Code Injection
Monthly
Let me synthesize. Product: Halo (halo-dev/halo) — a Java-based blog/CMS platform. Product name: "Halo". Vulnerability: CWE-94 code injection — plugin management allows installing/updating malicious plugins leading to arbitrary command execution with Halo process privileges. CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N = 4.6. Interesting — low privilege, requires user interaction, confidentiality/integrity low, no availability impact. Scope unchanged. EPSS 0.16% percentile 5% — very low. No KEV. No POC explicitly stated (references include a GitHub issue report from a researcher - MyCVE-Report). Tags: RCE, Code Injection. Affected: Halo <= 2.25.4. Prevalence: Halo is a popular open-source blog/CMS in China — medium (common but not everywhere). I'd say "medium" — it's a widely used open-source CMS/ blogging platform, but niche-ish. Let's say medium with basis "popular open-source Java CMS/blog platform, limited enterprise footprint". Assessed CVSS: The description says plugin management allows users to install/update malicious plugins — requires authenticated user with plugin management permission (admin typically), plus user interaction (UI:R from vector). Actually the input vector already says PR:L, UI:R. Hmm, but plugin management typically requires admin. The provided CVSS says PR:L. I might assess PR:L as given but arguably PR:H. I should be honest. Let me use CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N — but the impact of arbitrary command execution should be high. However CVSS given is low impacts. The description says "execute any command with Halo process permissions" — that would be C:H/I:H/A:H arguably. But scope unchanged and Halo process permissions limited. Hmm. I'll assess as AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H? Let me think: to install a plugin you need plugin management privilege — typically administrator. The given vector says PR:L though. Actually maybe Halo allows certain users to manage plugins. I'll go with PR:L per the vendor/NVD-ish
PHP code injection in Okta Access Gateway (all versions prior to 2026.9.1) allows an authenticated administrator to execute arbitrary code as the web server process by embedding malicious PHP payloads in dashboard application label values. The gateway writes these labels unsanitized into generated PHP configuration files, which are automatically included on every subsequent authentication request, triggering execution without further interaction. No public exploit has been identified at time of analysis; vendor-released patch is available at version 2026.9.1.
LDAP injection in Okta Access Gateway versions before 2026.9.1 allows a network-authenticated attacker to manipulate LDAP search filter logic by supplying crafted SAML assertion attribute values. Because the Access Gateway interpolates raw SAML attribute values directly into LDAP filter strings without sanitization, an attacker controlling those values can inject LDAP metacharacters to rewrite the intended query - potentially bypassing authorization decisions or extracting sensitive directory entries. No public exploit is identified at time of analysis, but the vendor has released a fix in 2026.9.1.
Nginx directive injection in Okta Access Gateway before version 2026.9.1 enables an authenticated administrator to inject arbitrary nginx directives into the gateway's server block by exploiting the application-level custom configuration field, which bypasses the Lua-based restriction mechanism applied to other directive entry points. The field is interpolated directly into the nginx server block without validation, allowing manipulation of routing, access controls, and header processing with high integrity impact. Vendor-released patch version 2026.9.1 is available; no public exploit has been identified at time of analysis.
Eval injection in the Okta Access Gateway management console allows an authenticated administrator, connected via SSH, to execute arbitrary code with the privileges of the management console process. The root cause (CWE-95) is unsanitized user input passed directly to eval() in an exception handler context, meaning any administrative SSH session can be leveraged for full code execution. All versions prior to 2026.9.1 are affected; a vendor patch is available and no public exploit or active exploitation has been identified at time of analysis.
Configuration injection in Okta Access Gateway (all versions before 2026.9.1) allows a high-privileged authenticated attacker to embed arbitrary nginx directives into the gateway's auto-generated nginx server block configuration by placing unsanitized payload in the application label field. Once the configuration is regenerated and nginx reloads, the injected directives execute within the nginx context, enabling full server compromise including code execution, credential interception, and proxy manipulation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the high impact triad and the identity-gateway nature of the product make this a meaningful risk for affected Okta deployments.
Remote code execution in InstantCMS prior to 2.18.2 allows authenticated administrators to execute arbitrary PHP code by abusing the component installer's file upload functionality. The attacker uploads a crafted ZIP archive containing a PHP webshell alongside a custom .htaccess file that overrides the upload directory's default PHP execution prohibition, causing the uploaded PHP files to become executable via direct HTTP request. The vulnerability requires admin-level authentication (PR:H per CVSS), significantly limiting exposure, but full server-side code execution is achievable post-exploitation. No public exploit code has been identified at time of analysis.
Server-side template injection (SSTI) in Nozomi Networks Guardian and CMC Dashboard functionality (versions prior to 26.3.0) allows an authenticated low-privilege user to embed malicious template payloads in dashboard definitions. When a victim - potentially one with elevated privileges - views or imports the crafted dashboard, the payload executes in their browser context, enabling modification of application data or disruption of the monitoring platform. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available.
Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticated remote attackers to invoke any registered WordPress shortcode via an insufficiently validated action handler that passes attacker-controlled input directly to do_shortcode(). Because shortcode impact depends on what handlers are registered in the environment, real-world consequences range from limited content disclosure or modification to chained exploitation through dangerous third-party shortcodes. No public exploit has been identified at time of analysis, and a patch was released as version 2.10.3.2.
WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows unauthenticated network attackers to smuggle arbitrary OAuth2 auth-params into Bearer challenge headers by supplying a tenant value containing a double-quote character. In multi-tenant Elixir/Phoenix applications that derive the Ash tenant from request-controlled data such as subdomains, Host headers, or path segments, an attacker can inject a second resource_metadata URL pointing to an attacker-controlled authorization server. Spec-compliant OAuth2 clients that follow the resource_metadata discovery URL will then contact the attacker's server instead of the legitimate one, enabling token theft or credential harvesting. No public exploit has been identified at time of analysis; a vendor-released patch is available at version 0.3.1.
