RCE
Monthly
Authenticated remote code execution in openEQUELLA releases before 2026.1.0 lets any logged-in non-guest user execute arbitrary code on the server by sending a crafted serialized Java object to the HTTP invoker endpoint at /invoker/*. The flaw is a denylist bypass: the class-name filter in PluginAwareObjectInputStream is evaded by wrapping a malicious payload inside a java.security.SignedObject, whose inner stream is handled by a separate ObjectInputStream that never applies the denylist, ultimately routing into a JNDI lookup sink. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the practical barrier is only the low-privilege account requirement (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scored 8.7 under CVSS 4.0), which is trivial to satisfy on instances that permit self-registration or broad SSO/LDAP provisioning.
Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. No public exploit is identified at time of analysis, this CVE is not in CISA KEV, and no fixed version is published in the referenced sources, so mitigation currently rests on network segmentation rather than patching.
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates the MQTT broker that a device connects to corrupt heap/stack memory and potentially achieve full code execution on that device. Only devices built with lwIP's optional MQTT client compiled in are exposed, and because MQTT connections are client-initiated the device is not directly reachable inbound: the attacker must operate a malicious broker, compromise the legitimate broker, or hold a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or certificate validation is disabled). No authentication or user interaction is required once that broker-side position is achieved, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N) presents this as trivially exploitable, whereas the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the significant broker-control/MITM prerequisite.
Local cross-user code execution with privilege-escalation potential affects the Windows builds of GNU wget distributed by eternallybored.org (releases 0 through 1.21.4 inclusive). The flaw is a hardcoded configuration location, C:\msys64, that unprivileged users can write to: a low-privileged local attacker who plants a wgetrc there can abuse the use_askpass directive so that arbitrary code is executed in the security context of a higher-privileged user who later runs the affected wget build. The attack is not remotely reachable and does not trigger on its own, which is captured by the UI:R component of the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code was identified at time of analysis.
Local code execution on Windows hosts running the Apache Lounge distribution of Apache HTTP Server (builds before Apache 2.4.68-260920 Win64) is possible because the build hardcodes the path to openssl.cnf, allowing a local attacker who can write to that path to plant a malicious OpenSSL configuration that the server loads when TLS is initialized. The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified CWE-732, meaning the weakness is an incorrect permission assignment for a critical resource; exploitation requires the attacker to already have local interactive or code-execution access on the host and the hardcoded path to be writable at the attacker's privilege level, with successful exploitation affecting confidentiality, integrity, and availability at high impact. No public exploit identified at time of analysis and no CISA KEV listing applies, and the issue is specific to the third-party Apache Lounge Windows build rather than the upstream Apache Software Foundation source or Linux distributions.
Arbitrary server-side code execution in the Plone process is possible through the Classic portlet shipped in plone.app.portlets 5.0.0 through 7.0.1, where user-supplied template and macro fields are assembled into a TALES path expression and then evaluated by the TAL path() helper, allowing a crafted value to be interpreted as a full expression rather than a constrained path. Any authenticated user who can add or edit a Classic portlet can execute code, and under Plone's default role map that includes ordinary registered users on their personal dashboard, so the issue amounts to a post-authentication privilege escalation across the trust boundary between a web user and the server-side Plone process (CVSS 3.1 9.9, scope changed: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, but vendor patches are available in 5.0.8, 6.0.4, and 7.0.2.
Unauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent network to execute arbitrary code via deserialization of untrusted data, but only when the deployment is configured to use a specific non-default communication mode. Default-configured instances are not exploitable, and the adjacent-network attack vector (AV:A) further narrows the exposed population. No public exploit code has been identified at time of analysis, and no credentials or user interaction are required once the mode is enabled and reachable.
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first establishes a man-in-the-middle position on the network path to the appliance's administrative component and an administrator then interacts with that component. The CVSS 7.1 vector (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no authentication is needed once the MitM and user-interaction preconditions are met, and successful exploitation grants root privileges. No public exploit code has been identified at time of analysis, and the provided data does not specify a patched version.
Unauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a non-default and non-secure configuration, allowing an attacker who can reach the service to execute arbitrary code with no credentials and no user interaction. The root cause is insufficient integrity checking (CWE-345): when the insecure configuration is present, integrity validation that would otherwise block attacker-supplied content is weakened or bypassed. SolarWinds scores the issue 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that base score does not reflect the environmental gate - default and hardened deployments are not exploitable, so real-world exposure is confined to operators who have deviated from the vendor's documented secure-configuration guidance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.
Opening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an attacker execute arbitrary code in the context of the current user. The flaw is client-side and local in nature - there is no network-facing exposure - so exploitation depends on social engineering to convince a victim to open a poisoned file, and any code that runs inherits only that user's privileges (no privilege escalation). The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches that assessment: high confidentiality and integrity impact, but gated behind the requirement that the user opens the file; no public exploit code or confirmed active exploitation was identified at time of analysis.
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.
Incorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenticated attacker to bypass intended access controls and execute arbitrary code in the context of the running AEM service account, with no user interaction required. The scope-change (S:C) rating and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H produce a maximum 10.0 base score, reflecting that successful exploitation can affect resources beyond the vulnerable component itself. Exposure is limited to deployments where the Forms JEE component is installed and network-reachable - typically internet- or intranet-facing AEM Forms servers - and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) was identified, though the pre-authorization nature of the flaw makes it an attractive target for rapid weaponization.
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper input validation weakness (CWE-20) that is reachable over the network with low attack complexity and no user interaction. Exploitation is gated by a mandatory prerequisite: the attacker must already hold a high-privilege account on the affected AEM Forms JEE instance (CVSS vector PR:H), so only administrative-level users, or an attacker who has first compromised such an account, can reach the vulnerable code path - the assessed risk is genuine but access-gated. Code runs in the context of the current user, and the changed scope (S:C) means impact can extend beyond the vulnerable component; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution with the privileges of the user running Bridge (CVE-2026-75649, CVSS 7.8). The attack is local-host only and depends on user interaction - a victim must open an attacker-supplied malicious file - so it cannot be triggered remotely or automatically, and code executes in the current user's context with no privilege escalation (AV:L/PR:N/UI:R/S:U). At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, but because the advisory is vendor-published and the flaw is a memory-corruption RCE class, it should be treated as a genuine but conditional risk requiring social engineering to deliver.
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of the user who opens it (CVSS 7.8, CWE-121). The attack is local and requires user interaction - an attacker must deliver a malicious file and convince the victim to open it in Bridge (AV:L/AC:L/PR:N/UI:R/S:U), after which code runs in the current user's context without privilege escalation. Impact is limited by the strong social-engineering and delivery prerequisites, and no public exploit identified at time of analysis; risk is concentrated in users who routinely open files from untrusted or external sources.
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controlled code to run with the privileges of the current user. The issue is scored 7.8 (HIGH) and is a client-side, file-format-triggered flaw with a local attack vector and mandatory user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the attacker does not authenticate to the product, but delivery depends entirely on social engineering the victim into opening the malicious file. Only unpatched Adobe Bridge versions addressed by vendor advisory APSB26-148 are affected, and no public exploit identified at time of analysis.
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning the attacker needs no prior privileges but must rely on social engineering to get the target to open a malicious file locally; successful exploitation yields full confidentiality, integrity, and availability impact within the user's own security context, with no privilege escalation to system level. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but non-urgent priority that should be handled through routine vendor patching; Adobe has published an advisory (APSB26-148) with fixed builds.
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chosen files into the server's working directory, because validate_safe_path defaults its base directory to os.getcwd() and the Confluence attachment call sites omit base_dir. Overwriting an importable Python module in that location can escalate to code execution once the application imports the modified module, and the vector intentionally bypasses the earlier remediation tracked as CVE-2026-27825. Exploitation requires permitted MCP tool access (CVSS vector shows PR:L, i.e. authenticated with low privileges) and a subsequent import or re-import of the overwritten module, so code execution is not immediate; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. The vendor rates this 8.3, while an independent assessment confirms it is a genuine remote-exploitable code-execution path whose real-world priority is moderated by those preconditions.
