N A
Monthly
OS command injection in FastNetMon Community Edition through 1.2.9 lets an authenticated network attacker execute arbitrary shell commands via the MikroTik router integration plugin by influencing argv[] values passed to the unsanitized _log() function. The flaw mirrors a previously disclosed Juniper plugin issue in the same project, and while a public technical write-up exists at lorikeetsecurity.com, no public exploit code or active exploitation has been identified, with EPSS at 0.05% (17th percentile).
Heap buffer overflow in FastNetMon Community Edition through 1.2.9 originates from a CWE-190 integer overflow in the BGP AS_PATH attribute encoder (IPv4UnicastAnnounce::get_attributes() in src/bgp_protocol.hpp). When an AS_PATH carries more than 63 ASNs, the computed attribute length is silently truncated into a uint8_t field used for buffer sizing while the full data is still written, corrupting the heap. The CVSS 9.8 score implies remote unauthenticated code execution, though the flaw lives in FastNetMon's outbound BGP announcement encoder; no public exploit is identified at time of analysis and no EPSS or KEV data was supplied.
Heap corruption in FastNetMon Community Edition through 1.2.9 allows authenticated local users to trigger an integer overflow in the packet capture buffer allocation routine, resulting in undersized allocations followed by out-of-bounds heap writes during packet storage. The flaw stems from 32-bit unsigned arithmetic in allocate_buffer() in src/packet_storage.hpp, where a sufficiently large ban_details_records_count configuration value causes the memory size calculation to wrap. No public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.01%.
Out-of-bounds read in FastNetMon Community Edition through 1.2.9 allows remote unauthenticated attackers to leak adjacent process memory by sending crafted BGP UPDATE messages containing malformed MP_REACH_NLRI IPv6 attributes. The flaw resides in decode_mp_reach_ipv6() where attacker-controlled length fields drive memcpy operations without bounds validation, and is acknowledged by an in-source TODO comment by the maintainer. No public exploit identified at time of analysis, EPSS is low (0.03%), and CISA SSVC classifies exploitation as 'none' but 'automatable: yes', meaning weaponization is technically straightforward if a threat actor invests effort.
Unauthenticated gRPC API exposure in FastNetMon Community Edition through 1.2.9 allows adjacent network attackers to invoke security-critical RPC methods including ExecuteBan and ExecuteUnBan without credentials. The server explicitly uses grpc::InsecureServerCredentials() on port 50052, enabling attackers to blackhole legitimate traffic via BGP announcements, disable active DDoS mitigations, and trigger external script execution via popen(). No public exploit identified at time of analysis, and EPSS is low at 0.03%, but CISA SSVC rates technical impact as total.
Man-in-the-middle interception of telemetry traffic affects FastNetMon Community Edition through version 1.2.9 due to missing TLS certificate validation in outbound HTTPS connections. Network-positioned attackers can intercept, modify, or redirect telemetry data sent to community-stats.fastnetmon.com - including system fingerprints, kernel version, traffic statistics, and configuration details - and potentially serve malicious responses. EPSS is very low (0.01%), and there is no public exploit identified at time of analysis, though a technical write-up by Lorikeet Security details the root cause.
Remote code execution in FastNetMon Community Edition through 1.2.9 stems from an off-by-one heap write in the pervasively-used dynamic_binary_buffer_t class, reachable by anyone who can send NetFlow, sFlow, IPFIX, or BGP traffic to the DDoS-detection appliance. Because the flawed buffer is exercised during BGP encoding/decoding, NetFlow template parsing, and Flow Spec NLRI construction, an unauthenticated network attacker can corrupt adjacent heap metadata and potentially execute arbitrary code. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), but no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Configuration injection in FastNetMon Community Edition through 1.2.9 allows an attacker who controls the attacker IP string passed to the Juniper integration plugin to inject arbitrary Juniper NETCONF set/delete commands, leading to full router compromise. The flaw lives in the PHP-based Juniper plugin where unsanitized argv input is interpolated into NETCONF commands, and although no public exploit identified at time of analysis (EPSS 0.03%), the technical impact is rated total under SSVC and CVSS scores 8.1.
Clickjacking in ClipBucket v5 5.5.2 lets an attacker embed the application's login page in a hidden iframe due to missing HTTP response security headers, enabling UI-redressing attacks that can capture credentials or trick authenticated users into unintended actions. The flaw is classified CWE-1021 (Improper Restriction of Rendered UI Layers), not the 'arbitrary code execution' the raw description claims — the referenced technical writeup and the CVSS profile (UI:R) both point to a framing/credential-theft issue. EPSS is very low (0.05%, 14th percentile) and CISA SSVC scores exploitation as 'none', indicating no observed active exploitation.
Remote code execution in Easy Chat Server 3.1 stems from a buffer overflow in the chat message handling functionality, letting remote attackers overwrite memory to leak sensitive data and run arbitrary code on the hosting Windows machine. The product is a small standalone web-based chat server historically used as an exploit-development target, and publicly available exploit code exists (GitHub PoC), though EPSS is low (0.18%, 39th percentile) and it is not on CISA KEV. No public evidence of active in-the-wild exploitation was identified at time of analysis.
Cross-Site Request Forgery in InfoScale 9.1.3 Operations Manager (VIOM) web application allows remote attackers on the adjacent network to coerce an authenticated user with an active session into clicking a malicious link that triggers unintended state-changing actions in VIOM. No public exploit identified at time of analysis, but the CVSS 8.8 score reflects high impact on confidentiality, integrity, and availability if a privileged VIOM operator is targeted.
Stack-based buffer overflow in the EPSON L14150 (firmware FL27PB) is reachable remotely and unauthenticated through the RAW/JetDirect print service on TCP port 9100, letting an attacker crash or potentially execute code on the device. The MITRE description claims arbitrary code execution, though the CVSS vector scores only availability impact (C:N/I:N/A:H) and CISA SSVC rates technical impact as 'partial', so the practical outcome is more consistent with a denial-of-service/device crash than confirmed RCE. Publicly available exploit code exists (POC on GitHub/gist), but it is not in CISA KEV and EPSS is low (0.19%).
Privilege escalation in Veritas InfoScale CmdServer prior to version 7.4.2 allows authenticated remote attackers to bypass access control restrictions and achieve full compromise of confidentiality, integrity, and availability on the targeted host. The flaw is tagged as an authentication bypass by intelligence sources and carries a CVSS 8.8 (High) rating; no public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Denial-of-service in ExifReader (npm package mattiasw/ExifReader) before 4.39.0 allows remote attackers to exhaust memory by submitting a crafted image whose ICC profile contains a malformed mluc tag. A specially crafted record count combined with a zero record size causes the parser to loop on the same record while continuously appending entries to an array, driving memory growth until the host process crashes. CVSS 4.0 base score is 7.7 with proof-of-concept exploit maturity (E:P), and publicly available exploit code exists via the referenced gist; no active in-the-wild exploitation is indicated.
Authorization bypass in Innoshop 0.6.0 allows authenticated frontend users to directly invoke backend administrative interfaces, enabling privileged operations outside their intended scope. The CVSS 7.3 score reflects low-impact gains across confidentiality, integrity, and availability achievable without prior authentication to the admin panel. No public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.02% (5th percentile), indicating minimal observed attacker interest so far.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deserialize attacker-controlled data via the bundled JSONSerializer or CBORSerializer. The unmarshal_object routine dynamically imports modules and invokes __setstate__ on arbitrary classes, letting an attacker pivot an untrusted payload into code execution; publicly available exploit code exists, though EPSS remains low at 0.06% (19th percentile).
Remote command execution in hitarth-gg Zenshin before 2.7.0 allows unauthenticated attackers to run arbitrary OS commands by sending a crafted url query parameter to the /stream-to-vlc Express route, which passed user input directly into a Node.js child_process.exec shell invocation. No public exploit identified at time of analysis, but a detailed write-up gist and the upstream fix commit publicly expose the vulnerable code path. EPSS is low (0.13%, 32nd percentile) but CVSS is 9.8 reflecting the trivial nature of the injection.
SQL injection in BillaBear (all versions prior to January 2026) allows authenticated users holding the ROLE_ACCOUNT_MANAGER role to execute arbitrary SQL commands via the EventRepository component. The flaw stems from unsanitized filter identifier keys being concatenated into queries through sprintf(), and while no public exploit identified at time of analysis is listed in KEV, two CVE-referenced gists suggest detailed technical write-ups are publicly available. EPSS is very low (0.01%), but the high CVSS of 8.8 and clear exploitation path make this a meaningful risk for any deployed instance.
Privilege escalation in LalanaChami Pharmacy Management System (commit 5c3d028) allows any remote unauthenticated attacker to register a new account with administrator privileges by simply including a role parameter in the signup request body. The /api/user/signup endpoint trusts client-supplied role values without server-side validation, granting full administrative access in a single HTTP call. No public exploit identified at time of analysis, and EPSS is very low (0.04%), but the trivial nature of the flaw means weaponization is straightforward once anyone notices the gist already documenting the issue.
OS command execution as root in the Panabit PAP-XM320 application delivery/bandwidth-management appliance (versions up to and including v7.7) is possible when an authenticated user submits action=runcmd to the /cgi-bin/tools/ajax_cmd CGI endpoint, letting attacker-supplied input reach a shell. Because the CGI runs with root privileges, any low-privileged authenticated account can achieve full device takeover. A public proof-of-concept write-up exists (SSVC exploitation: poc), but there is no public exploit identified as actively used in the wild; EPSS is low at 0.10% (28th percentile).
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump all user records including bcrypt password hashes, tamper with drug inventory, and read private medical prescription data. The flaw stems from missing authentication middleware on backend Express routes such as /api/user/getUserData and /api/doctorOder. Publicly available exploit code exists, though EPSS rates exploitation probability at only 0.06% (17th percentile), consistent with a low-deployment open-source project rather than mass exploitation.
Arbitrary code execution in Scalar Astro v0.1.13 allows remote unauthenticated attackers to upload malicious SVG files through the scalar_url query parameter of the Scalar Proxy endpoint. The flaw stems from inadequate validation in the proxy's file handling logic and, per CVSS, requires no authentication or user interaction, though EPSS rates real-world exploitation probability at only 0.02%. No public exploit identified at time of analysis, though a related XSS/Open-Redirect proof-of-concept repository is referenced.