Arbitrary shortcode execution in the Icegram Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows unauthenticated network attackers to invoke registered WordPress shortcodes without authentication. The flaw originates in the plugin's email workflow and subscription handling code, which passes user-controlled input to `do_shortcode()` without adequate validation - enabling attackers to trigger any shortcode registered on the target site. Depending on the shortcodes available, impact ranges from information disclosure and content manipulation to potential code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions kvm_inject_el2_exception() writes ESR_EL2 for synchronous exceptions but not for SError. enter_exception64() does not write ESR_ELx for any exception type, so the constructed syndrome is dropped. A guest L2 hypervisor taking a nested SError observes stale ESR_EL2. This affects both kvm_inject_nested_serror() and the EASE path in kvm_inject_nested_sea(). Write ESR_EL2 for except_type_serror, matching except_type_sync.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or snd_usb_mixer_resume() fails. The error path skips the out: block, which restores D0 and decrements chip->num_suspended_intf. The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in snd_power_ref_and_wait(). USB core logs an interface resume callback error. It does not retry that callback, so a later callback cannot complete the skipped cleanup. usb_audio_suspend() increments num_suspended_intf before returning success. A system-resume callback must consume the system-suspend count even if a component resume fails. Otherwise, the stranded count skews later suspend and resume cycles. Do not apply this cleanup to runtime-resume errors. Runtime PM can retry -EAGAIN or -EBUSY without another suspend callback. The count must continue to describe that suspended interface. Other runtime-resume errors latch runtime_error in the PM core and do not cause an immediate callback retry. Both parts of the system-resume error path are longstanding. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") introduced err_out past the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations. No third-party code is needed to reach the error path. snd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices that have a mixer status URB. Its mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It can return -EPIPE or -EIO when the device stalls the request. Route a component error through out: only when system_suspend is nonzero. Continue to return runtime-resume errors through err_out. Later component resume stages remain skipped. The original error still reaches USB core. A later transfer can fail if the device did not recover. I reproduced the system-resume failure on an Audient iD14 MkI with an out-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched core left control readers in uninterruptible sleep in snd_power_ref_and_wait() until a reboot. With this patch, the same failure restored control access. A second system suspend and resume also succeeded after I disabled fault injection.
Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 7.0.2.
Template injection in Kibana's Cribl integration allows a low-privileged authenticated user holding Fleet management rights to write Elasticsearch ingest pipelines exceeding their authorized Elasticsearch permissions. The flaw stems from insufficient validation of a configuration field that is rendered server-side as a script template, giving the attacker a code injection foothold (CWE-94) into the pipeline generation path. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L/I:L) reflects the constrained privilege requirement and limited integrity impact.
Code injection in SeaCMS's Locoy Collector module (versions up to 13.6) allows remote unauthenticated attackers to execute arbitrary PHP code by manipulating the `pwd` argument to the `parseIf` function in `seacms_locoy_news.php`. A publicly available proof-of-concept exploit exists, documented in a GitHub security advisory, elevating practical risk above the conservative 6.9 base score. The provided CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) conflict with the 'RCE' tag - PHP code injection in a CMS context typically yields full server-side code execution, suggesting the vendor scoring may significantly understate actual impact.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug. Trace for example: nft_flow_offload_chain() // FLOW_BLOCK_BIND nft_flow_block_chain() nft_chain_offload_cmd() nft_block_offload_cmd() ->ndo_setup_tc() nsim_setup_tc() flow_block_cb_setup_simple() flow_block_cb_alloc() // fails to -ENOMEM The warning was reproduced on the 5.10 stable kernel under memory pressure via fault injection, but the underlying bug exists in mainline as well, as demonstrated by the ENOMEM trace above. The following splat was triggered during nf_tables transaction processing: WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Modules linked in: CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Call Trace: nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604 nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline] nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340 netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] __sock_sendmsg+0x155/0x190 net/socket.c:663 ____sys_sendmsg+0x705/0x870 net/socket.c:2379 ___sys_sendmsg+0x100/0x170 net/socket.c:2433 __sys_sendmsg+0xe9/0x1c0 net/socket.c:2462 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that warnings are only emitted for unexpected errors. This aligns with the common kernel practice of not warning on -ENOMEM. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Jenkins REST API in versions 2.579 and earlier (LTS 2.568.2 and earlier) fails to escape map keys during JSON and Python serialization, enabling authenticated users who can control map property names to inject arbitrary fields into API responses consumed by downstream tooling or users. The flaw (CWE-116, improper output encoding) is rated CVSS 4.3 Medium with integrity-only impact and requires low-privilege authenticated access. No public exploit code or CISA KEV listing has been identified; vendor patches 2.580 and LTS 2.568.3 were released on 2026-09-02.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
LDAP injection in the Drupal LDAP / Active Directory Integration module (versions below 2.2.1) allows unauthenticated remote attackers to manipulate LDAP query structure by submitting unsanitized input containing LDAP special characters. The primary confirmed impact is partial confidentiality loss — directory enumeration or partial authentication bypass — with no integrity or availability impact per the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible attack vector makes it straightforward to attempt against exposed instances.
Email content injection in the CatalogX WordPress plugin before 6.1.3 allows unauthenticated attackers to permanently plant unsanitized content into product enquiry notification emails delivered to site administrators. The injected payload is stored server-side upon submission of a product enquiry and is included verbatim in the administrator notification email each time any subsequent visitor triggers a new enquiry. A publicly available proof-of-concept exists; no public exploit confirmed as actively exploited per CISA KEV.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Code injection in yaojingang GEOFlow versions up to 2.1.0 allows a remote superadmin to execute arbitrary PHP on the server by submitting a malicious Blade template payload to the preview function of the Superadmin Theme Editor (SiteThemeEditorController.php). A publicly available proof-of-concept exploit has been disclosed via GitHub issue #60, and the attack requires no user interaction beyond the attacker's own authenticated session. Vendor-released patch version 2.1.1 resolves the issue; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. No active exploitation or public proof-of-concept has been identified; the CVSS 4.0 score of 2.1 reflects significant compound preconditions required for exploitation.