Remote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting a PHP object injection flaw in the billing module handler, where untrusted serialized data in the billing_data POST field is passed to unserialize() without allowed_classes restrictions. Publicly available exploit code exists. Our assessment rates this 9.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N), while the vendor's CVSS 4.0 score is 9.2 (AC:H), reflecting the dependency on a reachable POP chain; no authentication or user interaction is required.
Arbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attackers run code in the context of the running ACC service. The vendor's CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks it as maximum severity: network-reachable, low-complexity, unauthenticated, requiring no user interaction, with a scope change and full loss of confidentiality, integrity, and availability. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, so the practical exposure driver is whether an unpatched ACC instance is reachable over the network.
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary code in the context of the affected process, and the CVSS 3.1 base score is the maximum 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope changed, meaning a successful compromise can cross the component's security boundary and affect resources beyond its intended authority. No user interaction and no authentication prerequisite are required, so the practical exposure is driven almost entirely by whether an ACC instance is reachable from untrusted networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the structural severity signals make this a top-priority patch item; Adobe's bulletin APSB26-142 is the authoritative source for fixed builds.
Code injection in Adobe Campaign Classic allows an authenticated attacker holding only a low-privileged account to execute arbitrary code on the server in the context of the current user, with no user interaction required (CVSS 9.9, Critical). The flaw is network-reachable and low-complexity, but the required low-privilege account is the primary limiting factor - this is not exploitable by fully unauthenticated remote attackers, unlike some sibling Adobe Campaign issues. No public exploit code and no confirmed active exploitation were identified at time of analysis; Adobe has published a security advisory (APSB26-142) for the issue.
Improper input validation in Adobe Campaign Classic allows a low-privileged, authenticated attacker with network reachability to achieve arbitrary code execution in the context of the current user, with the impact scoped beyond the vulnerable component (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, but Adobe explicitly notes that exploitability depends on conditions beyond the attacker's control, reflected as AC:H - meaning successful exploitation is gated by specific environmental, timing, or deployment state rather than being a reliably reproducible remote attack against default installs. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), and the specific vulnerable feature or endpoint is not named in the advisory summary.
SQL injection in Adobe Campaign Classic allows an attacker who already holds a high-privileged operator account to execute arbitrary SQL against the platform's database and, per Adobe, achieve arbitrary code execution in the context of the current user, with the scope change indicating impact that reaches beyond the vulnerable component. The flaw is remotely reachable, low-complexity, and requires no user interaction, but it is gated behind the PR:H prerequisite in the assessed vector, meaning the attacker must first hold or compromise a privileged ACC session and be able to reach the instance over the network. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 9.1 base score with a scope change reflects a serious post-compromise escalation path rather than a pre-authentication remote takeover.
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arbitrary code in the context of the current user, as described by the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score 10.0). The flaw is a CWE-94 code injection issue tracked via CPE cpe:2.3:a:adobe:adobe_campaign_classic, with exact vulnerable and fixed builds enumerated only in Adobe advisory APSB26-142, which the provided data points to but does not quote. No public exploit code and no confirmed active exploitation were identified at time of analysis, but because exploitation requires no authentication and no user interaction, any ACC instance reachable from untrusted networks should be treated as high risk.
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that should have been access-controlled, achieving arbitrary code execution in the context of the current application user without any user interaction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) reflects a scope-changing flaw, meaning the vulnerable component can affect resources beyond its own security boundary - a combination that makes this a genuine top-priority vulnerability for any internet- or partner-reachable ACC deployment. As of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Adobe's advisory APSB26-142 is the authoritative source for affected and fixed builds.
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to execute arbitrary code with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); no user interaction is required, and the scope change means impact is not necessarily confined to the vulnerable component. The affected version range and fixed build are not enumerated in the available intelligence, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, so risk is currently driven by structural severity rather than observed attacks. Because ACC is an internet-reachable marketing automation platform that typically stores customer data and holds credentials for downstream systems, this should be treated as a top-priority patch item even though corroborating sources are limited to Adobe's own advisory.
