Code Injection
Monthly
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Code injection in Jij-Inc Jij-MCP-Server 0.1.0 enables remote attackers with low-privilege authenticated access to execute arbitrary Python code by manipulating the `code` argument passed to the `PythonREPL.run` function within the `jm_check` component. A public proof-of-concept exploit has been disclosed, and the vendor has not responded to the responsible disclosure filed via GitHub issue tracker. No CISA KEV listing is present, but the availability of public exploit code elevates operational risk well above what the low CVSS 4.0 score of 2.0 would suggest in isolation.
Sandbox escape in O2OA v.10.0.2's Invoke script execution mechanism allows a locally authenticated low-privileged attacker to bypass code isolation controls and execute arbitrary commands on the host system, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The CVSS vector AV:L/AC:L/PR:L/UI:N confirms exploitation requires only a valid low-privileged platform account with access to the Invoke JAX-RS endpoint - no complex conditions or user interaction are needed. A detailed vulnerability analysis document has been publicly disclosed via GitHub, lowering the technical barrier for exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Halo 2.25.4, an open-source Java-based CMS/blogging platform, arises from its plugin-installation machinery: the installFromUri method in PluginEndpoint.java combined with DefaultPluginApplicationContextFactory loads and executes attacker-supplied plugin code, giving full CWE-94 code injection with total confidentiality, integrity, and availability impact (CVSS 9.8). Publicly available exploit code exists in a referenced GitHub gist, but there is no public exploit identified as being actively used in the wild (not on CISA KEV). Note a signal conflict: the NVD vector states PR:N (unauthenticated) while plugin installation in Halo is normally an administrative function - this warrants verification.
Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.
Remote code execution in JeecgBoot v3.9.2 allows attackers to run arbitrary code by supplying a malicious value to the 'files' parameter within the AI Chat module. The flaw is a code-injection weakness (CWE-94) carrying a critical 9.8 CVSS rating with a fully remote, low-complexity vector. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.21%, 11th percentile), indicating no observed mass-exploitation activity yet.
Remote code execution in Squirro Cognitive Search before version 3.14.2 lets remote attackers run arbitrary code by sending a crafted payload to the application's password-reset function, a CWE-94 code-injection flaw. The password-reset endpoint is typically pre-authentication and internet-facing, and the CVSS vector (PR:N/UI:N) indicates no credentials or user interaction are needed. Publicly available exploit code exists (SSVC exploitation status 'poc', plus a public GitHub research repo), but this CVE is not in CISA KEV and EPSS is low at 0.24% (15th percentile), indicating credible but not yet widespread exploitation.
Code injection in iatsiuk pptr-mcp through version 0.2.7 enables authenticated remote attackers to execute arbitrary code via the `executeCode` function in `src/vm-executor.ts`, a component of the MCP `execute` tool. The underlying sandbox fails to isolate user-supplied input from the execution context, a class of vulnerability closely associated with Node.js `vm` module escapes. A publicly available proof-of-concept exists on GitHub, and the project maintainer has not responded to responsible disclosure, leaving all known deployments unpatched.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.
Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.
Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. The upstream fix makes KVM reject non-memory backing and inject a Synchronous External Abort (SEA) into the guest instead. There is no public exploit identified at time of analysis and EPSS is low (0.21%).
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
LDAP injection in Hyperledger fabric-ca allows unauthenticated network attackers to manipulate LDAP search filters at the CA enrollment endpoint before password validation occurs. Versions 1.5.20 and earlier are affected when the LDAP backend is configured; installations using the default local identity store are not exposed. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but a vendor-released patch is available in version 1.5.21.
Authenticated remote code execution in ImpressCMS allows administrators with access to the custom tag module to store and persistently execute arbitrary PHP code across all frontend page loads. The root mechanism is a decode-then-eval pattern: the application's renderWithPhp() method calls undoHtmlSpecialChars() on stored tag content before passing it to eval(), causing HTML Purifier sanitization to be bypassed entirely since purification operates on the encoded form. Publicly available exploit code exists on GitHub; this vulnerability has not been confirmed as actively exploited by CISA KEV at time of analysis.
Unauthenticated remote code execution in MindsDB Minds Platform (version 26.1.0 and earlier) lets any network-reachable attacker run arbitrary OS commands on the host by chaining two unprotected API endpoints. The attacker first sets a controlled LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submits a crafted prompt to POST /api/v1/responses/ that steers the Anton agent into calling its scratchpad tool, which passes attacker-influenced Python directly into exec() with no sandbox. Reported by VulnCheck with a maximum CVSS 4.0 score of 10.0 and CWE-94; no public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication make it high priority.
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Code injection in Devolutions PowerShell Universal 2026.2.3 and earlier allows any authenticated user granted settings management permissions to execute arbitrary PowerShell within the platform runtime. The vulnerability arises because setting values submitted through the settings interface are not properly escaped before being written to the configuration file, which is subsequently parsed and interpreted as executable code. No public exploit code has been identified at time of analysis, and SSVC reports no known active exploitation, but the technical impact is rated total given full arbitrary code execution capability.
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary PHP files on the server by exploiting a validation bypass in the Flex Objects plugin. The attacker crafts a ZIP archive containing PHP code, circumvents routine-name validation by substituting array notation for the expected string notation, and triggers the unZip routine to write the payload directly into the web root where it becomes immediately executable via HTTP. No public exploit has been identified at time of analysis, but the precise bypass technique disclosed in the advisory substantially lowers the barrier to exploitation for any attacker holding valid credentials.