Remote code injection in SeaCMS 13.6 and earlier allows unauthenticated network attackers to execute arbitrary code by passing malicious input through the `searchtype` parameter, which flows into the `parseIf` function of the template engine in `search.php` without adequate sanitization. A public proof-of-concept exploit has been disclosed on GitHub under the title 'cascade-template-rce,' materially lowering the attack threshold for any internet-exposed instance. No vendor-released patch has been identified at time of analysis; publicly available exploit code exists.
Arbitrary host filesystem write is achievable via two distinct attack paths in an OCI image-handling component: symlinks planted inside OCI image layers that resolve outside the container root during image extraction, and newline characters injected into oci.dns.* annotation values that corrupt host-side configuration files written from those annotations. Both paths allow an attacker who controls an OCI image to write attacker-controlled data to arbitrary paths on the host system, breaking container isolation. No public exploit has been identified at time of analysis, and no CVSS data is available from the source record.
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker-specified hosts by embedding bare carriage return characters in URLs supplied to gitoxide operations. Because gitoxide fails to sanitize these control characters before constructing credential helper protocol messages, injected fields override the legitimate host value, causing helpers to return stored credentials for a host the attacker controls rather than the intended repository host. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 2.3 reflects the high complexity, attack prerequisites, and user interaction requirements that substantially constrain real-world exploitability.
Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.
In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() It's pointless to call WARN_ON() in case of an allocation failure in dev_change_net_namespace() and device_rename(), since it only leads to useless splats caused by deliberate fault injections, so avoid it. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
HTTP response splitting in cpp-httplib 0.49.0 allows an attacker who can influence chunked response trailer values to inject arbitrary headers into the HTTP response stream, potentially forging responses seen by downstream clients. The trailer-writing path in write_content_chunked() is the sole code path in the library that omits the CRLF validation applied by set_header() and every other header-writing function, meaning attacker-controlled CR/LF sequences pass directly to the socket. No public exploit code and no CISA KEV listing have been identified; the fix is confirmed in version 0.50.0 via upstream security advisory GHSA-2r2h-jc8w-w66c.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.
Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines by supplying email values containing CR/LF characters at the login endpoint. The vulnerability traces to a misuse of WTForms validation - the code constructed a validator object via Email(email) without invoking it, leaving attacker-controlled input unsanitized before it was interpolated into both the standard warning logger and the custom audit logger via Python f-strings. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially executable with a single HTTP request against any network-exposed deployment, and its impact falls directly on security logging integrity rather than application confidentiality or availability.
CSV injection in Dool through version 1.3.8 allows a local attacker who can control process names on a monitored host to plant malicious spreadsheet formulas into CSV exports. When an administrator or analyst opens the exported file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the injected formula executes in that application's context. Reported by CERT-PL and tracked as EUVD-2026-67128, the issue has an upstream fix via GitHub PR #117, though no officially tagged release containing the patch has been independently confirmed. No public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary code execution across entire WordPress multisite networks is possible in the Defender Security plugin (versions 5.0.0 through 6.1.x) due to a missing access control check on a network-wide setting. Any site-level administrator on a multisite installation - a role with significantly lower trust than a network/super administrator - can modify this setting to inject and execute code affecting all sites on the network. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), but SSVC rates technical impact as 'total', consistent with the network-wide RCE consequence if exploited by a malicious or compromised site admin.
Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.
Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.
Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.
MIME header injection in Apache Camel's camel-mail MimeMultipart data format allows unauthenticated network senders to plant Camel-internal namespace headers onto the Camel Exchange when headersInline is set to true, potentially redirecting what downstream route components - such as camel-sql - execute. Versions 2.17.0 through 4.14.8, 4.15.0 through 4.18.3, and 4.19.0 through 4.21.x are affected across all release lines until the current fixes. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% and SSVC rates exploitation status as none, making this a patch-priority rather than emergency-response item for most organizations.
Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Line-protocol injection and log spoofing in Spring Micrometer's StatsD and LoggingMeterRegistry components allow network-reachable attackers to forge arbitrary metrics and log entries by embedding newline characters into user-supplied strings that flow unvalidated into meter names, tag keys, or tag values. Affected deployments span the 1.9.x through 1.17.x release lines of io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core when the Datadog or Etsy StatsD flavor is active, or when LoggingMeterRegistry is in use. No public exploit has been identified at time of analysis, though the integrity-focused impact carries real risk for organizations whose incident-response workflows depend on Micrometer-sourced telemetry.
XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.
XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.
Terminal escape sequence injection in broot, the interactive Rust-based file tree navigator by Canop, allows any local user with filesystem write access to plant control characters in a filename and have them written verbatim to the terminal of any other user who browses that directory with broot. The vulnerable code path - to_string_lossy() in src/tree/tree_line.rs and src/tree_build/builder.rs - applies no control-character filtering despite an existing doc comment implying sanitization occurs. A proof of concept embedding an OSC 52 clipboard-write sequence confirmed that raw escape bytes reach the terminal unstripped; the terminal emulator then determines the actual impact, ranging from cosmetic disruption to clipboard hijacking. No public exploit identified at time of analysis beyond the reported proof of concept; the vulnerability is not listed in CISA KEV.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Remote code injection in chenhg5 cc-connect up to version 1.4.1 allows unauthenticated network attackers to execute arbitrary code by manipulating the `exec` argument passed to the `Authenticate` function in `core/webhook.go`. Tagged by reporters as RCE-capable, the vulnerability stems from unsanitized user input reaching a code execution path within the Go webhook handler. A public exploit has been disclosed; no patch has been released, as the upstream GitHub issue was closed automatically due to maintainer inactivity - leaving affected deployments without an official remediation path.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language queries under the permissions of a targeted Splunk administrator. The attacker must phish an admin-role user into opening a specially crafted link (CVSS UI:R/AC:H), making opportunistic mass exploitation unlikely, but a successful attack can expose all data indexed and accessible to that admin or corrupt lookup tables. Vendor-released patches are available for all affected branches; no public exploit code and no CISA KEV listing have been identified at time of analysis.
