exists per WPScan reporting, though EPSS at 0.21% (11th percentile) indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
Code injection through CorvusSKK's embedded Lua scripting engine permits arbitrary code execution on Windows systems running versions prior to 3.3.4. Vendor release notes for the fixed version explicitly confirm that dangerous Lua engine features were disabled to address this vulnerability (CWE-94). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though CISA's SSVC framework rates the technical impact as total, reflecting full compromise of confidentiality, integrity, and availability on affected hosts.
Remote command execution in JeecgBoot v3.9.2 lets attackers run arbitrary OS commands through the AI Flow module's CodeNode component, which executes user-supplied Groovy scripts. The SecurityCheck class enforces a blacklist to block dangerous calls, but Groovy's dynamic dispatch allows the blacklist to be fully bypassed via string concatenation and reflection, yielding full code execution. No public exploit is identified at time of analysis, and EPSS is low (0.22%, 13th percentile), consistent with a newly disclosed issue rather than mass exploitation.
Remote code execution in SimpleX Chat before v6.5 is claimed via the /Terminal/Notification.hs component, where a crafted payload delivered inside a normal text message is said to execute arbitrary commands with zero user interaction (CWE-94 code injection). If accurate, any user running a vulnerable build could be compromised simply by receiving a message. No public exploit identified at time of analysis and EPSS is low (0.22%, 12th percentile); the claim rests on a single third-party disclosure blog rather than a vendor advisory, so treat the severity as unconfirmed.
Remote code execution in AntFlow V2.0.0 arises because the ActivitiTest.java handler evaluates attacker-supplied JUEL (Java Unified Expression Language) expressions without any input filtering, letting an attacker run arbitrary Java code and operating-system commands on the host. The affected component is described as a front-desk (pre-authentication) endpoint, so exploitation appears to require no valid account. Publicly available exploit code exists via a GitHub write-up, though EPSS remains low (0.17%, 7th percentile) and it is not on CISA KEV.
Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.
Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. The vulnerability is confined to the legacy expression engine (isolated-vm-bridge.ts and ExpressionBuilder.ts); the vm expression engine is unaffected. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 is achievable by any authenticated user who can author workflow expressions. The root cause is a sandbox escape in the PrototypeSanitizer AST hook: because the sanitizer references itself via dynamically scoped `this`, a crafted class field named `__sanitize` rebinds the sanitizer function, after which the expression freely invokes the JavaScript `Function()` constructor and executes arbitrary Node.js code on the backend. No public exploit has been identified at time of analysis, but the Function constructor escape technique is well-documented in the JavaScript security research community, lowering the barrier to independent rediscovery.
Local privilege escalation in Auth0 AD/LDAP Connector versions up to and including 6.5.0 allows a low-privileged local user to modify the connector's configuration file due to improper permission handling during service startup processing. When the connector service restarts - whether scheduled, OS-triggered, or manually - the tampered configuration value is evaluated, resulting in code execution with the privileges of the service account running the connector. No public exploit code has been identified at time of analysis, but the straightforward local exploitation path (AC:L) and high impact to a service that often holds privileged Active Directory credentials make this a meaningful risk in environments running on-premise Auth0 connector deployments.
Eval injection (CWE-95) in Adobe ColdFusion 2023 (≤Update 23) and ColdFusion 2025 (≤Update 12) enables unauthenticated, network-based arbitrary code execution without user interaction. User-supplied input reaching a dynamic code evaluation function is processed without sanitization, allowing injected CFML or Java expressions to execute server-side as the application user. The CVSS scope-change metric (S:C) indicates the impact can extend beyond the ColdFusion process itself; Adobe PSIRT issued formal advisory APSB26-119. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Adobe ColdFusion 2023 (update ≤23) and ColdFusion 2025 (update ≤12) allows a low-privileged, authenticated attacker to inject directives into dynamically evaluated code (CWE-95, 'Eval Injection') and execute arbitrary code in the context of the current user without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable, low-complexity flaw with a scope change, meaning code executes beyond the initially authorized security context. No public exploit is identified at time of analysis, but ColdFusion RCE flaws are historically high-value targets and are frequently weaponized quickly after disclosure.