Code injection in Elastic Fleet Server allows an authenticated Kibana administrator to execute arbitrary server-side scripts by embedding script syntax within an output configuration identifier. Affected are all Fleet Server versions prior to those addressed in Elastic advisory ESA-2026-93, where Kibana's failure to restrict identifier characters permits injected script content to be incorporated into scripts Fleet Server constructs during routine agent policy processing. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, but the confidentiality and integrity impact is rated high given full script execution capability within the Fleet Server process.
Remote code execution in Velocity.js (npm 'velocityjs') versions <= 2.1.6 lets an attacker who controls template content reach the JavaScript Function constructor and run arbitrary code in the server process. The earlier CVE-2026-44966/GHSA-j658-c2gf-x6pq fix only filtered constructor/__proto__/prototype in the #set assignment target, leaving property-read expressions in references.ts unguarded, so this is a straightforward bypass. Publicly available exploit code exists (a working PoC is published in the GHSA advisory and was vendor-verified on v2.1.6); no confirmed active exploitation (not in CISA KEV).
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Remote code execution is achievable in Data::MuForm::Localizer for Perl (versions through 0.05) when an application passes user-supplied locale identifiers - such as an Accept-Language header or locale query parameter - directly to the load_lexicon function, and an attacker can also place a crafted .po file at a readable path on the server. The module constructs the catalog path by unsanitized interpolation of the language attribute, enabling directory traversal, then eval-executes the Plural-Forms header of the loaded catalog as live Perl code, giving the attacker arbitrary OS command execution as the application process user. No public exploit code is referenced in available sources and this CVE is not listed in CISA KEV; a vendor patch is available from CPANSec.
Newline injection in rsync's name-converter uid/gid mapping interface (all versions before 3.5.0) allows local attackers to forge protocol messages by embedding newline characters in OS-level user or group names. Because the rsync daemon communicates with the name-converter over a pipe-based, line-oriented protocol, injected newlines create false protocol boundaries, causing the daemon to parse attacker-controlled strings as legitimate protocol directives and corrupting uid/gid mapping logic. No public exploit code and no CISA KEV listing are identified at time of analysis; rsync 3.5.0 was designated a major security release to address this issue.
Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.
Template injection in Oh My Posh prior to 29.35.1 allows arbitrary operating system command execution as the victim user when the shell prompt renders inside a directory whose name contains a Go template expression. The `setStyle()` function in `src/segments/path.go` passes raw filesystem path components - including untrusted directory names - directly into `template.Render`, whose function map exposes a `cmd` helper that invokes `env.RunCommand`. A publicly available proof-of-concept demonstrates command execution and file writes across Linux, macOS, and Windows. No active exploitation is confirmed in CISA KEV, but the attack surface includes any developer who `cd`s into a maliciously named directory on a shared or attacker-influenced filesystem.
Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. No public exploit code has been identified at time of analysis, but the CVSS 8.1 score reflects the potential for full confidentiality, integrity, and availability impact when the dual-control preconditions are met.
Arbitrary file truncation in GitPython before 3.1.56 enables an attacker who can control keyword arguments forwarded to Commit.count() to blank any file accessible at the process's privilege level by injecting output=<path>, which causes git rev-list to open and truncate the target to zero bytes before revision parsing. The unguarded sink at commit.py:290-291 is a distinct, overlooked parallel to the sibling iter_items method, which carries the check_unsafe_options guard; this gap persisted after GHSA-956x-8gvw-wg5v addressed iter_commits and blame. No CISA KEV listing is present, but a proof-of-concept was verified on tag 3.1.53 and is published in the GHSA advisory.
Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. Reported by VulnCheck and fixed by the vendor; no public exploit or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 base score of 9.0 reflects full compromise of confidentiality, integrity, and availability.
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. Reported by VulnCheck with a CVSS 4.0 score of 9.0; no public exploit is identified at time of analysis, though the technique is documented in detail in the vendor advisory.
Remote code execution and SSRF in FlowiseAI Flowise before 3.1.3 stems from a bypassable regex-based Python code validator in the CSV and Airtable Agent nodes, letting attackers smuggle malicious pandas calls through the unauthenticated prediction API via prompt injection. Because the validator blocklists rather than sandboxes, unblocked functions such as pd.read_json() can be abused to exfiltrate local datasets, reach internal services (SSRF), or execute arbitrary code. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the reporting vendor VulnCheck and a GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) document the issue.
Authenticated arbitrary Python code execution in FlowiseAI Flowise before 3.1.3 arises from the CSV Agent node's customReadCSV parameter, whose regex-based validator can be defeated with obfuscation to run attacker-supplied code inside an unsandboxed pyodide runtime with full host access. Any user able to build or edit a chatflow can escalate from application-level access to code execution on the server. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch exists in version 3.1.3.
Remote code execution in Flowise before 3.1.3 lets attackers run arbitrary Python on the host by abusing the Airtable Agent node. Crafted chatflow prompts carry obfuscated Python that slips past the pythonCodeValidator blocklist and executes inside an unsandboxed pyodide runtime with full access to the underlying OS. Reported by VulnCheck with a published GHSA advisory; no public exploit code is identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Sequential DNS transaction IDs in Ubuntu's DNS resolver implementation allow network-adjacent or on-path attackers to inject forged DNS responses by predicting transaction IDs. The vulnerability undermines the randomness that DNS relies on to authenticate responses, enabling cache poisoning attacks that redirect legitimate domain resolutions to attacker-controlled addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and has proven exploitable historically.
Ruby code injection in the amazing_print gem's AwesomeMethodArray#grep enables arbitrary Ruby code execution inside the host process when attacker-controlled strings containing interpolation syntax reach a dynamically constructed eval call. Specifically pinned to commit dc890dfafdf07088ea901df53c19c2710e5c5234, the flaw requires an application code path where externally influenced values can become method names processed by grep with a block. A publicly available proof-of-concept exists on GitHub Gist, and while the CVE is not in CISA KEV, the full-RCE impact in affected deployments warrants urgent remediation review.