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. No public exploit identified at time of analysis; IBM has released a patch via its support portal.
YAML injection in volsync-addon-controller enables a highly privileged, network-capable attacker to break out of YAML value context when annotation values are rendered into OLM Subscription resources, allowing unauthorized modification of OpenShift operator lifecycle configuration. The root cause (CWE-94) is unsanitized interpolation of Kubernetes annotation strings into generated YAML, and the impact includes high integrity and availability consequences for cluster software management. Exploitation is gated behind high-privilege cluster access and the non-default 'volsync-addon-deploy-type: olm' annotation; no public exploit or CISA KEV listing has been identified at time of analysis.
Prompt injection in Context7 through version 2.1.2 allows an attacker with low-level write access to the Custom AI Instructions configuration to plant malicious directives that hijack connected AI coding agents when those agents make routine library documentation requests via the MCP server. The poisoned instructions cause the agent to exfiltrate credentials from environment files (such as .env files containing API keys and tokens) to an attacker-controlled endpoint, and to perform destructive file deletion on the victim developer's machine. No active exploitation has been confirmed in CISA KEV, but no public patch version has been independently verified at time of analysis.
Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Server-side template injection in JumpServer prior to 4.10.17 enables an authenticated administrator with Applet Host management and deployment permissions to plant Jinja2 expressions in the IP/Host or Core Service Address fields, which Ansible then evaluates as live template expressions during Applet Host deployment, yielding arbitrary OS command execution on the JumpServer control node. The patch was released in v4.10.17, confirmed via the GitHub release tag, and no public exploit code or CISA KEV entry has been identified at time of analysis. Because the control node manages downstream bastion targets, a successful exploit has blast radius well beyond the JumpServer process itself.
Terminal escape sequence injection in powerlevel10k (all versions through 1.20.17) allows any attacker who controls a package.json file on a victim's filesystem to emit arbitrary terminal control sequences on every shell prompt render when the victim navigates into the affected directory. The `prompt_package` segment in `internal/p10k.zsh` passed the `P9K_PACKAGE_VERSION` variable to the terminal without applying Zsh's `(V)` sanitization flag, meaning raw ANSI or OSC escape bytes in the version field reach the terminal emulator unfiltered. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 4.8 reflects limited integrity impact and required user interaction.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Code injection in Jij-Inc Jij-MCP-Server 0.1.0 enables remote attackers with low-privilege authenticated access to execute arbitrary Python code by manipulating the `code` argument passed to the `PythonREPL.run` function within the `jm_check` component. A public proof-of-concept exploit has been disclosed, and the vendor has not responded to the responsible disclosure filed via GitHub issue tracker. No CISA KEV listing is present, but the availability of public exploit code elevates operational risk well above what the low CVSS 4.0 score of 2.0 would suggest in isolation.
Code injection in iatsiuk pptr-mcp through version 0.2.7 enables authenticated remote attackers to execute arbitrary code via the `executeCode` function in `src/vm-executor.ts`, a component of the MCP `execute` tool. The underlying sandbox fails to isolate user-supplied input from the execution context, a class of vulnerability closely associated with Node.js `vm` module escapes. A publicly available proof-of-concept exists on GitHub, and the project maintainer has not responded to responsible disclosure, leaving all known deployments unpatched.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
LDAP injection in Hyperledger fabric-ca allows unauthenticated network attackers to manipulate LDAP search filters at the CA enrollment endpoint before password validation occurs. Versions 1.5.20 and earlier are affected when the LDAP backend is configured; installations using the default local identity store are not exposed. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but a vendor-released patch is available in version 1.5.21.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Newline injection in rsync's name-converter uid/gid mapping interface (all versions before 3.5.0) allows local attackers to forge protocol messages by embedding newline characters in OS-level user or group names. Because the rsync daemon communicates with the name-converter over a pipe-based, line-oriented protocol, injected newlines create false protocol boundaries, causing the daemon to parse attacker-controlled strings as legitimate protocol directives and corrupting uid/gid mapping logic. No public exploit code and no CISA KEV listing are identified at time of analysis; rsync 3.5.0 was designated a major security release to address this issue.
Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file truncation in GitPython before 3.1.56 enables an attacker who can control keyword arguments forwarded to Commit.count() to blank any file accessible at the process's privilege level by injecting output=<path>, which causes git rev-list to open and truncate the target to zero bytes before revision parsing. The unguarded sink at commit.py:290-291 is a distinct, overlooked parallel to the sibling iter_items method, which carries the check_unsafe_options guard; this gap persisted after GHSA-956x-8gvw-wg5v addressed iter_commits and blame. No CISA KEV listing is present, but a proof-of-concept was verified on tag 3.1.53 and is published in the GHSA advisory.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Sequential DNS transaction IDs in Ubuntu's DNS resolver implementation allow network-adjacent or on-path attackers to inject forged DNS responses by predicting transaction IDs. The vulnerability undermines the randomness that DNS relies on to authenticate responses, enabling cache poisoning attacks that redirect legitimate domain resolutions to attacker-controlled addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and has proven exploitable historically.
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.
Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Terminal escape sequence injection in Bash-it's barbuk theme (versions through 3.2.0) permits a local attacker to execute arbitrary OSC and CSI terminal control sequences in the context of a victim user's terminal emulator simply by placing a crafted pyproject.toml in any directory the victim navigates into. The root cause is that the barbuk theme's __python_venv_prompt function reads the requires-python field via awk without stripping control characters, then concatenates the raw value into PS1 through __prompt-command, causing injected sequences to render on every prompt refresh. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack is low-complexity given the vendor-confirmed fix commit.
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and SSVC assessment characterizes exploitation status as none with a non-automatable attack path.
MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.
Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Let me synthesize. Product: Halo (halo-dev/halo) — a Java-based blog/CMS platform. Product name: "Halo". Vulnerability: CWE-94 code injection — plugin management allows installing/updating malicious plugins leading to arbitrary command execution with Halo process privileges. CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N = 4.6. Interesting — low privilege, requires user interaction, confidentiality/integrity low, no availability impact. Scope unchanged. EPSS 0.16% percentile 5% — very low. No KEV. No POC explicitly stated (references include a GitHub issue report from a researcher - MyCVE-Report). Tags: RCE, Code Injection. Affected: Halo <= 2.25.4. Prevalence: Halo is a popular open-source blog/CMS in China — medium (common but not everywhere). I'd say "medium" — it's a widely used open-source CMS/ blogging platform, but niche-ish. Let's say medium with basis "popular open-source Java CMS/blog platform, limited enterprise footprint". Assessed CVSS: The description says plugin management allows users to install/update malicious plugins — requires authenticated user with plugin management permission (admin typically), plus user interaction (UI:R from vector). Actually the input vector already says PR:L, UI:R. Hmm, but plugin management typically requires admin. The provided CVSS says PR:L. I might assess PR:L as given but arguably PR:H. I should be honest. Let me use CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N — but the impact of arbitrary command execution should be high. However CVSS given is low impacts. The description says "execute any command with Halo process permissions" — that would be C:H/I:H/A:H arguably. But scope unchanged and Halo process permissions limited. Hmm. I'll assess as AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H? Let me think: to install a plugin you need plugin management privilege — typically administrator. The given vector says PR:L though. Actually maybe Halo allows certain users to manage plugins. I'll go with PR:L per the vendor/NVD-ish
PHP code injection in Okta Access Gateway (all versions prior to 2026.9.1) allows an authenticated administrator to execute arbitrary code as the web server process by embedding malicious PHP payloads in dashboard application label values. The gateway writes these labels unsanitized into generated PHP configuration files, which are automatically included on every subsequent authentication request, triggering execution without further interaction. No public exploit has been identified at time of analysis; vendor-released patch is available at version 2026.9.1.
LDAP injection in Okta Access Gateway versions before 2026.9.1 allows a network-authenticated attacker to manipulate LDAP search filter logic by supplying crafted SAML assertion attribute values. Because the Access Gateway interpolates raw SAML attribute values directly into LDAP filter strings without sanitization, an attacker controlling those values can inject LDAP metacharacters to rewrite the intended query - potentially bypassing authorization decisions or extracting sensitive directory entries. No public exploit is identified at time of analysis, but the vendor has released a fix in 2026.9.1.
Nginx directive injection in Okta Access Gateway before version 2026.9.1 enables an authenticated administrator to inject arbitrary nginx directives into the gateway's server block by exploiting the application-level custom configuration field, which bypasses the Lua-based restriction mechanism applied to other directive entry points. The field is interpolated directly into the nginx server block without validation, allowing manipulation of routing, access controls, and header processing with high integrity impact. Vendor-released patch version 2026.9.1 is available; no public exploit has been identified at time of analysis.
Eval injection in the Okta Access Gateway management console allows an authenticated administrator, connected via SSH, to execute arbitrary code with the privileges of the management console process. The root cause (CWE-95) is unsanitized user input passed directly to eval() in an exception handler context, meaning any administrative SSH session can be leveraged for full code execution. All versions prior to 2026.9.1 are affected; a vendor patch is available and no public exploit or active exploitation has been identified at time of analysis.
Configuration injection in Okta Access Gateway (all versions before 2026.9.1) allows a high-privileged authenticated attacker to embed arbitrary nginx directives into the gateway's auto-generated nginx server block configuration by placing unsanitized payload in the application label field. Once the configuration is regenerated and nginx reloads, the injected directives execute within the nginx context, enabling full server compromise including code execution, credential interception, and proxy manipulation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the high impact triad and the identity-gateway nature of the product make this a meaningful risk for affected Okta deployments.
Remote code execution in InstantCMS prior to 2.18.2 allows authenticated administrators to execute arbitrary PHP code by abusing the component installer's file upload functionality. The attacker uploads a crafted ZIP archive containing a PHP webshell alongside a custom .htaccess file that overrides the upload directory's default PHP execution prohibition, causing the uploaded PHP files to become executable via direct HTTP request. The vulnerability requires admin-level authentication (PR:H per CVSS), significantly limiting exposure, but full server-side code execution is achievable post-exploitation. No public exploit code has been identified at time of analysis.
Server-side template injection (SSTI) in Nozomi Networks Guardian and CMC Dashboard functionality (versions prior to 26.3.0) allows an authenticated low-privilege user to embed malicious template payloads in dashboard definitions. When a victim - potentially one with elevated privileges - views or imports the crafted dashboard, the payload executes in their browser context, enabling modification of application data or disruption of the monitoring platform. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available.
Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticated remote attackers to invoke any registered WordPress shortcode via an insufficiently validated action handler that passes attacker-controlled input directly to do_shortcode(). Because shortcode impact depends on what handlers are registered in the environment, real-world consequences range from limited content disclosure or modification to chained exploitation through dangerous third-party shortcodes. No public exploit has been identified at time of analysis, and a patch was released as version 2.10.3.2.
WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows unauthenticated network attackers to smuggle arbitrary OAuth2 auth-params into Bearer challenge headers by supplying a tenant value containing a double-quote character. In multi-tenant Elixir/Phoenix applications that derive the Ash tenant from request-controlled data such as subdomains, Host headers, or path segments, an attacker can inject a second resource_metadata URL pointing to an attacker-controlled authorization server. Spec-compliant OAuth2 clients that follow the resource_metadata discovery URL will then contact the attacker's server instead of the legitimate one, enabling token theft or credential harvesting. No public exploit has been identified at time of analysis; a vendor-released patch is available at version 0.3.1.