Code injection in Microsoft Remote Desktop Client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) enables an unauthenticated network attacker to execute arbitrary code on the connecting client machine. The vulnerability is triggered when a user connects to an attacker-controlled RDP server that delivers malicious server-side responses exploiting CWE-94 code generation flaws in the client. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Microsoft Dynamics 365 Customer Engagement V9.1 (versions below 9.1.0048.0004) is achievable by authenticated network attackers through a code injection vulnerability (CWE-94). An attacker holding a low-privilege account can submit a crafted request that causes the server to generate and execute attacker-controlled code, resulting in full confidentiality, integrity, and availability compromise of the affected instance. Microsoft has released a patch via the MSRC update guide, and no public exploit code has been identified at time of analysis.
Code injection in Adobe Animate allows a low-privileged attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. Both the 2023 and 2024 major release lines are affected, covering all versions up to and including 23.0.16 and 24.0.14 respectively. SSVC assessment indicates no current exploitation activity, but the technical impact is rated total due to full C/I/A compromise and a scope change beyond the vulnerable component.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.
Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. No public exploit has been identified at time of analysis, though Hitachi has released fixed maintenance versions.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.
Bilibili Desktop through v1.18.0 achieves full system command execution and credential theft by combining two design-level failures: TLS certificate verification is disabled process-wide (accepting any certificate, including attacker-controlled), and remote JavaScript configuration is fetched and executed without code-signing or integrity validation. Any on-path network adversary - via rogue Wi-Fi, ARP spoofing, or a compromised gateway - can intercept these fetches, present a forged certificate, and inject arbitrary JavaScript that runs in the app's renderer context with direct access to the privileged IPC bridge, enabling OS-level command execution or session-token exfiltration. A public proof-of-concept repository exists (GitHub: LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce); no vendor-released patch has been identified at time of analysis.
Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration.
CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. The vendor has released patches in versions 12.60.0 and 13.10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation to root/SYSTEM in IXON VPN Client before 1.4.7 lets an attacker inject arbitrary configuration directives via a CRLF (improper neutralization, CWE-93) flaw: the client's local configuration interface accepts changes without authenticating or verifying the requester's origin, writes those values to a file, and a privileged subprocess later consumes them. By embedding line-ending sequences the attacker smuggles additional directives that run with elevated privileges. Because the malicious config persists across client restarts and OS reboots while the VPN keeps functioning normally, the compromise is stealthy with no user-visible change. No public exploit identified at time of analysis; no CISA KEV listing.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
Remote code execution in LaVague 0.2.35, an LLM-driven web-automation agent framework, arises because PythonFromMarkdownExtractor.extract_as_object evaluates language-model output that is derived from attacker-influenced web page content. An attacker who controls or poisons a page the agent visits can use indirect prompt injection to coerce the model into emitting Python that is then eval'd and executed on the operator's host with no human review. Reported by VulnCheck (CWE-94); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted git repository containing a malicious `.aider.conf.yml` configuration file. The tool unconditionally reads this file at startup and passes `test-cmd` and `lint-cmd` values directly to Python's `subprocess` with `shell=True`, with no user confirmation, no LLM involvement, and no API key required. Confirmed present on version 0.86.2 and the 0.86.3.dev main branch per the VulnCheck advisory; no vendor-released patch has been identified at time of analysis, and no public exploit code has been identified beyond the mechanism documented in the public GitHub issue.
Arbitrary command execution in goose v1.37.0 allows an attacker to embed shell commands inside recipe stdio extension definitions and retry.check fields that are silently executed under the victim user's OS privileges. The built-in recipe security scanner does not inspect these fields, providing a false safety guarantee and a clear bypass path. No public exploit is identified at time of analysis, but exploitation is low-complexity once a target user loads a malicious recipe.
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Remote code execution in DocsGPT 0.15.0 and earlier arises from its custom-prompt feature, which passes user-supplied prompt content into Jinja template rendering with no sanitization or sandboxing. An unauthenticated attacker can submit crafted template expressions to achieve server-side template injection (SSTI) that escalates to full RCE on the host running the chatbot backend. VulDB has published an entry and a public writeup/PoC repository exists, though the flaw is not listed in CISA KEV and SSVC records exploitation status as 'none'.