Argument injection in PDF::WebKit through version 1.2 (Perl module, CPE mithaldu:pdf::webkit) lets an attacker who controls the source HTML dictate the wkhtmltopdf command-line options used for rendering. Because meta tags of the form <meta name="pdf-webkit-KEY" content="VALUE"> are converted into renderer switches without an allow-list and are merged last, a malicious document can enable options like --enable-local-file-access or --cookie-jar to read local files into the output PDF or write to attacker-chosen paths. No public exploit identified at time of analysis; a vendor patch is available. NVD scores this CVSS 9.8, though real-world exposure depends on the application feeding untrusted HTML to the module.
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.
Arbitrary code execution is achievable on Windows endpoints running IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13 when the software is installed in all-users mode, because the installer leaves one or more configuration files world-writable. Any local user with standard (non-administrator) privileges can modify these files to inject code that executes under the security context of other users who subsequently launch the application. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 7.8 High rating reflects the full confidentiality, integrity, and availability impact achievable once a local foothold exists.
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.
Command injection in stata-mcp (pip:stata-mcp < 1.19.0) enables full OS-level remote code execution against any principal that can invoke the `ado_package_install` MCP tool. The `package` argument is concatenated unsanitized into a Stata command string delivered via pexpect.sendline(), allowing embedded newline characters to inject arbitrary Stata commands - including the `shell` escape - that execute under the account running the MCP server. Because the tool is registered in the default `all` profile and `all` is the active default, no misconfiguration by the victim is required; a detailed proof-of-concept confirmed via Docker reproduction is publicly available in the GitHub advisory, and a vendor-released patch exists in v1.19.0.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.
Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%).
Local privilege escalation in Autodesk's ODIS (Online Deployment & Installation Service) installer allows a low-privileged local attacker to inject unauthenticated IPC messages into named pipes by executing a specially crafted binary on the target machine. The root cause is incorrect permission assignment (CWE-732) on named pipe resources, permitting unauthorized low-privileged processes to connect, write, or manipulate pipe ownership in ways that fully compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor has confirmed the issue and released a patched installer via advisory ADSK-SA-2026-0013.
Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). No public exploit code has been identified at the time of analysis, and it is not listed in CISA KEV, but the combination of unauthenticated access and full code execution makes it a top-priority patch.
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Arbitrary Python code execution in calibre's template engine affects all versions prior to 9.12.0, triggered when a user opens or imports a crafted EPUB, OPF, PDF, or OPF file containing malicious composite_template metadata. The root cause is a sandbox policy inheritance failure: nested formatter invocations via template(), eval(), re_group(), and list_re_group() instantiated fresh formatter objects without propagating allow_python_templates=False from the parent, allowing an embedded python: sub-template to bypass the restriction and reach compile_python_template. No public exploit has been identified at time of analysis, though the full patch diff is publicly visible on GitHub and makes the attack straightforward to reproduce.
OS command injection via the SNMP-handling code path in SonicWall Email Security 10.0.35.8405 and earlier grants a low-privileged, authenticated CLI user root-level code execution on the underlying appliance OS. The restricted CLI fails to sanitize user-supplied input before passing it to SNMP-related system commands, enabling full host compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total technical impact (full confidentiality, integrity, and availability loss) makes this a high priority for any deployment where CLI access is shared or weakly controlled.
Python code injection in FreeCAD's FEM Displacement Constraint dialog (all versions prior to 1.1.2) enables arbitrary code execution at the FreeCAD process's privilege level when a victim opens and accepts a weaponized project file. The root cause is an incomplete sanitization routine in TaskFemConstraintDisplacement.cpp that strips double-quotes from user-supplied formula fields but leaves backslash characters unhandled, allowing crafted input to escape the Python string boundary constructed by Gui::Command::doCommand(). SSVC rates technical impact as total and confirms a proof-of-concept exists; no CISA KEV listing is present, indicating no confirmed active exploitation campaigns at time of analysis.
Arbitrary JavaScript code execution in Faker.js prior to 10.5.0 is achievable when attacker-controlled strings reach the `faker.helpers.fake` template engine. The vulnerability resides in `fakeEval.resolveProperty` in `src/modules/helpers/eval.ts`, where direct property access on a function return value (`entrypoint?.[key]`) allows traversal to the `Function` constructor via `constructor.constructor`, a classic sandbox escape. Applications that pass any user-supplied input to `faker.helpers.fake` on the server side are directly exposed to remote code execution; in local/development contexts, exploitation requires low-privileged access to control template strings. No public exploit identified at time of analysis, and the fix is available in version 10.5.0.
Terminal escape sequence injection in Bash-it's barbuk theme (versions through 3.2.0) permits a local attacker to execute arbitrary OSC and CSI terminal control sequences in the context of a victim user's terminal emulator simply by placing a crafted pyproject.toml in any directory the victim navigates into. The root cause is that the barbuk theme's __python_venv_prompt function reads the requires-python field via awk without stripping control characters, then concatenates the raw value into PS1 through __prompt-command, causing injected sequences to render on every prompt refresh. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack is low-complexity given the vendor-confirmed fix commit.
Arbitrary code execution in the PapersGPT for Zotero plugin (versions ≤0.6.1) lets an attacker who controls or tampers with LLM responses run JavaScript in Zotero's chrome-privileged context. Text returned from the LLM endpoint is passed unsanitized into window.eval() in views.ts, so a poisoned PDF (prompt injection), a man-in-the-middle on the API channel, or a malicious custom endpoint can achieve full RCE. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV, but an upstream fix removing the eval sinks is available.