Authentication bypass in the embedded HTTP server of Panabit PAP-XM320 (versions up to and including v7.7) lets remote unauthenticated attackers gain administrative access by supplying a crafted session cookie. The server validates sessions with a filesystem existence check against the unsanitized cookie value, so directory traversal in that value satisfies the check and defeats authentication. SSVC rates technical impact as total and the attack as automatable, and publicly available exploit code exists, though EPSS remains modest at 0.43%.
Server-side request forgery in scalar/astro v0.1.13 allows remote unauthenticated attackers to coerce the backend into making HTTP requests to attacker-controlled destinations via the scalar_url query parameter of the Scalar Proxy endpoint. Exploitation can expose authentication cookies and headers forwarded by the proxy, enabling account takeover and potential privilege escalation. Publicly available exploit code exists, though EPSS is low (0.03%) suggesting limited mass exploitation at this time.
Stack-based buffer overflow in lwIP's SNMPv3 USM handler exposes embedded and IoT devices running versions 2.1.0 through 2.2.1 to remote unauthenticated code execution. The flaw in snmp_parse_inbound_frame() allowed an attacker-controlled msgAuthenticationParameters TLV length to be used directly in a stack buffer copy without bounds validation - a protective assertion had been explicitly commented out in the codebase. With CVSS 4.0 scoring 8.9, SSVC classifying the attack as automatable with total technical impact, and proof-of-concept code in existence (E:P), this is a high-priority remediation target for any network-accessible lwIP deployment with SNMPv3 enabled; no CISA KEV listing has occurred at time of analysis.
Arbitrary file disclosure in HSC MailInspector v5.3.3-7 allows unauthenticated remote attackers to read sensitive files from the host via a path traversal flaw in the exposed /vendor/phpunit/phpunit.php endpoint. The CVSS 7.5 rating reflects high confidentiality impact with no required privileges or user interaction, though EPSS remains very low at 0.05% (15th percentile) and there is no public exploit identified at time of analysis. The exposure of a PHPUnit development artifact in a production path mirrors a long-standing class of PHP supply-chain misconfigurations.
Unauthenticated path traversal in HSC MailInspector 5.3.3-7 allows remote attackers to read arbitrary files from the underlying operating system by manipulating the 'text' parameter of the /tap/dw.php endpoint. Public exploit details are disclosed on GitHub (sql3t0/cve-disclosures), though EPSS probability remains low (0.05%) and the issue is not currently listed in CISA KEV. The flaw enables disclosure of sensitive system files such as configuration files, credentials, and mail-related data without prior authentication.
Remote code execution in Offline Hospital Management System 5.3.0 stems from an insecure Electron renderer configuration where Node.js integration is enabled while context isolation is disabled, allowing JavaScript in the renderer to invoke Node.js APIs and run arbitrary OS commands. The flaw carries a CVSS 7.3 with network attack vector and no privileges required, though EPSS is low at 0.06% and no public exploit identified at time of analysis beyond a Medium write-up describing the technique.
Sensitive information disclosure in the PrestaShop upsshipping module (all versions through at least 2.4.0) lets remote attackers read exposed data by directly requesting the /modules/upsshipping/logs/ directory and the lib/UPSBaseApi.php component. Publicly available exploit code exists (SSVC 'poc'), the flaw is unauthenticated over the network (CVSS 7.5, PR:N), and CISA's SSVC framework rates it automatable, though EPSS remains low at 0.04%. There is no evidence of active exploitation in the wild.
Privilege escalation in Thermo Fisher Scientific Torrent Suite Dx software (all versions through 5.14.2) allows an authenticated, limited-privilege user to gain administrator-level control by abusing specific exposed system interfaces. The flaw grants full read/write/availability impact over the sequencing-analysis platform (CVSS 8.8). No public exploit identified at time of analysis, and CISA SSVC records no observed exploitation, though the technical impact is rated total.
Prototype pollution in the jsondiffpatch JavaScript library before 0.7.6 allows attackers to modify Object.prototype by supplying crafted delta documents to jsondiffpatch.patch() or JSON Patch documents to the jsonpatch formatter's patch() API. Because attacker-controlled key names and JSON Pointer path segments were used to traverse and mutate objects without filtering __proto__, constructor, or prototype, any application that feeds untrusted diffs into the library can have global object behavior tampered with. A public POC exists in the Snyk advisory and an accompanying gist, but there is no public exploit identified at time of analysis (not on CISA KEV).
Stack buffer overflow in PostgreSQL's refint module allows low-privileged database users to execute arbitrary code as the database operating system user across all supported versions before 14.23, 15.18, 16.14, 17.10, and 18.4. The vulnerability enables two distinct attack paths: direct stack overflow leading to OS-level code execution, and SQL injection when applications expose user-controlled columns configured as refint cascade primary keys. With CVSS 8.8 (AV:N/AC:L/PR:L) and network-based exploitation requiring only low-privilege database credentials, this represents a critical privilege escalation risk for PostgreSQL deployments. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Denial of service in PostgreSQL allows remote unauthenticated attackers to crash the database server via recursive SSL/GSS negotiation when connecting to AF_UNIX or TCP sockets (if SSL and GSS are both disabled). Affects all PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23. No active exploitation confirmed (not in CISA KEV). Vendor-released patches available across all supported major versions. EPSS data not available, but CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates high availability impact with low barrier to exploitation.
PostgreSQL libpq client library allows malicious server superusers to execute arbitrary code on connecting clients by overwriting stack buffers via unbounded responses to PQfn() calls. The vulnerability affects lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions used by psql and pg_dump utilities. A compromised or malicious PostgreSQL server can exploit clients running these common administrative tools during routine operations like database backups or large object exports. EPSS and KEV data not available for this recent CVE. CVSS 8.8 reflects the network attack vector with user interaction requirement (connecting to malicious server).
SQL injection in PostgreSQL's pg_createsubscriber utility escalates privileges from pg_create_subscription to superuser, enabling arbitrary SQL execution. Affects PostgreSQL versions 17.0-17.9 and 18.0-18.3; exploitation requires high-privilege access (pg_create_subscription rights) but occurs remotely without additional complexity. Attack triggers when pg_createsubscriber next executes. Fixed in PostgreSQL 18.4 and 17.10. No CISA KEV listing or public exploit identified at time of analysis, but the technical simplicity (AC:L) and privilege escalation nature present moderate risk for multi-tenant or hosted PostgreSQL environments where subscription management permissions are delegated.
Symlink following vulnerabilities in PostgreSQL pg_basebackup and pg_rewind enable database superusers to overwrite arbitrary files on the destination server's filesystem, leading to local OS account takeover. Exploitation requires a malicious origin database superuser convincing an administrator to run these backup/replication tools (UI:R in CVSS), with practical impact limited to scenarios where database files are transferred between systems or snapshotted before server restart. No public exploit identified at time of analysis. CVSS 8.8 reflects theoretical severity, but real-world risk depends on specific operational workflows involving backup file transfers across trust boundaries.
Remote code execution in PostgreSQL (versions 14.x-18.x) allows authenticated database users to execute arbitrary code as the database operating system user via integer wraparound vulnerabilities in multiple server features. By passing gigabyte-scale inputs to affected database functions, attackers trigger allocation undersizing that leads to out-of-bounds writes. No active exploitation confirmed (not in CISA KEV), but CVSS 8.8 with network vector and low complexity indicates high exploitability once technical details become public. EPSS data not available at time of analysis.
Command injection in CFEngine Enterprise and Community editions before versions 3.21.8, 3.24.3, and 3.27.0 enables remote unauthenticated attackers to execute arbitrary commands on the system. The vulnerability has an EPSS score of 0.15% indicating relatively low exploitation probability, and no public exploit identified at time of analysis. SSVC framework rates this as automatable with total technical impact, suggesting high potential severity if exploited.
Arbitrary file upload in qihang-wms (启航电商WMS) allows unauthenticated remote attackers to execute arbitrary code by uploading malicious files through the ShopOrderImportController component. The vulnerability affects commit 75c15a and potentially other versions of this warehouse management system. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed by CISA KEV at time of analysis. Public exploit documentation exists via GitHub/Gist references.
Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total.
Local privilege-driven data corruption in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 allows a privileged local adversary to trigger an out-of-bounds write (CWE-787) in a Ring 1 device driver, causing denial of service and integrity loss. The flaw affects the vulnerable system's integrity and availability (both High) with no confidentiality impact, and carries a CVSS 4.0 base score of 8.3. There is no public exploit identified at time of analysis, and the EPSS probability is negligible at 0.01%.
Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation.
Escalation of privilege in Intel's Slim Bootloader UEFI firmware allows a privileged local adversary to trigger an integer overflow (CWE-190) and execute code within the firmware/boot context. Exploitation requires existing high privileges and local access with a specific attack requirement present, but a successful attack fully compromises confidentiality, integrity, and availability of both the vulnerable firmware and the subsequent system. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), consistent with SSVC exploitation status of 'none'.
Local privilege-abusing denial of service and information disclosure in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger an out-of-bounds read (CWE-125) in the Ring 1 device-driver layer, potentially crashing the host and exposing adjacent memory. The flaw carries a CVSS 4.0 base score of 8.3 driven by high confidentiality and availability impact plus a scope change into subsequent systems. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC rates exploitation as 'none' and non-automatable.
Local privilege escalation in Intel QuickAssist Adapter 8960 software before version 1.13 allows an authenticated, low-privileged user to abuse an untrusted pointer dereference in a Ring 3 user-application component to gain elevated privileges on the host. The flaw yields total impact (high confidentiality, integrity, and availability) on the affected system and carries a CVSS 4.0 base score of 8.5. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at just 0.01%.
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configurations arises from a use-after-free in the BDAT/CHUNKING body-parsing path. An unauthenticated network attacker who sends a TLS close_notify mid-body during a CHUNKING transfer followed by a trailing cleartext byte on the same TCP connection can corrupt the heap and, per the advisory, execute arbitrary code. Publicly available exploit code exists, but there is no CISA KEV listing and EPSS is very low (0.06%, 18th percentile), so this is best treated as a high-impact issue with no confirmed active exploitation yet.
Unauthenticated remote attackers can completely destroy the mem0 v1.0.0 memory database by sending a DELETE request to the /memories endpoint, which executes DROP TABLE SQL statements without authentication or authorization checks. This causes irreversible data loss and total service denial for all users. EPSS score of 0.03% suggests low observed exploitation probability despite the CVSS 9.1 critical rating, likely due to mem0's limited deployment footprint. No public exploit code or active exploitation (CISA KEV) confirmed at time of analysis, but SSVC indicates the vulnerability is automatable with a single HTTP request.