Remote code execution in esoTalk v1.0.0g4 arises from configuration comment injection that allows attacker-controlled input reaching ETMemberModel, ETMemberController and ET.class.php to be persisted into a PHP configuration file and subsequently interpreted as code (CWE-94). Documented only in a third-party Notion writeup with no public exploit tool; EPSS is low at 0.19% (9th percentile). No public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary OS command execution in GeoNetwork before 4.4.12 and 4.2.17 arises because the Saxon XSLT processor that renders formatters runs without FEATURE_SECURE_PROCESSING and with Java extension functions (ALLOW_EXTERNAL_FUNCTIONS) enabled. A user privileged enough to upload a formatter can supply a malicious .xsl stylesheet that invokes java.lang.Runtime.exec() or java.lang.ProcessBuilder, running commands as the GeoNetwork process user. No public exploit is identified at time of analysis, though the vendor GHSA advisory and public reporting describe the technique in detail.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the intended host to userinfo and redirect the parsed authority to an attacker-controlled hostname, bypassing downstream re-validation because both fast-uri and Node.js's built-in URL parser silently accept the malformed output as well-formed. Applications in the Fastify ecosystem that build URIs from parts — passing untrusted data into the port field of a URI object through serialize, normalize, or equal — on fast-uri versions before 2.4.6, 3.1.7, or 4.1.4 are affected. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; vendor-released patches are available across all three active release lines.
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat.
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis.
Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 through 3.2.x when pipeline() is used over aggregate cluster or replication connections. Because AbstractAggregateConnection::write() re-splits an already-serialized RESP buffer on CRLF instead of respecting RESP length prefixes, attacker-controlled keys or values containing carriage-return/line-feed bytes are re-parsed as additional Redis commands, enabling shard-wide cache deletion, targeted data reads/writes, or node disruption on clusters and denial-of-service on replication setups. Fixed in 3.3.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by supplying element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029). The QName_exact regex in lib/grammar.js is compiled with JavaScript's multiline flag, causing the ^ and $ anchors to match per-line rather than over the full string - a name whose first line is a valid QName passes validation while subsequent lines carry injected markup, bypassing both the default serialization path and requireWellFormed: true. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no prerequisites reflects the high-integrity impact when an application passes attacker-controlled input to createElementNS, createAttributeNS, createDocumentType, or createAttribute.
XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely close the <!DOCTYPE ...> declaration and inject arbitrary sibling markup into serialized XML output. The gap exists because XMLSerializer.serializeToString() under requireWellFormed: true validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim, violating the XML Name production consistently enforced for the other fields. Affected packages are @xmldom/xmldom prior to 0.8.15 and 0.9.12, and all versions of the legacy unscoped xmldom (0.6.0 and earlier) for which no vendor-released fix will be issued; no public exploit code or CISA KEV listing has been identified at time of analysis.
XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during serialization, enabling injection of arbitrary attributes — including event handlers — into browser-consumed XML/HTML output. Applications using @xmldom/xmldom before 0.8.14 or 0.9.11, or any version of the legacy xmldom package (≤0.6.0), are affected when attacker-controlled data reaches Element.setAttribute() and the result is serialized via XMLSerializer.serializeToString(). No public exploit is identified at time of analysis, but the vulnerability class is well-understood and the injection mechanism is straightforward for any attacker who can influence attribute name input.
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allows an authenticated user with limited privileges to execute arbitrary code at root privilege level, achieving full appliance compromise. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms that exploitation requires only local authenticated access with low-level credentials and no user interaction, with the resulting code execution crossing a privilege boundary into a root context. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote code execution in Klemsan KIO (Klemsan Internet Objects) versions prior to v1.9 allows attackers to inject and execute arbitrary code against the network-facing application. The flaw, reported by TR-CERT (Turkey's national CSIRT), carries a CVSS 9.8 and requires no authentication or user interaction, giving full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial attack profile makes it a high-priority patch.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Remote code execution in lllyasviel Fooocus 2.1.854 through 2.5.5 allows any user who can upload an image to execute arbitrary Python code on the hosting server. The vulnerability stems from the `get_list` function in `modules/meta_parser.py` passing a `styles` field extracted from image EXIF metadata directly to Python's `eval()` without sanitization or sandboxing. A detailed technical writeup exists at mrbruh.com/fooocus and the vulnerable code path is publicly visible in the repository; no confirmed active exploitation has been identified at time of analysis, and EPSS stands at 0.24% (15th percentile).