Arbitrary shortcode execution in the Icegram Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows unauthenticated network attackers to invoke registered WordPress shortcodes without authentication. The flaw originates in the plugin's email workflow and subscription handling code, which passes user-controlled input to `do_shortcode()` without adequate validation - enabling attackers to trigger any shortcode registered on the target site. Depending on the shortcodes available, impact ranges from information disclosure and content manipulation to potential code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions kvm_inject_el2_exception() writes ESR_EL2 for synchronous exceptions but not for SError. enter_exception64() does not write ESR_ELx for any exception type, so the constructed syndrome is dropped. A guest L2 hypervisor taking a nested SError observes stale ESR_EL2. This affects both kvm_inject_nested_serror() and the EASE path in kvm_inject_nested_sea(). Write ESR_EL2 for except_type_serror, matching except_type_sync.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or snd_usb_mixer_resume() fails. The error path skips the out: block, which restores D0 and decrements chip->num_suspended_intf. The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in snd_power_ref_and_wait(). USB core logs an interface resume callback error. It does not retry that callback, so a later callback cannot complete the skipped cleanup. usb_audio_suspend() increments num_suspended_intf before returning success. A system-resume callback must consume the system-suspend count even if a component resume fails. Otherwise, the stranded count skews later suspend and resume cycles. Do not apply this cleanup to runtime-resume errors. Runtime PM can retry -EAGAIN or -EBUSY without another suspend callback. The count must continue to describe that suspended interface. Other runtime-resume errors latch runtime_error in the PM core and do not cause an immediate callback retry. Both parts of the system-resume error path are longstanding. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") introduced err_out past the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations. No third-party code is needed to reach the error path. snd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices that have a mixer status URB. Its mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It can return -EPIPE or -EIO when the device stalls the request. Route a component error through out: only when system_suspend is nonzero. Continue to return runtime-resume errors through err_out. Later component resume stages remain skipped. The original error still reaches USB core. A later transfer can fail if the device did not recover. I reproduced the system-resume failure on an Audient iD14 MkI with an out-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched core left control readers in uninterruptible sleep in snd_power_ref_and_wait() until a reboot. With this patch, the same failure restored control access. A second system suspend and resume also succeeded after I disabled fault injection.
Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 7.0.2.
Template injection in Kibana's Cribl integration allows a low-privileged authenticated user holding Fleet management rights to write Elasticsearch ingest pipelines exceeding their authorized Elasticsearch permissions. The flaw stems from insufficient validation of a configuration field that is rendered server-side as a script template, giving the attacker a code injection foothold (CWE-94) into the pipeline generation path. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L/I:L) reflects the constrained privilege requirement and limited integrity impact.
Code injection in SeaCMS's Locoy Collector module (versions up to 13.6) allows remote unauthenticated attackers to execute arbitrary PHP code by manipulating the `pwd` argument to the `parseIf` function in `seacms_locoy_news.php`. A publicly available proof-of-concept exploit exists, documented in a GitHub security advisory, elevating practical risk above the conservative 6.9 base score. The provided CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) conflict with the 'RCE' tag - PHP code injection in a CMS context typically yields full server-side code execution, suggesting the vendor scoring may significantly understate actual impact.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug. Trace for example: nft_flow_offload_chain() // FLOW_BLOCK_BIND nft_flow_block_chain() nft_chain_offload_cmd() nft_block_offload_cmd() ->ndo_setup_tc() nsim_setup_tc() flow_block_cb_setup_simple() flow_block_cb_alloc() // fails to -ENOMEM The warning was reproduced on the 5.10 stable kernel under memory pressure via fault injection, but the underlying bug exists in mainline as well, as demonstrated by the ENOMEM trace above. The following splat was triggered during nf_tables transaction processing: WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Modules linked in: CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Call Trace: nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604 nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline] nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340 netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] __sock_sendmsg+0x155/0x190 net/socket.c:663 ____sys_sendmsg+0x705/0x870 net/socket.c:2379 ___sys_sendmsg+0x100/0x170 net/socket.c:2433 __sys_sendmsg+0xe9/0x1c0 net/socket.c:2462 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that warnings are only emitted for unexpected errors. This aligns with the common kernel practice of not warning on -ENOMEM. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Jenkins REST API in versions 2.579 and earlier (LTS 2.568.2 and earlier) fails to escape map keys during JSON and Python serialization, enabling authenticated users who can control map property names to inject arbitrary fields into API responses consumed by downstream tooling or users. The flaw (CWE-116, improper output encoding) is rated CVSS 4.3 Medium with integrity-only impact and requires low-privilege authenticated access. No public exploit code or CISA KEV listing has been identified; vendor patches 2.580 and LTS 2.568.3 were released on 2026-09-02.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
LDAP injection in the Drupal LDAP / Active Directory Integration module (versions below 2.2.1) allows unauthenticated remote attackers to manipulate LDAP query structure by submitting unsanitized input containing LDAP special characters. The primary confirmed impact is partial confidentiality loss — directory enumeration or partial authentication bypass — with no integrity or availability impact per the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible attack vector makes it straightforward to attempt against exposed instances.
Email content injection in the CatalogX WordPress plugin before 6.1.3 allows unauthenticated attackers to permanently plant unsanitized content into product enquiry notification emails delivered to site administrators. The injected payload is stored server-side upon submission of a product enquiry and is included verbatim in the administrator notification email each time any subsequent visitor triggers a new enquiry. A publicly available proof-of-concept exists; no public exploit confirmed as actively exploited per CISA KEV.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Code injection in yaojingang GEOFlow versions up to 2.1.0 allows a remote superadmin to execute arbitrary PHP on the server by submitting a malicious Blade template payload to the preview function of the Superadmin Theme Editor (SiteThemeEditorController.php). A publicly available proof-of-concept exploit has been disclosed via GitHub issue #60, and the attack requires no user interaction beyond the attacker's own authenticated session. Vendor-released patch version 2.1.1 resolves the issue; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. No active exploitation or public proof-of-concept has been identified; the CVSS 4.0 score of 2.1 reflects significant compound preconditions required for exploitation.