Unauthenticated remote attackers can modify or delete arbitrary memory records in mem0 1.0.0 server by directly calling unprotected API endpoints including PUT /memories/{memory_id}. The vulnerability stems from complete absence of authentication and authorization controls on critical memory management functions, allowing data manipulation and loss without any verification of requester identity. EPSS score of 0.06% (18th percentile) indicates low exploitation probability in the wild, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary code execution occurs in the llm CLI tool (versions through 0.27.1) when attackers social-engineer victims into running crafted commands containing malicious Python code in the --functions argument. The tool directly executes this code via unsafe exec() without sanitization, enabling full system compromise. CVSS 9.8 assigns network attack vector and no authentication, but real-world exploitation requires local command execution by a tricked user, creating a significant disparity between the vector and actual attack prerequisites. EPSS score of 0.02% (5th percentile) suggests minimal automated exploitation risk, and no active exploitation or public POC has been identified at time of analysis.
Arbitrary code execution in Ludwig framework ≤0.10.4 occurs when attackers supply malicious pickle files to the predict() method, which deserializes untrusted data without validation using pandas.read_pickle(). Remote unauthenticated attackers can achieve full system compromise by exploiting the automatic file format detection mechanism that processes .pkl files through Python's unsafe pickle module. EPSS score of 0.06% (19th percentile) suggests low current exploitation likelihood despite the critical CVSS 9.8 rating, though no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Horovod distributed training framework (versions through 0.28.1) allows unauthenticated network attackers to execute arbitrary code on worker nodes by injecting malicious pickle payloads into the KVStore HTTP server. The vulnerability combines unauthenticated write access to the KVStore coordination server with unsafe deserialization using cloudpickle.loads(), enabling trivial exploitation against any reachable Horovod cluster. EPSS score of 0.12% (31st percentile) suggests low widespread exploitation probability despite critical CVSS 9.8 rating, and no active exploitation confirmed (not in CISA KEV). Public exploit development is highly feasible given the straightforward attack path and publicly documented details.
Arbitrary code execution in imgaug library (versions through 0.4.0) occurs when the BackgroundAugmenter class deserializes malicious pickle payloads without validation in its multiprocessing worker method. Attackers who can influence queue data-through compromised shared queues, malicious input scripts, or social engineering-can achieve remote or local code execution depending on deployment context. CVSS 9.8 critical severity reflects network-based exploitation without authentication, though EPSS probability is low (0.02%, 6th percentile), indicating limited observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.
Remote code execution in Ludwig framework ≤0.10.4 allows unauthenticated network attackers to execute arbitrary code by supplying a malicious PyTorch model file to the ludwig serve endpoint. The vulnerability stems from unsafe deserialization in the model loading component, which uses torch.load() without the weights_only=True safety parameter. With CVSS 9.8 (critical network vector, no authentication required) but only 0.02% EPSS, this represents a high-severity issue in vulnerable deployments, though widespread exploitation has not been observed. No CISA KEV listing or public POC identified at time of analysis.
Remote code execution in Cognee v0.4.0 and earlier allows unauthenticated attackers to execute arbitrary Python code via the notebook cell execution API endpoint. The vulnerability stems from unsafe use of Python's exec() function without sandboxing or validation, enabling complete system compromise with server process privileges. While not actively exploited (not in KEV), the vulnerability is automatable with total technical impact per SSVC framework, though EPSS indicates low exploitation probability at 0.06%.
Remote code execution in CosyVoice (FunAudioLLM's open-source text-to-speech toolkit) up to commit 6e01309 allows an attacker to run arbitrary Python on a victim's host when the victim loads an attacker-supplied model directory. The flaw stems from calling torch.load() without weights_only=True, so malicious pickle payloads embedded in .pt model files execute during model loading via the web interface. There is no public exploit identified at time of analysis and EPSS is very low (0.05%, 17th percentile), but SSVC rates the technical impact as total.
Remote code execution in Guardrails AI through version 0.6.7 occurs when installing validator packages via the Hub mechanism. The guardrails hub install command dynamically executes post-installation scripts from Hub manifests without validating the script path or content, allowing attackers who publish malicious packages to achieve arbitrary code execution on victim systems during package installation. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) but only 0.06% EPSS (18th percentile), this represents a supply chain attack requiring user-initiated installation rather than widespread automated exploitation. No active exploitation confirmed (not in CISA KEV), and patch availability not confirmed from available data.
Remote code execution in Mamba language model framework (through version 2.2.6) allows unauthenticated attackers to execute arbitrary Python code by publishing malicious models on HuggingFace Hub. When victims call MambaLMHeadModel.from_pretrained() on a weaponized model repository, insecure pickle deserialization executes attacker-controlled code in the context of the victim's process. Despite the critical CVSS 9.8 score and network attack vector requiring no authentication, EPSS probability remains extremely low (0.02%, 5th percentile), suggesting limited real-world exploitation to date. No CISA KEV listing or public POC identified at time of analysis.
Remote code execution in Adversarial Robustness Toolbox (ART) through version 1.20.1 allows unauthenticated network attackers to execute arbitrary Python code by uploading malicious PyTorch model files to pipeline-accessible object storage locations. The vulnerability stems from unsafe use of torch.load() without the weights_only=True parameter in the Kubeflow component's model loading process, enabling Pickle deserialization of arbitrary objects. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) but only 0.06% EPSS exploitation probability (19th percentile), this represents a critical-severity issue with low observed real-world targeting, likely due to the specialized nature of ML robustness evaluation deployments. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis.
Command injection in Adversarial Robustness Toolbox (ART) up to version 1.20.1 enables remote code execution through unsafe eval() usage in Kubeflow pipeline components. The robustness_evaluation_fgsm_pytorch.py script directly evaluates user-controlled --clip_values and --input_shape arguments without sanitization, allowing Python code injection. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicating network-exploitable unauthenticated access, this represents critical risk in automated ML pipeline environments where attackers can control pipeline configurations. EPSS score of 0.02% (5th percentile) suggests low observed exploitation activity, though the attack vector and ML tooling context create significant supply chain risk in CI/CD and research environments.
Remote code execution in Adversarial Robustness Toolbox (ART) versions through 1.20.1 allows unauthenticated network attackers to execute arbitrary Python code via unsafe eval() usage in the Kubeflow robustness evaluation component. The vulnerability accepts unsanitized user input for LossFn and Optimizer parameters in PyTorch model evaluations, enabling complete system compromise. With CVSS 9.8 but only 0.06% EPSS score (18th percentile), this represents a severe theoretical risk that has not yet manifested in widespread exploitation. No public exploit code identified at time of analysis, and the vulnerability requires specific deployment of ART's Kubeflow integration component.
Arbitrary code execution in Snorkel library (Python) through version 0.10.0 enables remote attackers to execute code by supplying malicious pickle files to the BaseLabeler.load() method. The vulnerability stems from unsafe deserialization using pickle.load() without input validation, allowing attackers to craft serialized objects that execute arbitrary commands during deserialization. With EPSS at 6th percentile, exploitation probability remains relatively low despite the critical CVSS score, and no active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.
Remote code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load untrusted model files via MultitaskClassifier.load(). The vulnerability exploits insecure Python object deserialization through torch.load(), allowing attackers to embed malicious code in model weight files that executes upon loading. EPSS score of 0.06% (19th percentile) suggests low observed exploitation probability in the wild, though SSVC framework indicates total technical impact once exploited. No public exploit code or active exploitation confirmed at time of analysis, but exploitation requires only that a data scientist or ML engineer load a malicious .pkl model file.
Remote code execution in superduper (Python library) through version 0.10.0 allows unauthenticated network attackers to execute arbitrary system commands by submitting malicious query strings with embedded Python code. The _parse_op_part() function in query.py uses unsafe eval() with inadequate context restrictions, enabling attackers to import modules (such as os) and achieve complete server compromise. EPSS score is low (0.07%, 20th percentile) and no active exploitation is confirmed (CISA KEV absent), but SSVC framework rates technical impact as total. User interaction is required (CVSS UI:R), reducing automated exploitation risk. Authentication requirements not confirmed from available data - CVSS vector shows PR:N (no privileges required) but UI:R suggests user-triggered queries.
Arbitrary code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load malicious model checkpoint files through the Trainer.load() method. The vulnerability stems from unsafe PyTorch deserialization that processes untrusted Pickle objects without the weights_only security parameter. Attackers can embed malicious Python code in model files distributed through repositories, shared datasets, or social engineering campaigns. Despite the 8.8 CVSS score indicating critical severity, EPSS scoring at 0.06% (19th percentile) suggests very low real-world exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Remote code execution in TinyZero's HDFS utilities allows unauthenticated attackers to execute arbitrary OS commands via crafted file paths passed through the Hydra configuration framework. The vulnerability stems from unsanitized user input directly interpolated into os.system() shell commands within the _copy() function, affecting all deployments through commit 6652a63c57fa. No active exploitation confirmed at time of analysis, but EPSS score of 0.14% (33rd percentile) suggests below-average likelihood despite CVSS:9.8 critical rating. The attack requires network access to the TinyZero training process and ability to control path parameters via configuration.
Remote code execution in PySyft Datasite/Server versions 0.9.5 and earlier allows unauthenticated attackers to execute arbitrary Python code on the server through the function submission mechanism. The vulnerability stems from insufficient validation and sandboxing of user-submitted Python functions decorated with @sy.syft_function(), which are executed using unsafe exec() and eval() calls after approval. With an EPSS score of 0.04% and no current KEV listing, this appears to be a high-severity vulnerability without confirmed active exploitation.
Arbitrary code execution occurs in PyTorch Lightning 2.6.0 and earlier when loading malicious checkpoint files. The LightningModule.load_from_checkpoint() method deserializes untrusted Pickle data without security restrictions, allowing attackers to execute arbitrary Python code when victims open crafted .ckpt files. EPSS score of 0.06% (19th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis. Attack requires local access and user interaction (opening a malicious checkpoint), limiting remote attack scenarios to social engineering or supply chain compromise.
Remote unauthenticated attackers can delete arbitrary ElasticSearch documents and MinIO storage files in nexent v1.7.5.2 via the unprotected DELETE /{index_name}/documents endpoint. The backend service fails to authenticate requests or validate the path_or_url parameter, enabling mass data destruction and denial of service. EPSS probability (0.12%) indicates low predicted exploitation likelihood, and no active exploitation or public exploit code has been identified at time of analysis, though the CVSS 9.1 reflects the severe impact of unauthenticated remote data deletion.