Unauthenticated remote code execution in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier lets remote attackers read sensitive data and write arbitrary files through a Zip-Slip path-traversal flaw during archive extraction, which can be leveraged to plant executable content and achieve code execution. The issue was disclosed by SonicWall PSIRT (SNWLID-2026-0011) and carries a CVSS 9.1 (Critical) rating. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'.
OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted CLI user to execute arbitrary commands as root via a crafted netmask parameter. The CVSS 7.8 score reflects complete confidentiality, integrity, and availability impact despite requiring local CLI access and low-level privileges. No public exploit code exists and CISA SSVC indicates no known exploitation at time of analysis, though successful exploitation yields full appliance compromise.
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and SSVC assessment characterizes exploitation status as none with a non-automatable attack path.
Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. No public exploit identified at time of analysis, though the CVSS 9.4 rating and 'total' technical impact make this a high-priority patch target.
MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.
CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature through user interaction, resulting in high-impact compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects a local attack vector requiring user interaction, with no privileges needed from the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE tag and full C/I/A impact make this a priority for environments running PowerShell on Windows.
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary code on a victim's machine with no prior authentication, provided the victim performs a user interaction - such as opening a malicious workspace, file, or URI. Classified under CWE-94 (Code Injection), the vulnerability carries a CVSS base score of 8.8, reflecting high impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing was identified at the time of analysis, but the attack complexity is rated Low, making reliable exploitation straightforward once a victim is lured.
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise across confidentiality, integrity, and availability on unpatched servers running SharePoint 2016 Enterprise, 2019, or Subscription Edition. The CVSS 8.8 rating (AV:N/AC:L/PR:L) reflects network exploitation requiring only low-privileged credentials, though the CVE description characterizes the primary effect as spoofing rather than full remote code execution - a tension that deserves verification against the Microsoft MSRC advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis, and SSVC rates exploitation as none and automatable as no, moderating the immediate response urgency.
Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.
Code injection in Vim's vimball plugin prior to version 9.2.0847 allows arbitrary operating-system command execution when a user installs a crafted vimball archive and later uninstalls it. An attacker who delivers a malicious vimball containing a member named .VimballRecord can overwrite the installation record with arbitrary Ex commands - including shell invocations via :! - which execute with the victim user's full privileges when vimball#RmVimball() is subsequently called. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV; the upstream patch is available as Vim 9.2.0847.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Terminal escape sequence injection in npm-check-updates through 23.0.2 enables a supply-chain attacker who controls a malicious npm package's metadata to embed arbitrary VT100/OSC control sequences in the `homepage` or `repository` URL fields of `package.json`. When developers run `ncu --format homepage` or `--format repo`, these unfiltered sequences are written directly to the terminal, allowing output overwriting via bare carriage returns, terminal title hijacking via OSC sequences, and other display manipulation on developer workstations or CI runners. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix PR's test suite demonstrates the exact attack pattern using OSC title-setting sequences and CR overwrites.
Remote OS command execution in SPIP before 4.4.18 is achievable by any authenticated editor-level user on SQLite-backed installations via the navigation menu endpoint. Array-typed GET parameters submitted to /ecrire/?exec=navigation bypass the CMS sanitization layer and break out of an internal PHP string evaluation context, enabling arbitrary command execution in the web server process. MySQL-backed deployments are not affected; no public exploit has been identified at time of analysis.
Arbitrary command execution in the goose AI agent's `goose review` command allows a malicious Git repository to run attacker-controlled code on the host before any model interaction occurs. The vulnerability exists in versions prior to 1.44.0 and stems from goose invoking the system `git` binary without suppressing the `core.fsmonitor` configuration key, meaning a repository's `.git/config` can nominate an arbitrary command that Git then executes during index refresh. Exploitation requires only that a user runs `goose review` inside a malicious repository, and the injected command inherits the user's full environment - including provider API keys and filesystem access. No public exploit has been identified at time of analysis, though the fix commit and advisory are public.
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free. Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init(): 1. Load kvm.ko and kvm-intel.ko, creating both caches. 2. Unload only kvm_intel, leaving kvm.ko loaded. 3. Reload kvm_intel and force initialization through the -ENOMEM path. KASAN reports: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm] Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe. With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.
Stale mode_callbacks pointer dereference in the Linux kernel xfrm IPTFS subsystem causes kernel panic when deferred garbage collection runs after the xfrm_iptfs module has been unloaded following a failed IPTFS state initialization. The xfrm subsystem's __xfrm_init_state() caches x->mode_cbs before IPTFS setup completes, but releases the temporary module reference immediately on failure - leaving a dangling callback table pointer that xfrm_state_gc_task later dereferences against an unloaded module. No public exploit code exists and EPSS is 0.17% (6th percentile), though the vendor-assigned CVSS of 7.8 reflects worst-case kernel memory impact if the race is won.
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.
Cache poisoning in CoreBunch/Instatic through version 0.0.14 allows unauthenticated remote attackers to corrupt the shared process-wide render cache by supplying a crafted originating-page URL via the `u` query parameter of the server island endpoint `GET /_instatic/hole/<nodeId>`. Because the cache is keyed solely on `nodeId` without incorporating the `u` value, a single poisoning request causes every subsequent visitor requesting that node to receive attacker-controlled fragment content. No public exploit code has been identified and no CISA KEV listing exists; the product's early-stage, niche deployment footprint limits real-world blast radius, but the unauthenticated network vector and low attack complexity make exploitation straightforward against exposed instances.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Code injection in Jij-Inc Jij-MCP-Server 0.1.0 enables remote attackers with low-privilege authenticated access to execute arbitrary Python code by manipulating the `code` argument passed to the `PythonREPL.run` function within the `jm_check` component. A public proof-of-concept exploit has been disclosed, and the vendor has not responded to the responsible disclosure filed via GitHub issue tracker. No CISA KEV listing is present, but the availability of public exploit code elevates operational risk well above what the low CVSS 4.0 score of 2.0 would suggest in isolation.