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests.
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious repository to exfiltrate arbitrary files outside the repository boundary through submodule metadata. When Repository::submodules() processes a worktree .gitmodules that is a symlink, std::fs::read() transparently follows it to an attacker-chosen target, and the resulting bytes are parsed as submodule configuration, exposing attacker-controlled name, path, and url values. A proof-of-concept is publicly confirmed in the GHSA advisory; no CISA KEV listing was present at time of analysis.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. No public exploit exists and no active exploitation is confirmed; EPSS stands at 0.18% (7th percentile), reflecting the niche attack surface.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.
Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting sandbox and execute arbitrary code, gaining more access to the instance than intended. ServiceNow rates this maximum severity (CVSS 4.0 base 10.0) and has patched hosted instances while shipping fixes to self-hosted and partner deployments across the Zurich, Australia, Xanadu, and Yokohama release families. No public exploit identified at time of analysis and ServiceNow states it is not aware of malicious exploitation, though the unauthenticated, network-reachable nature makes prompt patching essential.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Safe Import filter, which fails to mark the shareTemplate relation as dangerous. An attacker distributes a crafted export archive containing a malicious EJS template; when a user imports it and subsequently publishes the note, the public share renderer passes raw EJS content to ejs.render() in the server's Node.js process, executing attacker-controlled JavaScript with full access to the filesystem, network, and Node.js runtime. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed public advisory significantly lowers the barrier to exploit development.
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-supplied plugin to run in the host process at import time. Because the plugin signature policy defaulted to WARN, an unsigned or unverifiable non-built-in plugin was compiled and executed before the runtime sandbox was installed, with only a bypassable AST denylist as a gate. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw yields full code execution as the invoking user once a malicious plugin is loaded.
Output-encoding text injection in jahlives openssl_encrypt before 1.4.9 lets an attacker forge the desktop GUI's irreversible-removal confirmation dialog. By embedding bidirectional-override and line-separator control characters in the recovery-slot identifier of a crafted encrypted file, an attacker can rewrite the warning text a victim sees, tricking them into approving destructive file-removal operations. No public exploit is identified at time of analysis, and the record is not in CISA KEV; the published 9.3 CVSS 4.0 rating appears inflated relative to the spoofing-only mechanism.
Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.
Privilege escalation to network-wide remote code execution in the Smush WordPress plugin (versions 3.22.1 through 4.3.2) allows any authenticated single-site administrator on a WordPress multisite network to execute arbitrary code across all sites in that network. The flaw arises because the plugin's network-wide configuration interface fails to restrict access to network administrators only, permitting lower-privileged site admins to reach settings with cross-network impact. No public exploit has been identified and SSVC confirms no active exploitation, though the technical impact is rated 'total' given successful exploitation grants full control over the entire multisite infrastructure.
Unauthenticated remote code execution affects BerriAI litellm through version 1.82.4, where the /prompts/test endpoint renders the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment. Because no authentication is required and templates are evaluated server-side, an attacker can inject a Jinja2 payload that escapes into Python and runs arbitrary OS commands on the proxy host. No public exploit identified at time of analysis and the EPSS probability is low (0.25%), but the CVSS is 9.8 and a third-party technical write-up is referenced.
Remote code execution in Bilibili Desktop v1.17.9 (an Electron-based client for the Bilibili video platform) stems from the bili-inject.js and bili-bridge.js components exposing privileged IPC/native functionality to renderer content without validating message origin. Per the published GitHub advisories, attacker-controlled web content loaded or rendered in the app can invoke these bridge APIs to run arbitrary code on the host. Rated CVSS 9.8 by MITRE, but EPSS is low (0.26%, 17th percentile); no public exploit is independently confirmed and it is not in CISA KEV.