Unauthenticated remote attackers can delete arbitrary files from nexent v1.7.5.2's MinIO storage backend via an unprotected DELETE endpoint, leading to data loss and denial of service. The /storage/{object_name:path} API lacks authentication, authorization, and input validation (CWE-552). CVSS 9.1 reflects critical severity, though EPSS score of 0.08% (23rd percentile) and SSVC 'exploitation: none' indicate no observed active exploitation or public exploit code at time of analysis. SSVC marks this as 'automatable: yes' with 'technical impact: partial', suggesting straightforward exploitation once discovered but limited scope beyond data integrity/availability impacts.
Arbitrary code execution in optimate's neural_magic_training.py allows remote attackers to execute Python code by supplying a malicious directory path containing a crafted module.py file. The _load_model() function directly executes file contents via Python's exec() without validation. CVSS 9.8 reflects network vector with no authentication, but EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). Vulnerability exists in commit a6d302f912b481c94370811af6b11402f51d377f from July 2024. Affects organizations using optimate for neural network model optimization.
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to execute malicious Python code by providing crafted PyTorch checkpoint files. The vulnerability stems from insecure deserialization where torch.load() processes .pt files without the weights_only=True safeguard, enabling pickle-based arbitrary object instantiation. Despite a critical CVSS 9.8 score, EPSS probability is low (0.06%, 19th percentile) and no public exploit or active exploitation is confirmed, suggesting limited real-world targeting to date. SSVC assessment indicates total technical impact with automatable exploitation potential, making this a priority for organizations using ml-engineering scripts in production environments.
Remote code execution in Optimate's neural_magic_training.py script allows authenticated attackers to execute arbitrary code via malicious PyTorch model files. The vulnerability stems from unsafe deserialization when loading model state dictionaries without PyTorch's weights_only=True security flag, enabling pickle-based arbitrary object execution. With an EPSS score of 0.06% and no confirmed exploitation, this represents a moderate risk primarily in environments where users can upload or specify model files.
Insecure deserialization in Optimate's neural_magic_training.py script enables remote code execution when loading PyTorch model files. The _load_model() function uses torch.load() without the weights_only=True security parameter, allowing attackers with low privileges to execute arbitrary Python code by providing malicious .pt or .pth files via the --model command-line argument. EPSS indicates low exploitation probability at 0.06% with no active exploitation confirmed.
Remote code execution in automagik-genie 2.5.27 MCP Server occurs when processing transcripts from attacker-controlled external FORGE_BASE_URL endpoints. Exploitation chains command injection in the readTranscriptFromCommit function's view_task parameter to execute arbitrary system commands on the server. A proof-of-concept exploit exists, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Command injection in EDIMAX BR-6428nS V3 wireless router firmware 1.15 allows authenticated attackers to execute arbitrary system commands via crafted input to WLAN configuration interface. The vulnerability requires low-privilege network authentication but no user interaction, enabling complete device compromise including credential theft, traffic interception, and pivot attacks into connected networks. EPSS score of 0.17% suggests low probability of mass exploitation, though a proof-of-concept is publicly available on GitHub, lowering the barrier for targeted attacks against exposed management interfaces.
Remote code execution in QuickJS-NG 0.12.1 allows unauthenticated network attackers to execute arbitrary code through the js_mapped_arguments_mark function. The vulnerability enables attackers to achieve code injection with low confidentiality, integrity, and availability impact via network-accessible JavaScript engine exploitation. EPSS score of 0.02% (5th percentile) indicates very low predicted exploitation probability, and no active exploitation has been publicly reported at time of analysis.
Broken object-level authorization in HireFlow v1.2 exposes all candidate profiles and interview notes to any authenticated user via direct object reference. Attackers with valid low-privilege credentials can enumerate integer IDs in /candidate/<id> and /interview/<id> endpoints to access the entire database, enabling full horizontal privilege escalation and complete data breach. No vendor patch identified at time of analysis. EPSS data not available; no evidence of active exploitation (not in CISA KEV).
Arbitrary code execution in the flash-attention project's training script (up to commit e724e2588cbe754beb97cf7c011b5e7e34119e62) allows an attacker to run Python code by supplying a malicious Hydra configuration. The script registers Python's eval() as a Hydra resolver named 'eval', so any config value using the ${eval:...} syntax is executed when a victim launches training with that configuration. No public exploit has been identified and EPSS probability is very low (0.02%), but SSVC rates the flaw as automatable with partial technical impact.
Cross-Site Request Forgery (CSRF) in HireFlow v1.2 allows remote attackers to perform unauthorized actions on behalf of authenticated users without token validation on any state-changing endpoint. An attacker can craft malicious web pages to silently change victim passwords, delete candidate records, inject feedback, or schedule interviews when visited by an authenticated user. The absence of SESSION_COOKIE_SAMESITE configuration removes browser-level CSRF defenses. Publicly available exploit code exists (SSVC exploitation status: POC), though EPSS score of 0.02% (4th percentile) suggests limited widespread targeting. CVSS 8.1 reflects high confidentiality and integrity impact requiring only user interaction (UI:R), making this a realistic threat in phishing scenarios despite no active exploitation confirmed at time of analysis.
Arbitrary code execution in the Dao-AILab flash-attention training framework (all revisions up to and including commit e724e2588cbe754beb97cf7c011b5e7e34119e62) arises because its checkpoint-loading paths call PyTorch's torch.load() without weights_only=True, permitting pickle-based deserialization of attacker-controlled objects. Any user who warmstarts or evaluates a model from an untrusted checkpoint file triggers code execution on their host. No public exploit is identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as 'none' - this is a latent supply-chain/ML-artifact risk rather than an actively exploited one.
SQL injection in MuuCMF T6 v1.9.4.20260115 lets an unauthenticated remote attacker inject arbitrary SQL through the keyword parameter of the /index/controller/Search.php endpoint, exposing the full database and enabling forged administrative access. Because the underlying database and application run with sufficient privileges, the flaw can be escalated to write malicious files to disk and potentially achieve remote code execution. Publicly available exploit code exists (write-up by thinhneee), but the flaw is not on CISA KEV and EPSS is very low at 0.03% (10th percentile).
Arbitrary code execution in CosyVoice's gRPC server (through commit 6e01309e) occurs because the speech-synthesis model is loaded via torch.load() without weights_only=True, deserializing untrusted pickle data. Any operator who starts the gRPC server against an attacker-supplied model directory executes embedded Python code during initialization. No public exploit has been identified and it is not in CISA KEV; EPSS is negligible at 0.02% (5th percentile), consistent with a file-delivery attack rather than mass remote exploitation.
Command injection in D-Link DCS-932L v2.18.01 allows remote unauthenticated attackers to execute arbitrary system commands via the LightSensorControl parameter in the /bin/alphapd binary. CVSS 7.3 indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, though EPSS score of 0.15% (35th percentile) suggests low observed exploitation probability. No CISA KEV listing or confirmed active exploitation. Publicly documented vulnerability details exist on GitHub, increasing risk of future exploitation attempts against this end-of-life IoT camera model.
Denial of service in Docling's METS GBS backend (through version 2.61.0) allows remote attackers to exhaust CPU and memory by submitting a malicious .tar.gz archive containing an XML bomb. The backend parses embedded XML with etree.fromstring() while entity resolution remains enabled, so recursively nested entity definitions expand exponentially during parsing and stall or crash the host processing the document. EPSS is very low (0.02%) and there is no public exploit code or KEV listing, but a vendor-published Notion write-up describes the flaw in detail.
Arbitrary code execution in CosyVoice (FunAudioLLM's multilingual text-to-speech toolkit) through commit 6e01309 allows an attacker to run code on a victim's machine via a malicious PyTorch .pt file. The vulnerability lives in the make_parquet_list.py data-preparation tool, which calls torch.load() without weights_only=True, so any .pt file it ingests can carry a malicious pickle payload that executes when the victim processes an attacker-supplied data directory. Reported by MITRE with a low EPSS (0.02%, 5th percentile) and no public exploit identified at time of analysis; this is a poisoned-input/supply-chain style flaw rather than a remotely reachable network service.
SQL injection in HireFlow v1.2 enables unauthenticated attackers to bypass authentication and exfiltrate the entire database via /login and /search endpoints. Direct string concatenation without parameterization allows both authentication bypass using comment injection (admin'--) and UNION-based data extraction. Public proof-of-concept exists (SSVC: POC, automatable, total technical impact), though EPSS exploitation probability remains low (0.10%, 28th percentile), suggesting limited observed exploitation attempts. CISA SSVC framework classifies this as automatable with total technical impact, warranting immediate patching despite relatively low EPSS score.
Arbitrary code execution in CosyVoice (FunAudioLLM's open-source multilingual text-to-speech toolkit) arises because its average_model.py utility calls PyTorch's torch.load() on epoch_*.pt checkpoint files without weights_only=True, allowing pickle-based deserialization of attacker-controlled objects. Any user who runs the model-averaging tool against a directory containing a malicious checkpoint executes attacker code on their machine. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-502 pattern is trivially weaponizable and SSVC marks it automatable.
Denial of service in Docling through version 2.61.0 lets remote attackers crash or exhaust resources on any system that parses a document via the JATS XML backend. The backend calls etree.parse() without disabling entity resolution, so a maliciously crafted JATS/XML file containing nested entity definitions (a 'billion laughs' XML bomb) triggers exponential entity expansion and consumes all available CPU/memory. No public exploit identified at time of analysis; EPSS is very low (0.02%) and SSVC records no observed exploitation, so this is a high-CVSS availability issue rather than an actively exploited threat.
Denial of service in PgBouncer before 1.25.2 lets a malicious or malfunctioning PostgreSQL backend crash the connection pooler by returning an error response that omits the SQLSTATE field, triggering a null pointer dereference (CWE-476). Because PgBouncer is a shared proxy fronting many client connections, a single crash disrupts all pooled sessions, causing a broad availability outage. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%, 2nd percentile), and SSVC rates exploitation as none - but a vendor patch is available.
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the pooler's memory during SCRAM authentication. Because the SCRAM code ignores the truncation return value of strlcat() while assembling the client-final-message, a backend that replies with an over-long SCRAM server-final-message nonce overruns a stack buffer, enabling a crash and potentially code execution in the PgBouncer process. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.02%), but SSVC rates the technical impact as total.