Remote code injection in SeaCMS 13.6 and earlier allows unauthenticated network attackers to execute arbitrary code by passing malicious input through the `searchtype` parameter, which flows into the `parseIf` function of the template engine in `search.php` without adequate sanitization. A public proof-of-concept exploit has been disclosed on GitHub under the title 'cascade-template-rce,' materially lowering the attack threshold for any internet-exposed instance. No vendor-released patch has been identified at time of analysis; publicly available exploit code exists.
Arbitrary host filesystem write is achievable via two distinct attack paths in an OCI image-handling component: symlinks planted inside OCI image layers that resolve outside the container root during image extraction, and newline characters injected into oci.dns.* annotation values that corrupt host-side configuration files written from those annotations. Both paths allow an attacker who controls an OCI image to write attacker-controlled data to arbitrary paths on the host system, breaking container isolation. No public exploit has been identified at time of analysis, and no CVSS data is available from the source record.
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker-specified hosts by embedding bare carriage return characters in URLs supplied to gitoxide operations. Because gitoxide fails to sanitize these control characters before constructing credential helper protocol messages, injected fields override the legitimate host value, causing helpers to return stored credentials for a host the attacker controls rather than the intended repository host. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 2.3 reflects the high complexity, attack prerequisites, and user interaction requirements that substantially constrain real-world exploitability.
Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.
In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() It's pointless to call WARN_ON() in case of an allocation failure in dev_change_net_namespace() and device_rename(), since it only leads to useless splats caused by deliberate fault injections, so avoid it. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
HTTP response splitting in cpp-httplib 0.49.0 allows an attacker who can influence chunked response trailer values to inject arbitrary headers into the HTTP response stream, potentially forging responses seen by downstream clients. The trailer-writing path in write_content_chunked() is the sole code path in the library that omits the CRLF validation applied by set_header() and every other header-writing function, meaning attacker-controlled CR/LF sequences pass directly to the socket. No public exploit code and no CISA KEV listing have been identified; the fix is confirmed in version 0.50.0 via upstream security advisory GHSA-2r2h-jc8w-w66c.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.
Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines by supplying email values containing CR/LF characters at the login endpoint. The vulnerability traces to a misuse of WTForms validation - the code constructed a validator object via Email(email) without invoking it, leaving attacker-controlled input unsanitized before it was interpolated into both the standard warning logger and the custom audit logger via Python f-strings. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially executable with a single HTTP request against any network-exposed deployment, and its impact falls directly on security logging integrity rather than application confidentiality or availability.
CSV injection in Dool through version 1.3.8 allows a local attacker who can control process names on a monitored host to plant malicious spreadsheet formulas into CSV exports. When an administrator or analyst opens the exported file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the injected formula executes in that application's context. Reported by CERT-PL and tracked as EUVD-2026-67128, the issue has an upstream fix via GitHub PR #117, though no officially tagged release containing the patch has been independently confirmed. No public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary code execution across entire WordPress multisite networks is possible in the Defender Security plugin (versions 5.0.0 through 6.1.x) due to a missing access control check on a network-wide setting. Any site-level administrator on a multisite installation - a role with significantly lower trust than a network/super administrator - can modify this setting to inject and execute code affecting all sites on the network. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), but SSVC rates technical impact as 'total', consistent with the network-wide RCE consequence if exploited by a malicious or compromised site admin.
Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.
Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.
Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.
MIME header injection in Apache Camel's camel-mail MimeMultipart data format allows unauthenticated network senders to plant Camel-internal namespace headers onto the Camel Exchange when headersInline is set to true, potentially redirecting what downstream route components - such as camel-sql - execute. Versions 2.17.0 through 4.14.8, 4.15.0 through 4.18.3, and 4.19.0 through 4.21.x are affected across all release lines until the current fixes. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% and SSVC rates exploitation status as none, making this a patch-priority rather than emergency-response item for most organizations.
Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Line-protocol injection and log spoofing in Spring Micrometer's StatsD and LoggingMeterRegistry components allow network-reachable attackers to forge arbitrary metrics and log entries by embedding newline characters into user-supplied strings that flow unvalidated into meter names, tag keys, or tag values. Affected deployments span the 1.9.x through 1.17.x release lines of io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core when the Datadog or Etsy StatsD flavor is active, or when LoggingMeterRegistry is in use. No public exploit has been identified at time of analysis, though the integrity-focused impact carries real risk for organizations whose incident-response workflows depend on Micrometer-sourced telemetry.
XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.
XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.
Terminal escape sequence injection in broot, the interactive Rust-based file tree navigator by Canop, allows any local user with filesystem write access to plant control characters in a filename and have them written verbatim to the terminal of any other user who browses that directory with broot. The vulnerable code path - to_string_lossy() in src/tree/tree_line.rs and src/tree_build/builder.rs - applies no control-character filtering despite an existing doc comment implying sanitization occurs. A proof of concept embedding an OSC 52 clipboard-write sequence confirmed that raw escape bytes reach the terminal unstripped; the terminal emulator then determines the actual impact, ranging from cosmetic disruption to clipboard hijacking. No public exploit identified at time of analysis beyond the reported proof of concept; the vulnerability is not listed in CISA KEV.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Remote code injection in chenhg5 cc-connect up to version 1.4.1 allows unauthenticated network attackers to execute arbitrary code by manipulating the `exec` argument passed to the `Authenticate` function in `core/webhook.go`. Tagged by reporters as RCE-capable, the vulnerability stems from unsanitized user input reaching a code execution path within the Go webhook handler. A public exploit has been disclosed; no patch has been released, as the upstream GitHub issue was closed automatically due to maintainer inactivity - leaving affected deployments without an official remediation path.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language queries under the permissions of a targeted Splunk administrator. The attacker must phish an admin-role user into opening a specially crafted link (CVSS UI:R/AC:H), making opportunistic mass exploitation unlikely, but a successful attack can expose all data indexed and accessible to that admin or corrupt lookup tables. Vendor-released patches are available for all affected branches; no public exploit code and no CISA KEV listing have been identified at time of analysis.