Sandbox escape in O2OA v.10.0.2's Invoke script execution mechanism allows a locally authenticated low-privileged attacker to bypass code isolation controls and execute arbitrary commands on the host system, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The CVSS vector AV:L/AC:L/PR:L/UI:N confirms exploitation requires only a valid low-privileged platform account with access to the Invoke JAX-RS endpoint - no complex conditions or user interaction are needed. A detailed vulnerability analysis document has been publicly disclosed via GitHub, lowering the technical barrier for exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Halo 2.25.4, an open-source Java-based CMS/blogging platform, arises from its plugin-installation machinery: the installFromUri method in PluginEndpoint.java combined with DefaultPluginApplicationContextFactory loads and executes attacker-supplied plugin code, giving full CWE-94 code injection with total confidentiality, integrity, and availability impact (CVSS 9.8). Publicly available exploit code exists in a referenced GitHub gist, but there is no public exploit identified as being actively used in the wild (not on CISA KEV). Note a signal conflict: the NVD vector states PR:N (unauthenticated) while plugin installation in Halo is normally an administrative function - this warrants verification.
Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.
Remote code execution in JeecgBoot v3.9.2 allows attackers to run arbitrary code by supplying a malicious value to the 'files' parameter within the AI Chat module. The flaw is a code-injection weakness (CWE-94) carrying a critical 9.8 CVSS rating with a fully remote, low-complexity vector. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.21%, 11th percentile), indicating no observed mass-exploitation activity yet.
Remote code execution in Squirro Cognitive Search before version 3.14.2 lets remote attackers run arbitrary code by sending a crafted payload to the application's password-reset function, a CWE-94 code-injection flaw. The password-reset endpoint is typically pre-authentication and internet-facing, and the CVSS vector (PR:N/UI:N) indicates no credentials or user interaction are needed. Publicly available exploit code exists (SSVC exploitation status 'poc', plus a public GitHub research repo), but this CVE is not in CISA KEV and EPSS is low at 0.24% (15th percentile), indicating credible but not yet widespread exploitation.
Code injection in iatsiuk pptr-mcp through version 0.2.7 enables authenticated remote attackers to execute arbitrary code via the `executeCode` function in `src/vm-executor.ts`, a component of the MCP `execute` tool. The underlying sandbox fails to isolate user-supplied input from the execution context, a class of vulnerability closely associated with Node.js `vm` module escapes. A publicly available proof-of-concept exists on GitHub, and the project maintainer has not responded to responsible disclosure, leaving all known deployments unpatched.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.
Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.
Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. The upstream fix makes KVM reject non-memory backing and inject a Synchronous External Abort (SEA) into the guest instead. There is no public exploit identified at time of analysis and EPSS is low (0.21%).
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
LDAP injection in Hyperledger fabric-ca allows unauthenticated network attackers to manipulate LDAP search filters at the CA enrollment endpoint before password validation occurs. Versions 1.5.20 and earlier are affected when the LDAP backend is configured; installations using the default local identity store are not exposed. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but a vendor-released patch is available in version 1.5.21.
Authenticated remote code execution in ImpressCMS allows administrators with access to the custom tag module to store and persistently execute arbitrary PHP code across all frontend page loads. The root mechanism is a decode-then-eval pattern: the application's renderWithPhp() method calls undoHtmlSpecialChars() on stored tag content before passing it to eval(), causing HTML Purifier sanitization to be bypassed entirely since purification operates on the encoded form. Publicly available exploit code exists on GitHub; this vulnerability has not been confirmed as actively exploited by CISA KEV at time of analysis.
Unauthenticated remote code execution in MindsDB Minds Platform (version 26.1.0 and earlier) lets any network-reachable attacker run arbitrary OS commands on the host by chaining two unprotected API endpoints. The attacker first sets a controlled LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submits a crafted prompt to POST /api/v1/responses/ that steers the Anton agent into calling its scratchpad tool, which passes attacker-influenced Python directly into exec() with no sandbox. Reported by VulnCheck with a maximum CVSS 4.0 score of 10.0 and CWE-94; no public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication make it high priority.
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Code injection in Devolutions PowerShell Universal 2026.2.3 and earlier allows any authenticated user granted settings management permissions to execute arbitrary PowerShell within the platform runtime. The vulnerability arises because setting values submitted through the settings interface are not properly escaped before being written to the configuration file, which is subsequently parsed and interpreted as executable code. No public exploit code has been identified at time of analysis, and SSVC reports no known active exploitation, but the technical impact is rated total given full arbitrary code execution capability.
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary PHP files on the server by exploiting a validation bypass in the Flex Objects plugin. The attacker crafts a ZIP archive containing PHP code, circumvents routine-name validation by substituting array notation for the expected string notation, and triggers the unZip routine to write the payload directly into the web root where it becomes immediately executable via HTTP. No public exploit has been identified at time of analysis, but the precise bypass technique disclosed in the advisory substantially lowers the barrier to exploitation for any attacker holding valid credentials.