OS command injection in FastNetMon Community Edition through 1.2.9 lets an authenticated network attacker execute arbitrary shell commands via the MikroTik router integration plugin by influencing argv[] values passed to the unsanitized _log() function. The flaw mirrors a previously disclosed Juniper plugin issue in the same project, and while a public technical write-up exists at lorikeetsecurity.com, no public exploit code or active exploitation has been identified, with EPSS at 0.05% (17th percentile).
Heap buffer overflow in FastNetMon Community Edition through 1.2.9 originates from a CWE-190 integer overflow in the BGP AS_PATH attribute encoder (IPv4UnicastAnnounce::get_attributes() in src/bgp_protocol.hpp). When an AS_PATH carries more than 63 ASNs, the computed attribute length is silently truncated into a uint8_t field used for buffer sizing while the full data is still written, corrupting the heap. The CVSS 9.8 score implies remote unauthenticated code execution, though the flaw lives in FastNetMon's outbound BGP announcement encoder; no public exploit is identified at time of analysis and no EPSS or KEV data was supplied.
Heap corruption in FastNetMon Community Edition through 1.2.9 allows authenticated local users to trigger an integer overflow in the packet capture buffer allocation routine, resulting in undersized allocations followed by out-of-bounds heap writes during packet storage. The flaw stems from 32-bit unsigned arithmetic in allocate_buffer() in src/packet_storage.hpp, where a sufficiently large ban_details_records_count configuration value causes the memory size calculation to wrap. No public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.01%.
Out-of-bounds read in FastNetMon Community Edition through 1.2.9 allows remote unauthenticated attackers to leak adjacent process memory by sending crafted BGP UPDATE messages containing malformed MP_REACH_NLRI IPv6 attributes. The flaw resides in decode_mp_reach_ipv6() where attacker-controlled length fields drive memcpy operations without bounds validation, and is acknowledged by an in-source TODO comment by the maintainer. No public exploit identified at time of analysis, EPSS is low (0.03%), and CISA SSVC classifies exploitation as 'none' but 'automatable: yes', meaning weaponization is technically straightforward if a threat actor invests effort.
Unauthenticated gRPC API exposure in FastNetMon Community Edition through 1.2.9 allows adjacent network attackers to invoke security-critical RPC methods including ExecuteBan and ExecuteUnBan without credentials. The server explicitly uses grpc::InsecureServerCredentials() on port 50052, enabling attackers to blackhole legitimate traffic via BGP announcements, disable active DDoS mitigations, and trigger external script execution via popen(). No public exploit identified at time of analysis, and EPSS is low at 0.03%, but CISA SSVC rates technical impact as total.
Man-in-the-middle interception of telemetry traffic affects FastNetMon Community Edition through version 1.2.9 due to missing TLS certificate validation in outbound HTTPS connections. Network-positioned attackers can intercept, modify, or redirect telemetry data sent to community-stats.fastnetmon.com - including system fingerprints, kernel version, traffic statistics, and configuration details - and potentially serve malicious responses. EPSS is very low (0.01%), and there is no public exploit identified at time of analysis, though a technical write-up by Lorikeet Security details the root cause.
Remote code execution in FastNetMon Community Edition through 1.2.9 stems from an off-by-one heap write in the pervasively-used dynamic_binary_buffer_t class, reachable by anyone who can send NetFlow, sFlow, IPFIX, or BGP traffic to the DDoS-detection appliance. Because the flawed buffer is exercised during BGP encoding/decoding, NetFlow template parsing, and Flow Spec NLRI construction, an unauthenticated network attacker can corrupt adjacent heap metadata and potentially execute arbitrary code. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), but no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Configuration injection in FastNetMon Community Edition through 1.2.9 allows an attacker who controls the attacker IP string passed to the Juniper integration plugin to inject arbitrary Juniper NETCONF set/delete commands, leading to full router compromise. The flaw lives in the PHP-based Juniper plugin where unsanitized argv input is interpolated into NETCONF commands, and although no public exploit identified at time of analysis (EPSS 0.03%), the technical impact is rated total under SSVC and CVSS scores 8.1.
Clickjacking in ClipBucket v5 5.5.2 lets an attacker embed the application's login page in a hidden iframe due to missing HTTP response security headers, enabling UI-redressing attacks that can capture credentials or trick authenticated users into unintended actions. The flaw is classified CWE-1021 (Improper Restriction of Rendered UI Layers), not the 'arbitrary code execution' the raw description claims — the referenced technical writeup and the CVSS profile (UI:R) both point to a framing/credential-theft issue. EPSS is very low (0.05%, 14th percentile) and CISA SSVC scores exploitation as 'none', indicating no observed active exploitation.
Remote code execution in Easy Chat Server 3.1 stems from a buffer overflow in the chat message handling functionality, letting remote attackers overwrite memory to leak sensitive data and run arbitrary code on the hosting Windows machine. The product is a small standalone web-based chat server historically used as an exploit-development target, and publicly available exploit code exists (GitHub PoC), though EPSS is low (0.18%, 39th percentile) and it is not on CISA KEV. No public evidence of active in-the-wild exploitation was identified at time of analysis.
Cross-Site Request Forgery in InfoScale 9.1.3 Operations Manager (VIOM) web application allows remote attackers on the adjacent network to coerce an authenticated user with an active session into clicking a malicious link that triggers unintended state-changing actions in VIOM. No public exploit identified at time of analysis, but the CVSS 8.8 score reflects high impact on confidentiality, integrity, and availability if a privileged VIOM operator is targeted.
Stack-based buffer overflow in the EPSON L14150 (firmware FL27PB) is reachable remotely and unauthenticated through the RAW/JetDirect print service on TCP port 9100, letting an attacker crash or potentially execute code on the device. The MITRE description claims arbitrary code execution, though the CVSS vector scores only availability impact (C:N/I:N/A:H) and CISA SSVC rates technical impact as 'partial', so the practical outcome is more consistent with a denial-of-service/device crash than confirmed RCE. Publicly available exploit code exists (POC on GitHub/gist), but it is not in CISA KEV and EPSS is low (0.19%).
Privilege escalation in Veritas InfoScale CmdServer prior to version 7.4.2 allows authenticated remote attackers to bypass access control restrictions and achieve full compromise of confidentiality, integrity, and availability on the targeted host. The flaw is tagged as an authentication bypass by intelligence sources and carries a CVSS 8.8 (High) rating; no public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Denial-of-service in ExifReader (npm package mattiasw/ExifReader) before 4.39.0 allows remote attackers to exhaust memory by submitting a crafted image whose ICC profile contains a malformed mluc tag. A specially crafted record count combined with a zero record size causes the parser to loop on the same record while continuously appending entries to an array, driving memory growth until the host process crashes. CVSS 4.0 base score is 7.7 with proof-of-concept exploit maturity (E:P), and publicly available exploit code exists via the referenced gist; no active in-the-wild exploitation is indicated.
Authorization bypass in Innoshop 0.6.0 allows authenticated frontend users to directly invoke backend administrative interfaces, enabling privileged operations outside their intended scope. The CVSS 7.3 score reflects low-impact gains across confidentiality, integrity, and availability achievable without prior authentication to the admin panel. No public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.02% (5th percentile), indicating minimal observed attacker interest so far.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deserialize attacker-controlled data via the bundled JSONSerializer or CBORSerializer. The unmarshal_object routine dynamically imports modules and invokes __setstate__ on arbitrary classes, letting an attacker pivot an untrusted payload into code execution; publicly available exploit code exists, though EPSS remains low at 0.06% (19th percentile).
Remote command execution in hitarth-gg Zenshin before 2.7.0 allows unauthenticated attackers to run arbitrary OS commands by sending a crafted url query parameter to the /stream-to-vlc Express route, which passed user input directly into a Node.js child_process.exec shell invocation. No public exploit identified at time of analysis, but a detailed write-up gist and the upstream fix commit publicly expose the vulnerable code path. EPSS is low (0.13%, 32nd percentile) but CVSS is 9.8 reflecting the trivial nature of the injection.
SQL injection in BillaBear (all versions prior to January 2026) allows authenticated users holding the ROLE_ACCOUNT_MANAGER role to execute arbitrary SQL commands via the EventRepository component. The flaw stems from unsanitized filter identifier keys being concatenated into queries through sprintf(), and while no public exploit identified at time of analysis is listed in KEV, two CVE-referenced gists suggest detailed technical write-ups are publicly available. EPSS is very low (0.01%), but the high CVSS of 8.8 and clear exploitation path make this a meaningful risk for any deployed instance.
Privilege escalation in LalanaChami Pharmacy Management System (commit 5c3d028) allows any remote unauthenticated attacker to register a new account with administrator privileges by simply including a role parameter in the signup request body. The /api/user/signup endpoint trusts client-supplied role values without server-side validation, granting full administrative access in a single HTTP call. No public exploit identified at time of analysis, and EPSS is very low (0.04%), but the trivial nature of the flaw means weaponization is straightforward once anyone notices the gist already documenting the issue.
OS command execution as root in the Panabit PAP-XM320 application delivery/bandwidth-management appliance (versions up to and including v7.7) is possible when an authenticated user submits action=runcmd to the /cgi-bin/tools/ajax_cmd CGI endpoint, letting attacker-supplied input reach a shell. Because the CGI runs with root privileges, any low-privileged authenticated account can achieve full device takeover. A public proof-of-concept write-up exists (SSVC exploitation: poc), but there is no public exploit identified as actively used in the wild; EPSS is low at 0.10% (28th percentile).
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump all user records including bcrypt password hashes, tamper with drug inventory, and read private medical prescription data. The flaw stems from missing authentication middleware on backend Express routes such as /api/user/getUserData and /api/doctorOder. Publicly available exploit code exists, though EPSS rates exploitation probability at only 0.06% (17th percentile), consistent with a low-deployment open-source project rather than mass exploitation.
Arbitrary code execution in Scalar Astro v0.1.13 allows remote unauthenticated attackers to upload malicious SVG files through the scalar_url query parameter of the Scalar Proxy endpoint. The flaw stems from inadequate validation in the proxy's file handling logic and, per CVSS, requires no authentication or user interaction, though EPSS rates real-world exploitation probability at only 0.02%. No public exploit identified at time of analysis, though a related XSS/Open-Redirect proof-of-concept repository is referenced.