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. No public exploit identified at time of analysis; IBM has released a patch via its support portal.
YAML injection in volsync-addon-controller enables a highly privileged, network-capable attacker to break out of YAML value context when annotation values are rendered into OLM Subscription resources, allowing unauthorized modification of OpenShift operator lifecycle configuration. The root cause (CWE-94) is unsanitized interpolation of Kubernetes annotation strings into generated YAML, and the impact includes high integrity and availability consequences for cluster software management. Exploitation is gated behind high-privilege cluster access and the non-default 'volsync-addon-deploy-type: olm' annotation; no public exploit or CISA KEV listing has been identified at time of analysis.
Prompt injection in Context7 through version 2.1.2 allows an attacker with low-level write access to the Custom AI Instructions configuration to plant malicious directives that hijack connected AI coding agents when those agents make routine library documentation requests via the MCP server. The poisoned instructions cause the agent to exfiltrate credentials from environment files (such as .env files containing API keys and tokens) to an attacker-controlled endpoint, and to perform destructive file deletion on the victim developer's machine. No active exploitation has been confirmed in CISA KEV, but no public patch version has been independently verified at time of analysis.
Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Server-side template injection in JumpServer prior to 4.10.17 enables an authenticated administrator with Applet Host management and deployment permissions to plant Jinja2 expressions in the IP/Host or Core Service Address fields, which Ansible then evaluates as live template expressions during Applet Host deployment, yielding arbitrary OS command execution on the JumpServer control node. The patch was released in v4.10.17, confirmed via the GitHub release tag, and no public exploit code or CISA KEV entry has been identified at time of analysis. Because the control node manages downstream bastion targets, a successful exploit has blast radius well beyond the JumpServer process itself.
Terminal escape sequence injection in powerlevel10k (all versions through 1.20.17) allows any attacker who controls a package.json file on a victim's filesystem to emit arbitrary terminal control sequences on every shell prompt render when the victim navigates into the affected directory. The `prompt_package` segment in `internal/p10k.zsh` passed the `P9K_PACKAGE_VERSION` variable to the terminal without applying Zsh's `(V)` sanitization flag, meaning raw ANSI or OSC escape bytes in the version field reach the terminal emulator unfiltered. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 4.8 reflects limited integrity impact and required user interaction.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Code injection in Jij-Inc Jij-MCP-Server 0.1.0 enables remote attackers with low-privilege authenticated access to execute arbitrary Python code by manipulating the `code` argument passed to the `PythonREPL.run` function within the `jm_check` component. A public proof-of-concept exploit has been disclosed, and the vendor has not responded to the responsible disclosure filed via GitHub issue tracker. No CISA KEV listing is present, but the availability of public exploit code elevates operational risk well above what the low CVSS 4.0 score of 2.0 would suggest in isolation.
Code injection in iatsiuk pptr-mcp through version 0.2.7 enables authenticated remote attackers to execute arbitrary code via the `executeCode` function in `src/vm-executor.ts`, a component of the MCP `execute` tool. The underlying sandbox fails to isolate user-supplied input from the execution context, a class of vulnerability closely associated with Node.js `vm` module escapes. A publicly available proof-of-concept exists on GitHub, and the project maintainer has not responded to responsible disclosure, leaving all known deployments unpatched.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
LDAP injection in Hyperledger fabric-ca allows unauthenticated network attackers to manipulate LDAP search filters at the CA enrollment endpoint before password validation occurs. Versions 1.5.20 and earlier are affected when the LDAP backend is configured; installations using the default local identity store are not exposed. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but a vendor-released patch is available in version 1.5.21.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Newline injection in rsync's name-converter uid/gid mapping interface (all versions before 3.5.0) allows local attackers to forge protocol messages by embedding newline characters in OS-level user or group names. Because the rsync daemon communicates with the name-converter over a pipe-based, line-oriented protocol, injected newlines create false protocol boundaries, causing the daemon to parse attacker-controlled strings as legitimate protocol directives and corrupting uid/gid mapping logic. No public exploit code and no CISA KEV listing are identified at time of analysis; rsync 3.5.0 was designated a major security release to address this issue.
Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file truncation in GitPython before 3.1.56 enables an attacker who can control keyword arguments forwarded to Commit.count() to blank any file accessible at the process's privilege level by injecting output=<path>, which causes git rev-list to open and truncate the target to zero bytes before revision parsing. The unguarded sink at commit.py:290-291 is a distinct, overlooked parallel to the sibling iter_items method, which carries the check_unsafe_options guard; this gap persisted after GHSA-956x-8gvw-wg5v addressed iter_commits and blame. No CISA KEV listing is present, but a proof-of-concept was verified on tag 3.1.53 and is published in the GHSA advisory.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Sequential DNS transaction IDs in Ubuntu's DNS resolver implementation allow network-adjacent or on-path attackers to inject forged DNS responses by predicting transaction IDs. The vulnerability undermines the randomness that DNS relies on to authenticate responses, enabling cache poisoning attacks that redirect legitimate domain resolutions to attacker-controlled addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and has proven exploitable historically.
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.
Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Terminal escape sequence injection in Bash-it's barbuk theme (versions through 3.2.0) permits a local attacker to execute arbitrary OSC and CSI terminal control sequences in the context of a victim user's terminal emulator simply by placing a crafted pyproject.toml in any directory the victim navigates into. The root cause is that the barbuk theme's __python_venv_prompt function reads the requires-python field via awk without stripping control characters, then concatenates the raw value into PS1 through __prompt-command, causing injected sequences to render on every prompt refresh. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack is low-complexity given the vendor-confirmed fix commit.
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and SSVC assessment characterizes exploitation status as none with a non-automatable attack path.
MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.
Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.