Code injection in Elastic Fleet Server allows an authenticated Kibana administrator to execute arbitrary server-side scripts by embedding script syntax within an output configuration identifier. Affected are all Fleet Server versions prior to those addressed in Elastic advisory ESA-2026-93, where Kibana's failure to restrict identifier characters permits injected script content to be incorporated into scripts Fleet Server constructs during routine agent policy processing. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, but the confidentiality and integrity impact is rated high given full script execution capability within the Fleet Server process.
Remote code execution in Velocity.js (npm 'velocityjs') versions <= 2.1.6 lets an attacker who controls template content reach the JavaScript Function constructor and run arbitrary code in the server process. The earlier CVE-2026-44966/GHSA-j658-c2gf-x6pq fix only filtered constructor/__proto__/prototype in the #set assignment target, leaving property-read expressions in references.ts unguarded, so this is a straightforward bypass. Publicly available exploit code exists (a working PoC is published in the GHSA advisory and was vendor-verified on v2.1.6); no confirmed active exploitation (not in CISA KEV).
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Remote code execution is achievable in Data::MuForm::Localizer for Perl (versions through 0.05) when an application passes user-supplied locale identifiers - such as an Accept-Language header or locale query parameter - directly to the load_lexicon function, and an attacker can also place a crafted .po file at a readable path on the server. The module constructs the catalog path by unsanitized interpolation of the language attribute, enabling directory traversal, then eval-executes the Plural-Forms header of the loaded catalog as live Perl code, giving the attacker arbitrary OS command execution as the application process user. No public exploit code is referenced in available sources and this CVE is not listed in CISA KEV; a vendor patch is available from CPANSec.
Newline injection in rsync's name-converter uid/gid mapping interface (all versions before 3.5.0) allows local attackers to forge protocol messages by embedding newline characters in OS-level user or group names. Because the rsync daemon communicates with the name-converter over a pipe-based, line-oriented protocol, injected newlines create false protocol boundaries, causing the daemon to parse attacker-controlled strings as legitimate protocol directives and corrupting uid/gid mapping logic. No public exploit code and no CISA KEV listing are identified at time of analysis; rsync 3.5.0 was designated a major security release to address this issue.
Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.
Template injection in Oh My Posh prior to 29.35.1 allows arbitrary operating system command execution as the victim user when the shell prompt renders inside a directory whose name contains a Go template expression. The `setStyle()` function in `src/segments/path.go` passes raw filesystem path components - including untrusted directory names - directly into `template.Render`, whose function map exposes a `cmd` helper that invokes `env.RunCommand`. A publicly available proof-of-concept demonstrates command execution and file writes across Linux, macOS, and Windows. No active exploitation is confirmed in CISA KEV, but the attack surface includes any developer who `cd`s into a maliciously named directory on a shared or attacker-influenced filesystem.
Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. No public exploit code has been identified at time of analysis, but the CVSS 8.1 score reflects the potential for full confidentiality, integrity, and availability impact when the dual-control preconditions are met.
Arbitrary file truncation in GitPython before 3.1.56 enables an attacker who can control keyword arguments forwarded to Commit.count() to blank any file accessible at the process's privilege level by injecting output=<path>, which causes git rev-list to open and truncate the target to zero bytes before revision parsing. The unguarded sink at commit.py:290-291 is a distinct, overlooked parallel to the sibling iter_items method, which carries the check_unsafe_options guard; this gap persisted after GHSA-956x-8gvw-wg5v addressed iter_commits and blame. No CISA KEV listing is present, but a proof-of-concept was verified on tag 3.1.53 and is published in the GHSA advisory.
Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. Reported by VulnCheck and fixed by the vendor; no public exploit or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 base score of 9.0 reflects full compromise of confidentiality, integrity, and availability.
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. Reported by VulnCheck with a CVSS 4.0 score of 9.0; no public exploit is identified at time of analysis, though the technique is documented in detail in the vendor advisory.
Remote code execution and SSRF in FlowiseAI Flowise before 3.1.3 stems from a bypassable regex-based Python code validator in the CSV and Airtable Agent nodes, letting attackers smuggle malicious pandas calls through the unauthenticated prediction API via prompt injection. Because the validator blocklists rather than sandboxes, unblocked functions such as pd.read_json() can be abused to exfiltrate local datasets, reach internal services (SSRF), or execute arbitrary code. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the reporting vendor VulnCheck and a GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) document the issue.
Authenticated arbitrary Python code execution in FlowiseAI Flowise before 3.1.3 arises from the CSV Agent node's customReadCSV parameter, whose regex-based validator can be defeated with obfuscation to run attacker-supplied code inside an unsandboxed pyodide runtime with full host access. Any user able to build or edit a chatflow can escalate from application-level access to code execution on the server. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch exists in version 3.1.3.
Remote code execution in Flowise before 3.1.3 lets attackers run arbitrary Python on the host by abusing the Airtable Agent node. Crafted chatflow prompts carry obfuscated Python that slips past the pythonCodeValidator blocklist and executes inside an unsandboxed pyodide runtime with full access to the underlying OS. Reported by VulnCheck with a published GHSA advisory; no public exploit code is identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Sequential DNS transaction IDs in Ubuntu's DNS resolver implementation allow network-adjacent or on-path attackers to inject forged DNS responses by predicting transaction IDs. The vulnerability undermines the randomness that DNS relies on to authenticate responses, enabling cache poisoning attacks that redirect legitimate domain resolutions to attacker-controlled addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and has proven exploitable historically.
Ruby code injection in the amazing_print gem's AwesomeMethodArray#grep enables arbitrary Ruby code execution inside the host process when attacker-controlled strings containing interpolation syntax reach a dynamically constructed eval call. Specifically pinned to commit dc890dfafdf07088ea901df53c19c2710e5c5234, the flaw requires an application code path where externally influenced values can become method names processed by grep with a block. A publicly available proof-of-concept exists on GitHub Gist, and while the CVE is not in CISA KEV, the full-RCE impact in affected deployments warrants urgent remediation review.