Authentication bypass in the embedded HTTP server of Panabit PAP-XM320 (versions up to and including v7.7) lets remote unauthenticated attackers gain administrative access by supplying a crafted session cookie. The server validates sessions with a filesystem existence check against the unsanitized cookie value, so directory traversal in that value satisfies the check and defeats authentication. SSVC rates technical impact as total and the attack as automatable, and publicly available exploit code exists, though EPSS remains modest at 0.43%.
Server-side request forgery in scalar/astro v0.1.13 allows remote unauthenticated attackers to coerce the backend into making HTTP requests to attacker-controlled destinations via the scalar_url query parameter of the Scalar Proxy endpoint. Exploitation can expose authentication cookies and headers forwarded by the proxy, enabling account takeover and potential privilege escalation. Publicly available exploit code exists, though EPSS is low (0.03%) suggesting limited mass exploitation at this time.
Stack-based buffer overflow in lwIP's SNMPv3 USM handler exposes embedded and IoT devices running versions 2.1.0 through 2.2.1 to remote unauthenticated code execution. The flaw in snmp_parse_inbound_frame() allowed an attacker-controlled msgAuthenticationParameters TLV length to be used directly in a stack buffer copy without bounds validation - a protective assertion had been explicitly commented out in the codebase. With CVSS 4.0 scoring 8.9, SSVC classifying the attack as automatable with total technical impact, and proof-of-concept code in existence (E:P), this is a high-priority remediation target for any network-accessible lwIP deployment with SNMPv3 enabled; no CISA KEV listing has occurred at time of analysis.
Arbitrary file disclosure in HSC MailInspector v5.3.3-7 allows unauthenticated remote attackers to read sensitive files from the host via a path traversal flaw in the exposed /vendor/phpunit/phpunit.php endpoint. The CVSS 7.5 rating reflects high confidentiality impact with no required privileges or user interaction, though EPSS remains very low at 0.05% (15th percentile) and there is no public exploit identified at time of analysis. The exposure of a PHPUnit development artifact in a production path mirrors a long-standing class of PHP supply-chain misconfigurations.
Unauthenticated path traversal in HSC MailInspector 5.3.3-7 allows remote attackers to read arbitrary files from the underlying operating system by manipulating the 'text' parameter of the /tap/dw.php endpoint. Public exploit details are disclosed on GitHub (sql3t0/cve-disclosures), though EPSS probability remains low (0.05%) and the issue is not currently listed in CISA KEV. The flaw enables disclosure of sensitive system files such as configuration files, credentials, and mail-related data without prior authentication.
Remote code execution in Offline Hospital Management System 5.3.0 stems from an insecure Electron renderer configuration where Node.js integration is enabled while context isolation is disabled, allowing JavaScript in the renderer to invoke Node.js APIs and run arbitrary OS commands. The flaw carries a CVSS 7.3 with network attack vector and no privileges required, though EPSS is low at 0.06% and no public exploit identified at time of analysis beyond a Medium write-up describing the technique.
Sensitive information disclosure in the PrestaShop upsshipping module (all versions through at least 2.4.0) lets remote attackers read exposed data by directly requesting the /modules/upsshipping/logs/ directory and the lib/UPSBaseApi.php component. Publicly available exploit code exists (SSVC 'poc'), the flaw is unauthenticated over the network (CVSS 7.5, PR:N), and CISA's SSVC framework rates it automatable, though EPSS remains low at 0.04%. There is no evidence of active exploitation in the wild.
Privilege escalation in Thermo Fisher Scientific Torrent Suite Dx software (all versions through 5.14.2) allows an authenticated, limited-privilege user to gain administrator-level control by abusing specific exposed system interfaces. The flaw grants full read/write/availability impact over the sequencing-analysis platform (CVSS 8.8). No public exploit identified at time of analysis, and CISA SSVC records no observed exploitation, though the technical impact is rated total.
Prototype pollution in the jsondiffpatch JavaScript library before 0.7.6 allows attackers to modify Object.prototype by supplying crafted delta documents to jsondiffpatch.patch() or JSON Patch documents to the jsonpatch formatter's patch() API. Because attacker-controlled key names and JSON Pointer path segments were used to traverse and mutate objects without filtering __proto__, constructor, or prototype, any application that feeds untrusted diffs into the library can have global object behavior tampered with. A public POC exists in the Snyk advisory and an accompanying gist, but there is no public exploit identified at time of analysis (not on CISA KEV).
Stack buffer overflow in PostgreSQL's refint module allows low-privileged database users to execute arbitrary code as the database operating system user across all supported versions before 14.23, 15.18, 16.14, 17.10, and 18.4. The vulnerability enables two distinct attack paths: direct stack overflow leading to OS-level code execution, and SQL injection when applications expose user-controlled columns configured as refint cascade primary keys. With CVSS 8.8 (AV:N/AC:L/PR:L) and network-based exploitation requiring only low-privilege database credentials, this represents a critical privilege escalation risk for PostgreSQL deployments. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Denial of service in PostgreSQL allows remote unauthenticated attackers to crash the database server via recursive SSL/GSS negotiation when connecting to AF_UNIX or TCP sockets (if SSL and GSS are both disabled). Affects all PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23. No active exploitation confirmed (not in CISA KEV). Vendor-released patches available across all supported major versions. EPSS data not available, but CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates high availability impact with low barrier to exploitation.
PostgreSQL libpq client library allows malicious server superusers to execute arbitrary code on connecting clients by overwriting stack buffers via unbounded responses to PQfn() calls. The vulnerability affects lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions used by psql and pg_dump utilities. A compromised or malicious PostgreSQL server can exploit clients running these common administrative tools during routine operations like database backups or large object exports. EPSS and KEV data not available for this recent CVE. CVSS 8.8 reflects the network attack vector with user interaction requirement (connecting to malicious server).
SQL injection in PostgreSQL's pg_createsubscriber utility escalates privileges from pg_create_subscription to superuser, enabling arbitrary SQL execution. Affects PostgreSQL versions 17.0-17.9 and 18.0-18.3; exploitation requires high-privilege access (pg_create_subscription rights) but occurs remotely without additional complexity. Attack triggers when pg_createsubscriber next executes. Fixed in PostgreSQL 18.4 and 17.10. No CISA KEV listing or public exploit identified at time of analysis, but the technical simplicity (AC:L) and privilege escalation nature present moderate risk for multi-tenant or hosted PostgreSQL environments where subscription management permissions are delegated.
Symlink following vulnerabilities in PostgreSQL pg_basebackup and pg_rewind enable database superusers to overwrite arbitrary files on the destination server's filesystem, leading to local OS account takeover. Exploitation requires a malicious origin database superuser convincing an administrator to run these backup/replication tools (UI:R in CVSS), with practical impact limited to scenarios where database files are transferred between systems or snapshotted before server restart. No public exploit identified at time of analysis. CVSS 8.8 reflects theoretical severity, but real-world risk depends on specific operational workflows involving backup file transfers across trust boundaries.
Remote code execution in PostgreSQL (versions 14.x-18.x) allows authenticated database users to execute arbitrary code as the database operating system user via integer wraparound vulnerabilities in multiple server features. By passing gigabyte-scale inputs to affected database functions, attackers trigger allocation undersizing that leads to out-of-bounds writes. No active exploitation confirmed (not in CISA KEV), but CVSS 8.8 with network vector and low complexity indicates high exploitability once technical details become public. EPSS data not available at time of analysis.
Command injection in CFEngine Enterprise and Community editions before versions 3.21.8, 3.24.3, and 3.27.0 enables remote unauthenticated attackers to execute arbitrary commands on the system. The vulnerability has an EPSS score of 0.15% indicating relatively low exploitation probability, and no public exploit identified at time of analysis. SSVC framework rates this as automatable with total technical impact, suggesting high potential severity if exploited.
Arbitrary file upload in qihang-wms (启航电商WMS) allows unauthenticated remote attackers to execute arbitrary code by uploading malicious files through the ShopOrderImportController component. The vulnerability affects commit 75c15a and potentially other versions of this warehouse management system. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed by CISA KEV at time of analysis. Public exploit documentation exists via GitHub/Gist references.
Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total.
Local privilege-driven data corruption in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 allows a privileged local adversary to trigger an out-of-bounds write (CWE-787) in a Ring 1 device driver, causing denial of service and integrity loss. The flaw affects the vulnerable system's integrity and availability (both High) with no confidentiality impact, and carries a CVSS 4.0 base score of 8.3. There is no public exploit identified at time of analysis, and the EPSS probability is negligible at 0.01%.
Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation.
Escalation of privilege in Intel's Slim Bootloader UEFI firmware allows a privileged local adversary to trigger an integer overflow (CWE-190) and execute code within the firmware/boot context. Exploitation requires existing high privileges and local access with a specific attack requirement present, but a successful attack fully compromises confidentiality, integrity, and availability of both the vulnerable firmware and the subsequent system. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), consistent with SSVC exploitation status of 'none'.
Local privilege-abusing denial of service and information disclosure in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger an out-of-bounds read (CWE-125) in the Ring 1 device-driver layer, potentially crashing the host and exposing adjacent memory. The flaw carries a CVSS 4.0 base score of 8.3 driven by high confidentiality and availability impact plus a scope change into subsequent systems. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC rates exploitation as 'none' and non-automatable.
Local privilege escalation in Intel QuickAssist Adapter 8960 software before version 1.13 allows an authenticated, low-privileged user to abuse an untrusted pointer dereference in a Ring 3 user-application component to gain elevated privileges on the host. The flaw yields total impact (high confidentiality, integrity, and availability) on the affected system and carries a CVSS 4.0 base score of 8.5. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at just 0.01%.
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configurations arises from a use-after-free in the BDAT/CHUNKING body-parsing path. An unauthenticated network attacker who sends a TLS close_notify mid-body during a CHUNKING transfer followed by a trailing cleartext byte on the same TCP connection can corrupt the heap and, per the advisory, execute arbitrary code. Publicly available exploit code exists, but there is no CISA KEV listing and EPSS is very low (0.06%, 18th percentile), so this is best treated as a high-impact issue with no confirmed active exploitation yet.
Unauthenticated remote attackers can completely destroy the mem0 v1.0.0 memory database by sending a DELETE request to the /memories endpoint, which executes DROP TABLE SQL statements without authentication or authorization checks. This causes irreversible data loss and total service denial for all users. EPSS score of 0.03% suggests low observed exploitation probability despite the CVSS 9.1 critical rating, likely due to mem0's limited deployment footprint. No public exploit code or active exploitation (CISA KEV) confirmed at time of analysis, but SSVC indicates the vulnerability is automatable with a single HTTP request.