Remote code execution in Agno (the Python AI-agent framework) up to and including 2.5.8 lets attackers run arbitrary code and OS commands on the host by way of prompt injection. The PythonTools and ShellTools components feed LLM-generated arguments straight into exec(), runpy.run_path(), and subprocess.run() without sanitization, so an attacker who plants malicious instructions in any content the agent ingests (a web page, a document) can hijack execution. CVSS is rated 9.8 and the CVSS vector marks it unauthenticated/network, but no public exploit is identified at time of analysis and EPSS is low at 0.60% (46th percentile).
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Code injection in whichllm's run and snippet CLI commands allows a network-positioned attacker who controls a HuggingFace repository to achieve full arbitrary code execution on any victim's machine by publishing a repository containing a crafted GGUF filename with Python metacharacters. The script generation function in cli.py interpolates the HuggingFace Hub API siblings rfilename field directly into dynamically generated Python source without escaping, enabling a string-literal breakout that fires injected code before any model download occurs. No active exploitation is confirmed in CISA KEV and no public proof-of-concept is referenced; vendor-released patch v0.5.16 is available and directly remediates the root cause.
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. No public exploit code or active exploitation has been identified at time of analysis, but the primitive (credential-bearing lateral identity escalation at the API gateway layer) is high-value in multi-tenant or zero-trust deployments.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
Persistent root escalation in Admin By Request (ABR) on macOS allows a low-privileged local user to inject malicious entries into the sudoers file during an ABR privilege elevation session, achieving root access that outlasts the session itself. The flaw is tracked under advisory ABR-MAC-26-02 and was flagged by Singapore's Cyber Security Agency (CSA). No public exploit or CISA KEV listing is present at time of analysis, but the nature of the impact - permanent, session-independent privilege escalation - makes this high priority for any enterprise fleet running ABR on macOS.
Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding the author role or higher to invoke arbitrary PHP functions on the server by submitting a crafted display callback that bypasses the plugin's blocked-function comparison logic. Exploitation is limited to sites where restricted display-callback mode is active - the automatic default on installations first deployed on Pods versions predating 3.1 - meaning a large subset of long-running Pods deployments are in-scope. A public exploit exists per WPScan reporting, though EPSS at 0.21% (11th percentile) indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
Code injection through CorvusSKK's embedded Lua scripting engine permits arbitrary code execution on Windows systems running versions prior to 3.3.4. Vendor release notes for the fixed version explicitly confirm that dangerous Lua engine features were disabled to address this vulnerability (CWE-94). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though CISA's SSVC framework rates the technical impact as total, reflecting full compromise of confidentiality, integrity, and availability on affected hosts.
Remote command execution in JeecgBoot v3.9.2 lets attackers run arbitrary OS commands through the AI Flow module's CodeNode component, which executes user-supplied Groovy scripts. The SecurityCheck class enforces a blacklist to block dangerous calls, but Groovy's dynamic dispatch allows the blacklist to be fully bypassed via string concatenation and reflection, yielding full code execution. No public exploit is identified at time of analysis, and EPSS is low (0.22%, 13th percentile), consistent with a newly disclosed issue rather than mass exploitation.
Remote code execution in SimpleX Chat before v6.5 is claimed via the /Terminal/Notification.hs component, where a crafted payload delivered inside a normal text message is said to execute arbitrary commands with zero user interaction (CWE-94 code injection). If accurate, any user running a vulnerable build could be compromised simply by receiving a message. No public exploit identified at time of analysis and EPSS is low (0.22%, 12th percentile); the claim rests on a single third-party disclosure blog rather than a vendor advisory, so treat the severity as unconfirmed.
Remote code execution in AntFlow V2.0.0 arises because the ActivitiTest.java handler evaluates attacker-supplied JUEL (Java Unified Expression Language) expressions without any input filtering, letting an attacker run arbitrary Java code and operating-system commands on the host. The affected component is described as a front-desk (pre-authentication) endpoint, so exploitation appears to require no valid account. Publicly available exploit code exists via a GitHub write-up, though EPSS remains low (0.17%, 7th percentile) and it is not on CISA KEV.
Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.
Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.