Argument injection in PDF::WebKit through version 1.2 (Perl module, CPE mithaldu:pdf::webkit) lets an attacker who controls the source HTML dictate the wkhtmltopdf command-line options used for rendering. Because meta tags of the form <meta name="pdf-webkit-KEY" content="VALUE"> are converted into renderer switches without an allow-list and are merged last, a malicious document can enable options like --enable-local-file-access or --cookie-jar to read local files into the output PDF or write to attacker-chosen paths. No public exploit identified at time of analysis; a vendor patch is available. NVD scores this CVSS 9.8, though real-world exposure depends on the application feeding untrusted HTML to the module.
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.
Arbitrary code execution is achievable on Windows endpoints running IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13 when the software is installed in all-users mode, because the installer leaves one or more configuration files world-writable. Any local user with standard (non-administrator) privileges can modify these files to inject code that executes under the security context of other users who subsequently launch the application. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 7.8 High rating reflects the full confidentiality, integrity, and availability impact achievable once a local foothold exists.
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.
Command injection in stata-mcp (pip:stata-mcp < 1.19.0) enables full OS-level remote code execution against any principal that can invoke the `ado_package_install` MCP tool. The `package` argument is concatenated unsanitized into a Stata command string delivered via pexpect.sendline(), allowing embedded newline characters to inject arbitrary Stata commands - including the `shell` escape - that execute under the account running the MCP server. Because the tool is registered in the default `all` profile and `all` is the active default, no misconfiguration by the victim is required; a detailed proof-of-concept confirmed via Docker reproduction is publicly available in the GitHub advisory, and a vendor-released patch exists in v1.19.0.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.
Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%).
Local privilege escalation in Autodesk's ODIS (Online Deployment & Installation Service) installer allows a low-privileged local attacker to inject unauthenticated IPC messages into named pipes by executing a specially crafted binary on the target machine. The root cause is incorrect permission assignment (CWE-732) on named pipe resources, permitting unauthorized low-privileged processes to connect, write, or manipulate pipe ownership in ways that fully compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor has confirmed the issue and released a patched installer via advisory ADSK-SA-2026-0013.
Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). No public exploit code has been identified at the time of analysis, and it is not listed in CISA KEV, but the combination of unauthenticated access and full code execution makes it a top-priority patch.
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Arbitrary Python code execution in calibre's template engine affects all versions prior to 9.12.0, triggered when a user opens or imports a crafted EPUB, OPF, PDF, or OPF file containing malicious composite_template metadata. The root cause is a sandbox policy inheritance failure: nested formatter invocations via template(), eval(), re_group(), and list_re_group() instantiated fresh formatter objects without propagating allow_python_templates=False from the parent, allowing an embedded python: sub-template to bypass the restriction and reach compile_python_template. No public exploit has been identified at time of analysis, though the full patch diff is publicly visible on GitHub and makes the attack straightforward to reproduce.
OS command injection via the SNMP-handling code path in SonicWall Email Security 10.0.35.8405 and earlier grants a low-privileged, authenticated CLI user root-level code execution on the underlying appliance OS. The restricted CLI fails to sanitize user-supplied input before passing it to SNMP-related system commands, enabling full host compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total technical impact (full confidentiality, integrity, and availability loss) makes this a high priority for any deployment where CLI access is shared or weakly controlled.
Python code injection in FreeCAD's FEM Displacement Constraint dialog (all versions prior to 1.1.2) enables arbitrary code execution at the FreeCAD process's privilege level when a victim opens and accepts a weaponized project file. The root cause is an incomplete sanitization routine in TaskFemConstraintDisplacement.cpp that strips double-quotes from user-supplied formula fields but leaves backslash characters unhandled, allowing crafted input to escape the Python string boundary constructed by Gui::Command::doCommand(). SSVC rates technical impact as total and confirms a proof-of-concept exists; no CISA KEV listing is present, indicating no confirmed active exploitation campaigns at time of analysis.
Arbitrary JavaScript code execution in Faker.js prior to 10.5.0 is achievable when attacker-controlled strings reach the `faker.helpers.fake` template engine. The vulnerability resides in `fakeEval.resolveProperty` in `src/modules/helpers/eval.ts`, where direct property access on a function return value (`entrypoint?.[key]`) allows traversal to the `Function` constructor via `constructor.constructor`, a classic sandbox escape. Applications that pass any user-supplied input to `faker.helpers.fake` on the server side are directly exposed to remote code execution; in local/development contexts, exploitation requires low-privileged access to control template strings. No public exploit identified at time of analysis, and the fix is available in version 10.5.0.
Terminal escape sequence injection in Bash-it's barbuk theme (versions through 3.2.0) permits a local attacker to execute arbitrary OSC and CSI terminal control sequences in the context of a victim user's terminal emulator simply by placing a crafted pyproject.toml in any directory the victim navigates into. The root cause is that the barbuk theme's __python_venv_prompt function reads the requires-python field via awk without stripping control characters, then concatenates the raw value into PS1 through __prompt-command, causing injected sequences to render on every prompt refresh. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack is low-complexity given the vendor-confirmed fix commit.
Arbitrary code execution in the PapersGPT for Zotero plugin (versions ≤0.6.1) lets an attacker who controls or tampers with LLM responses run JavaScript in Zotero's chrome-privileged context. Text returned from the LLM endpoint is passed unsanitized into window.eval() in views.ts, so a poisoned PDF (prompt injection), a man-in-the-middle on the API channel, or a malicious custom endpoint can achieve full RCE. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV, but an upstream fix removing the eval sinks is available.