Unauthenticated remote attackers can modify or delete arbitrary memory records in mem0 1.0.0 server by directly calling unprotected API endpoints including PUT /memories/{memory_id}. The vulnerability stems from complete absence of authentication and authorization controls on critical memory management functions, allowing data manipulation and loss without any verification of requester identity. EPSS score of 0.06% (18th percentile) indicates low exploitation probability in the wild, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary code execution occurs in the llm CLI tool (versions through 0.27.1) when attackers social-engineer victims into running crafted commands containing malicious Python code in the --functions argument. The tool directly executes this code via unsafe exec() without sanitization, enabling full system compromise. CVSS 9.8 assigns network attack vector and no authentication, but real-world exploitation requires local command execution by a tricked user, creating a significant disparity between the vector and actual attack prerequisites. EPSS score of 0.02% (5th percentile) suggests minimal automated exploitation risk, and no active exploitation or public POC has been identified at time of analysis.
Arbitrary code execution in Ludwig framework ≤0.10.4 occurs when attackers supply malicious pickle files to the predict() method, which deserializes untrusted data without validation using pandas.read_pickle(). Remote unauthenticated attackers can achieve full system compromise by exploiting the automatic file format detection mechanism that processes .pkl files through Python's unsafe pickle module. EPSS score of 0.06% (19th percentile) suggests low current exploitation likelihood despite the critical CVSS 9.8 rating, though no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Horovod distributed training framework (versions through 0.28.1) allows unauthenticated network attackers to execute arbitrary code on worker nodes by injecting malicious pickle payloads into the KVStore HTTP server. The vulnerability combines unauthenticated write access to the KVStore coordination server with unsafe deserialization using cloudpickle.loads(), enabling trivial exploitation against any reachable Horovod cluster. EPSS score of 0.12% (31st percentile) suggests low widespread exploitation probability despite critical CVSS 9.8 rating, and no active exploitation confirmed (not in CISA KEV). Public exploit development is highly feasible given the straightforward attack path and publicly documented details.
Arbitrary code execution in imgaug library (versions through 0.4.0) occurs when the BackgroundAugmenter class deserializes malicious pickle payloads without validation in its multiprocessing worker method. Attackers who can influence queue data-through compromised shared queues, malicious input scripts, or social engineering-can achieve remote or local code execution depending on deployment context. CVSS 9.8 critical severity reflects network-based exploitation without authentication, though EPSS probability is low (0.02%, 6th percentile), indicating limited observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.
Remote code execution in Ludwig framework ≤0.10.4 allows unauthenticated network attackers to execute arbitrary code by supplying a malicious PyTorch model file to the ludwig serve endpoint. The vulnerability stems from unsafe deserialization in the model loading component, which uses torch.load() without the weights_only=True safety parameter. With CVSS 9.8 (critical network vector, no authentication required) but only 0.02% EPSS, this represents a high-severity issue in vulnerable deployments, though widespread exploitation has not been observed. No CISA KEV listing or public POC identified at time of analysis.
Remote code execution in Cognee v0.4.0 and earlier allows unauthenticated attackers to execute arbitrary Python code via the notebook cell execution API endpoint. The vulnerability stems from unsafe use of Python's exec() function without sandboxing or validation, enabling complete system compromise with server process privileges. While not actively exploited (not in KEV), the vulnerability is automatable with total technical impact per SSVC framework, though EPSS indicates low exploitation probability at 0.06%.
Remote code execution in CosyVoice (FunAudioLLM's open-source text-to-speech toolkit) up to commit 6e01309 allows an attacker to run arbitrary Python on a victim's host when the victim loads an attacker-supplied model directory. The flaw stems from calling torch.load() without weights_only=True, so malicious pickle payloads embedded in .pt model files execute during model loading via the web interface. There is no public exploit identified at time of analysis and EPSS is very low (0.05%, 17th percentile), but SSVC rates the technical impact as total.
Remote code execution in Guardrails AI through version 0.6.7 occurs when installing validator packages via the Hub mechanism. The guardrails hub install command dynamically executes post-installation scripts from Hub manifests without validating the script path or content, allowing attackers who publish malicious packages to achieve arbitrary code execution on victim systems during package installation. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) but only 0.06% EPSS (18th percentile), this represents a supply chain attack requiring user-initiated installation rather than widespread automated exploitation. No active exploitation confirmed (not in CISA KEV), and patch availability not confirmed from available data.
Remote code execution in Mamba language model framework (through version 2.2.6) allows unauthenticated attackers to execute arbitrary Python code by publishing malicious models on HuggingFace Hub. When victims call MambaLMHeadModel.from_pretrained() on a weaponized model repository, insecure pickle deserialization executes attacker-controlled code in the context of the victim's process. Despite the critical CVSS 9.8 score and network attack vector requiring no authentication, EPSS probability remains extremely low (0.02%, 5th percentile), suggesting limited real-world exploitation to date. No CISA KEV listing or public POC identified at time of analysis.
Remote code execution in Adversarial Robustness Toolbox (ART) through version 1.20.1 allows unauthenticated network attackers to execute arbitrary Python code by uploading malicious PyTorch model files to pipeline-accessible object storage locations. The vulnerability stems from unsafe use of torch.load() without the weights_only=True parameter in the Kubeflow component's model loading process, enabling Pickle deserialization of arbitrary objects. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) but only 0.06% EPSS exploitation probability (19th percentile), this represents a critical-severity issue with low observed real-world targeting, likely due to the specialized nature of ML robustness evaluation deployments. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis.
Command injection in Adversarial Robustness Toolbox (ART) up to version 1.20.1 enables remote code execution through unsafe eval() usage in Kubeflow pipeline components. The robustness_evaluation_fgsm_pytorch.py script directly evaluates user-controlled --clip_values and --input_shape arguments without sanitization, allowing Python code injection. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicating network-exploitable unauthenticated access, this represents critical risk in automated ML pipeline environments where attackers can control pipeline configurations. EPSS score of 0.02% (5th percentile) suggests low observed exploitation activity, though the attack vector and ML tooling context create significant supply chain risk in CI/CD and research environments.
Remote code execution in Adversarial Robustness Toolbox (ART) versions through 1.20.1 allows unauthenticated network attackers to execute arbitrary Python code via unsafe eval() usage in the Kubeflow robustness evaluation component. The vulnerability accepts unsanitized user input for LossFn and Optimizer parameters in PyTorch model evaluations, enabling complete system compromise. With CVSS 9.8 but only 0.06% EPSS score (18th percentile), this represents a severe theoretical risk that has not yet manifested in widespread exploitation. No public exploit code identified at time of analysis, and the vulnerability requires specific deployment of ART's Kubeflow integration component.
Arbitrary code execution in Snorkel library (Python) through version 0.10.0 enables remote attackers to execute code by supplying malicious pickle files to the BaseLabeler.load() method. The vulnerability stems from unsafe deserialization using pickle.load() without input validation, allowing attackers to craft serialized objects that execute arbitrary commands during deserialization. With EPSS at 6th percentile, exploitation probability remains relatively low despite the critical CVSS score, and no active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.
Remote code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load untrusted model files via MultitaskClassifier.load(). The vulnerability exploits insecure Python object deserialization through torch.load(), allowing attackers to embed malicious code in model weight files that executes upon loading. EPSS score of 0.06% (19th percentile) suggests low observed exploitation probability in the wild, though SSVC framework indicates total technical impact once exploited. No public exploit code or active exploitation confirmed at time of analysis, but exploitation requires only that a data scientist or ML engineer load a malicious .pkl model file.
Remote code execution in superduper (Python library) through version 0.10.0 allows unauthenticated network attackers to execute arbitrary system commands by submitting malicious query strings with embedded Python code. The _parse_op_part() function in query.py uses unsafe eval() with inadequate context restrictions, enabling attackers to import modules (such as os) and achieve complete server compromise. EPSS score is low (0.07%, 20th percentile) and no active exploitation is confirmed (CISA KEV absent), but SSVC framework rates technical impact as total. User interaction is required (CVSS UI:R), reducing automated exploitation risk. Authentication requirements not confirmed from available data - CVSS vector shows PR:N (no privileges required) but UI:R suggests user-triggered queries.
Arbitrary code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load malicious model checkpoint files through the Trainer.load() method. The vulnerability stems from unsafe PyTorch deserialization that processes untrusted Pickle objects without the weights_only security parameter. Attackers can embed malicious Python code in model files distributed through repositories, shared datasets, or social engineering campaigns. Despite the 8.8 CVSS score indicating critical severity, EPSS scoring at 0.06% (19th percentile) suggests very low real-world exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Remote code execution in TinyZero's HDFS utilities allows unauthenticated attackers to execute arbitrary OS commands via crafted file paths passed through the Hydra configuration framework. The vulnerability stems from unsanitized user input directly interpolated into os.system() shell commands within the _copy() function, affecting all deployments through commit 6652a63c57fa. No active exploitation confirmed at time of analysis, but EPSS score of 0.14% (33rd percentile) suggests below-average likelihood despite CVSS:9.8 critical rating. The attack requires network access to the TinyZero training process and ability to control path parameters via configuration.
Remote code execution in PySyft Datasite/Server versions 0.9.5 and earlier allows unauthenticated attackers to execute arbitrary Python code on the server through the function submission mechanism. The vulnerability stems from insufficient validation and sandboxing of user-submitted Python functions decorated with @sy.syft_function(), which are executed using unsafe exec() and eval() calls after approval. With an EPSS score of 0.04% and no current KEV listing, this appears to be a high-severity vulnerability without confirmed active exploitation.
Arbitrary code execution occurs in PyTorch Lightning 2.6.0 and earlier when loading malicious checkpoint files. The LightningModule.load_from_checkpoint() method deserializes untrusted Pickle data without security restrictions, allowing attackers to execute arbitrary Python code when victims open crafted .ckpt files. EPSS score of 0.06% (19th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis. Attack requires local access and user interaction (opening a malicious checkpoint), limiting remote attack scenarios to social engineering or supply chain compromise.
Remote unauthenticated attackers can delete arbitrary ElasticSearch documents and MinIO storage files in nexent v1.7.5.2 via the unprotected DELETE /{index_name}/documents endpoint. The backend service fails to authenticate requests or validate the path_or_url parameter, enabling mass data destruction and denial of service. EPSS probability (0.12%) indicates low predicted exploitation likelihood, and no active exploitation or public exploit code has been identified at time of analysis, though the CVSS 9.1 reflects the severe impact of unauthenticated remote data deletion.
Unauthenticated remote attackers can delete arbitrary files from nexent v1.7.5.2's MinIO storage backend via an unprotected DELETE endpoint, leading to data loss and denial of service. The /storage/{object_name:path} API lacks authentication, authorization, and input validation (CWE-552). CVSS 9.1 reflects critical severity, though EPSS score of 0.08% (23rd percentile) and SSVC 'exploitation: none' indicate no observed active exploitation or public exploit code at time of analysis. SSVC marks this as 'automatable: yes' with 'technical impact: partial', suggesting straightforward exploitation once discovered but limited scope beyond data integrity/availability impacts.
Arbitrary code execution in optimate's neural_magic_training.py allows remote attackers to execute Python code by supplying a malicious directory path containing a crafted module.py file. The _load_model() function directly executes file contents via Python's exec() without validation. CVSS 9.8 reflects network vector with no authentication, but EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). Vulnerability exists in commit a6d302f912b481c94370811af6b11402f51d377f from July 2024. Affects organizations using optimate for neural network model optimization.
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to execute malicious Python code by providing crafted PyTorch checkpoint files. The vulnerability stems from insecure deserialization where torch.load() processes .pt files without the weights_only=True safeguard, enabling pickle-based arbitrary object instantiation. Despite a critical CVSS 9.8 score, EPSS probability is low (0.06%, 19th percentile) and no public exploit or active exploitation is confirmed, suggesting limited real-world targeting to date. SSVC assessment indicates total technical impact with automatable exploitation potential, making this a priority for organizations using ml-engineering scripts in production environments.
Remote code execution in Optimate's neural_magic_training.py script allows authenticated attackers to execute arbitrary code via malicious PyTorch model files. The vulnerability stems from unsafe deserialization when loading model state dictionaries without PyTorch's weights_only=True security flag, enabling pickle-based arbitrary object execution. With an EPSS score of 0.06% and no confirmed exploitation, this represents a moderate risk primarily in environments where users can upload or specify model files.
Insecure deserialization in Optimate's neural_magic_training.py script enables remote code execution when loading PyTorch model files. The _load_model() function uses torch.load() without the weights_only=True security parameter, allowing attackers with low privileges to execute arbitrary Python code by providing malicious .pt or .pth files via the --model command-line argument. EPSS indicates low exploitation probability at 0.06% with no active exploitation confirmed.
Remote code execution in automagik-genie 2.5.27 MCP Server occurs when processing transcripts from attacker-controlled external FORGE_BASE_URL endpoints. Exploitation chains command injection in the readTranscriptFromCommit function's view_task parameter to execute arbitrary system commands on the server. A proof-of-concept exploit exists, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Command injection in EDIMAX BR-6428nS V3 wireless router firmware 1.15 allows authenticated attackers to execute arbitrary system commands via crafted input to WLAN configuration interface. The vulnerability requires low-privilege network authentication but no user interaction, enabling complete device compromise including credential theft, traffic interception, and pivot attacks into connected networks. EPSS score of 0.17% suggests low probability of mass exploitation, though a proof-of-concept is publicly available on GitHub, lowering the barrier for targeted attacks against exposed management interfaces.
Remote code execution in QuickJS-NG 0.12.1 allows unauthenticated network attackers to execute arbitrary code through the js_mapped_arguments_mark function. The vulnerability enables attackers to achieve code injection with low confidentiality, integrity, and availability impact via network-accessible JavaScript engine exploitation. EPSS score of 0.02% (5th percentile) indicates very low predicted exploitation probability, and no active exploitation has been publicly reported at time of analysis.
Broken object-level authorization in HireFlow v1.2 exposes all candidate profiles and interview notes to any authenticated user via direct object reference. Attackers with valid low-privilege credentials can enumerate integer IDs in /candidate/<id> and /interview/<id> endpoints to access the entire database, enabling full horizontal privilege escalation and complete data breach. No vendor patch identified at time of analysis. EPSS data not available; no evidence of active exploitation (not in CISA KEV).
Arbitrary code execution in the flash-attention project's training script (up to commit e724e2588cbe754beb97cf7c011b5e7e34119e62) allows an attacker to run Python code by supplying a malicious Hydra configuration. The script registers Python's eval() as a Hydra resolver named 'eval', so any config value using the ${eval:...} syntax is executed when a victim launches training with that configuration. No public exploit has been identified and EPSS probability is very low (0.02%), but SSVC rates the flaw as automatable with partial technical impact.
Cross-Site Request Forgery (CSRF) in HireFlow v1.2 allows remote attackers to perform unauthorized actions on behalf of authenticated users without token validation on any state-changing endpoint. An attacker can craft malicious web pages to silently change victim passwords, delete candidate records, inject feedback, or schedule interviews when visited by an authenticated user. The absence of SESSION_COOKIE_SAMESITE configuration removes browser-level CSRF defenses. Publicly available exploit code exists (SSVC exploitation status: POC), though EPSS score of 0.02% (4th percentile) suggests limited widespread targeting. CVSS 8.1 reflects high confidentiality and integrity impact requiring only user interaction (UI:R), making this a realistic threat in phishing scenarios despite no active exploitation confirmed at time of analysis.
Arbitrary code execution in the Dao-AILab flash-attention training framework (all revisions up to and including commit e724e2588cbe754beb97cf7c011b5e7e34119e62) arises because its checkpoint-loading paths call PyTorch's torch.load() without weights_only=True, permitting pickle-based deserialization of attacker-controlled objects. Any user who warmstarts or evaluates a model from an untrusted checkpoint file triggers code execution on their host. No public exploit is identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as 'none' - this is a latent supply-chain/ML-artifact risk rather than an actively exploited one.
SQL injection in MuuCMF T6 v1.9.4.20260115 lets an unauthenticated remote attacker inject arbitrary SQL through the keyword parameter of the /index/controller/Search.php endpoint, exposing the full database and enabling forged administrative access. Because the underlying database and application run with sufficient privileges, the flaw can be escalated to write malicious files to disk and potentially achieve remote code execution. Publicly available exploit code exists (write-up by thinhneee), but the flaw is not on CISA KEV and EPSS is very low at 0.03% (10th percentile).
Arbitrary code execution in CosyVoice's gRPC server (through commit 6e01309e) occurs because the speech-synthesis model is loaded via torch.load() without weights_only=True, deserializing untrusted pickle data. Any operator who starts the gRPC server against an attacker-supplied model directory executes embedded Python code during initialization. No public exploit has been identified and it is not in CISA KEV; EPSS is negligible at 0.02% (5th percentile), consistent with a file-delivery attack rather than mass remote exploitation.
Command injection in D-Link DCS-932L v2.18.01 allows remote unauthenticated attackers to execute arbitrary system commands via the LightSensorControl parameter in the /bin/alphapd binary. CVSS 7.3 indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, though EPSS score of 0.15% (35th percentile) suggests low observed exploitation probability. No CISA KEV listing or confirmed active exploitation. Publicly documented vulnerability details exist on GitHub, increasing risk of future exploitation attempts against this end-of-life IoT camera model.
Denial of service in Docling's METS GBS backend (through version 2.61.0) allows remote attackers to exhaust CPU and memory by submitting a malicious .tar.gz archive containing an XML bomb. The backend parses embedded XML with etree.fromstring() while entity resolution remains enabled, so recursively nested entity definitions expand exponentially during parsing and stall or crash the host processing the document. EPSS is very low (0.02%) and there is no public exploit code or KEV listing, but a vendor-published Notion write-up describes the flaw in detail.
Arbitrary code execution in CosyVoice (FunAudioLLM's multilingual text-to-speech toolkit) through commit 6e01309 allows an attacker to run code on a victim's machine via a malicious PyTorch .pt file. The vulnerability lives in the make_parquet_list.py data-preparation tool, which calls torch.load() without weights_only=True, so any .pt file it ingests can carry a malicious pickle payload that executes when the victim processes an attacker-supplied data directory. Reported by MITRE with a low EPSS (0.02%, 5th percentile) and no public exploit identified at time of analysis; this is a poisoned-input/supply-chain style flaw rather than a remotely reachable network service.
SQL injection in HireFlow v1.2 enables unauthenticated attackers to bypass authentication and exfiltrate the entire database via /login and /search endpoints. Direct string concatenation without parameterization allows both authentication bypass using comment injection (admin'--) and UNION-based data extraction. Public proof-of-concept exists (SSVC: POC, automatable, total technical impact), though EPSS exploitation probability remains low (0.10%, 28th percentile), suggesting limited observed exploitation attempts. CISA SSVC framework classifies this as automatable with total technical impact, warranting immediate patching despite relatively low EPSS score.
Arbitrary code execution in CosyVoice (FunAudioLLM's open-source multilingual text-to-speech toolkit) arises because its average_model.py utility calls PyTorch's torch.load() on epoch_*.pt checkpoint files without weights_only=True, allowing pickle-based deserialization of attacker-controlled objects. Any user who runs the model-averaging tool against a directory containing a malicious checkpoint executes attacker code on their machine. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-502 pattern is trivially weaponizable and SSVC marks it automatable.
Denial of service in Docling through version 2.61.0 lets remote attackers crash or exhaust resources on any system that parses a document via the JATS XML backend. The backend calls etree.parse() without disabling entity resolution, so a maliciously crafted JATS/XML file containing nested entity definitions (a 'billion laughs' XML bomb) triggers exponential entity expansion and consumes all available CPU/memory. No public exploit identified at time of analysis; EPSS is very low (0.02%) and SSVC records no observed exploitation, so this is a high-CVSS availability issue rather than an actively exploited threat.
Denial of service in PgBouncer before 1.25.2 lets a malicious or malfunctioning PostgreSQL backend crash the connection pooler by returning an error response that omits the SQLSTATE field, triggering a null pointer dereference (CWE-476). Because PgBouncer is a shared proxy fronting many client connections, a single crash disrupts all pooled sessions, causing a broad availability outage. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%, 2nd percentile), and SSVC rates exploitation as none - but a vendor patch is available.
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the pooler's memory during SCRAM authentication. Because the SCRAM code ignores the truncation return value of strlcat() while assembling the client-final-message, a backend that replies with an over-long SCRAM server-final-message nonce overruns a stack buffer, enabling a crash and potentially code execution in the PgBouncer process. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.02%), but SSVC rates the technical impact as total.