Unauthenticated remote code execution in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier lets remote attackers read sensitive data and write arbitrary files through a Zip-Slip path-traversal flaw during archive extraction, which can be leveraged to plant executable content and achieve code execution. The issue was disclosed by SonicWall PSIRT (SNWLID-2026-0011) and carries a CVSS 9.1 (Critical) rating. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'.
OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted CLI user to execute arbitrary commands as root via a crafted netmask parameter. The CVSS 7.8 score reflects complete confidentiality, integrity, and availability impact despite requiring local CLI access and low-level privileges. No public exploit code exists and CISA SSVC indicates no known exploitation at time of analysis, though successful exploitation yields full appliance compromise.
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and SSVC assessment characterizes exploitation status as none with a non-automatable attack path.
Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. No public exploit identified at time of analysis, though the CVSS 9.4 rating and 'total' technical impact make this a high-priority patch target.
MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.
CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature through user interaction, resulting in high-impact compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects a local attack vector requiring user interaction, with no privileges needed from the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE tag and full C/I/A impact make this a priority for environments running PowerShell on Windows.
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary code on a victim's machine with no prior authentication, provided the victim performs a user interaction - such as opening a malicious workspace, file, or URI. Classified under CWE-94 (Code Injection), the vulnerability carries a CVSS base score of 8.8, reflecting high impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing was identified at the time of analysis, but the attack complexity is rated Low, making reliable exploitation straightforward once a victim is lured.
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise across confidentiality, integrity, and availability on unpatched servers running SharePoint 2016 Enterprise, 2019, or Subscription Edition. The CVSS 8.8 rating (AV:N/AC:L/PR:L) reflects network exploitation requiring only low-privileged credentials, though the CVE description characterizes the primary effect as spoofing rather than full remote code execution - a tension that deserves verification against the Microsoft MSRC advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis, and SSVC rates exploitation as none and automatable as no, moderating the immediate response urgency.
Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.
Code injection in Vim's vimball plugin prior to version 9.2.0847 allows arbitrary operating-system command execution when a user installs a crafted vimball archive and later uninstalls it. An attacker who delivers a malicious vimball containing a member named .VimballRecord can overwrite the installation record with arbitrary Ex commands - including shell invocations via :! - which execute with the victim user's full privileges when vimball#RmVimball() is subsequently called. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV; the upstream patch is available as Vim 9.2.0847.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Terminal escape sequence injection in npm-check-updates through 23.0.2 enables a supply-chain attacker who controls a malicious npm package's metadata to embed arbitrary VT100/OSC control sequences in the `homepage` or `repository` URL fields of `package.json`. When developers run `ncu --format homepage` or `--format repo`, these unfiltered sequences are written directly to the terminal, allowing output overwriting via bare carriage returns, terminal title hijacking via OSC sequences, and other display manipulation on developer workstations or CI runners. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix PR's test suite demonstrates the exact attack pattern using OSC title-setting sequences and CR overwrites.
Remote OS command execution in SPIP before 4.4.18 is achievable by any authenticated editor-level user on SQLite-backed installations via the navigation menu endpoint. Array-typed GET parameters submitted to /ecrire/?exec=navigation bypass the CMS sanitization layer and break out of an internal PHP string evaluation context, enabling arbitrary command execution in the web server process. MySQL-backed deployments are not affected; no public exploit has been identified at time of analysis.
Arbitrary command execution in the goose AI agent's `goose review` command allows a malicious Git repository to run attacker-controlled code on the host before any model interaction occurs. The vulnerability exists in versions prior to 1.44.0 and stems from goose invoking the system `git` binary without suppressing the `core.fsmonitor` configuration key, meaning a repository's `.git/config` can nominate an arbitrary command that Git then executes during index refresh. Exploitation requires only that a user runs `goose review` inside a malicious repository, and the injected command inherits the user's full environment - including provider API keys and filesystem access. No public exploit has been identified at time of analysis, though the fix commit and advisory are public.
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free. Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init(): 1. Load kvm.ko and kvm-intel.ko, creating both caches. 2. Unload only kvm_intel, leaving kvm.ko loaded. 3. Reload kvm_intel and force initialization through the -ENOMEM path. KASAN reports: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm] Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe. With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.
Stale mode_callbacks pointer dereference in the Linux kernel xfrm IPTFS subsystem causes kernel panic when deferred garbage collection runs after the xfrm_iptfs module has been unloaded following a failed IPTFS state initialization. The xfrm subsystem's __xfrm_init_state() caches x->mode_cbs before IPTFS setup completes, but releases the temporary module reference immediately on failure - leaving a dangling callback table pointer that xfrm_state_gc_task later dereferences against an unloaded module. No public exploit code exists and EPSS is 0.17% (6th percentile), though the vendor-assigned CVSS of 7.8 reflects worst-case kernel memory impact if the race is won.
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.
Cache poisoning in CoreBunch/Instatic through version 0.0.14 allows unauthenticated remote attackers to corrupt the shared process-wide render cache by supplying a crafted originating-page URL via the `u` query parameter of the server island endpoint `GET /_instatic/hole/<nodeId>`. Because the cache is keyed solely on `nodeId` without incorporating the `u` value, a single poisoning request causes every subsequent visitor requesting that node to receive attacker-controlled fragment content. No public exploit code has been identified and no CISA KEV listing exists; the product's early-stage, niche deployment footprint limits real-world blast radius, but the unauthenticated network vector and low attack complexity make exploitation straightforward against exposed instances.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.