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems running Adobe Campaign Classic, tracked as CVE-2026-73369, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with a base score of 10.0 (CWE-94 code injection). Exploitation requires no authentication, no user interaction, and no confirmed special configuration; the vector's changed scope (S:C) means the compromise can affect resources beyond the vulnerable component's security authority, though the code itself runs as the current application user rather than as a privileged system account. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but the impact, the low attack complexity, and the two practical limiting factors - network reachability of the ACC instance and the currently unspecified affected version range (CPE is a wildcard) - make this a genuine top-tier priority for any deployment confirmed affected by Adobe advisory APSB26-142.
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the context of the current user without any victim interaction, because the platform fails to properly validate input reaching an exposed processing component. The flaw scores 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and its scope change means a successful exploit can affect resources beyond the vulnerable component, raising the blast radius for confidentiality, integrity, and availability. The decisive prerequisite is authentication: per the assessed vector (PR:L), any valid low-privilege ACC account that can reach the component over the network is enough, but a fully anonymous remote attacker cannot trigger it; there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so the exploitation signals remain thin even though the severity math is high.
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current user, carrying a maximum-severity CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with no user interaction required under the vendor vector. The CPE data flags the product with a wildcard version, so the specific affected release range is not enumerated in the supplied intelligence, and Adobe's advisory (APSB26-142) is the only reference. Exploitation status: no public exploit identified at time of analysis; independent analysis cautions that the advisory is sparse and that the description's 'current user' wording may imply an existing session context, so the PR:N unauthenticated rating should be confirmed with Adobe.
Unauthenticated remote code execution in Adobe Campaign Classic allows attackers to execute arbitrary code in the context of the current user due to an incorrect authorization flaw (CWE-863). The flaw is network-reachable with low complexity and no user interaction (CVSS 9.1), though code execution is limited to the application user context rather than system privileges. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in Adobe Campaign Classic allows an authenticated low-privileged user to execute arbitrary code in the context of the current user, with no victim interaction required, carrying a CVSS base score of 9.9. The vulnerability is exploitable over the network with low attack complexity (AV:N/AC:L/PR:L/UI:N) and is rated Scope Changed, meaning a successful attack can escape the ACC application boundary and affect the underlying database or host rather than remaining confined to the web tier. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the credential-only precondition and the low privilege bar make this a priority fix for any broadly provisioned or externally reachable Campaign Classic instance.
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array inside PluginsManager::loadPluginFromPath(), corrupting adjacent control data and potentially yielding arbitrary code execution in the Notepad++ process; the flaw affects all releases prior to 8.9.8. The attack is local and requires user interaction (the victim must install and load the malicious native plugin DLL), and because any loaded native plugin already runs in-process with full editor privileges, the incremental risk over simply distributing malicious plugin code is minimal - no public exploit identified at time of analysis, and the issue is not reachable remotely or through opened documents. Vendor-released patch: 8.9.8 (CVSS 8.6 base score; our assessment keeps the same 8.6 but treats scope as Unchanged rather than Changed).
Authenticated code execution in Sentry's relocation import worker lets a user with a valid account on an affected instance run arbitrary code in the worker process by uploading a crafted relocation archive. Only instances that have explicitly enabled the relocation (backup import/export) feature are exposed, since that feature is disabled by default in self-hosted installations; affected versions run from 23.11.0 up to but not including 26.7.0, which contains the fix. Severity is high (7.7 under CVSS 4.0), requires authenticated access and a non-default feature flag, and no public exploit has been identified at time of analysis.
Unsafe reflection in Apache Calcite Avatica before 1.29.0 allows an attacker who can influence plugin-instantiation parameters to force the loading and static initialization of arbitrary classes on the server classpath. Exploitation requires low privileges (PR:L per the assessed CVSS vector) and a dangerous static-initializer gadget already present on the classpath; the vendor states no well-known class currently satisfies this, so real-world risk is low despite the RCE tag. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Deserialization-based code execution is possible in MISP because PHP's phar stream wrapper is left registered in both the web entry point (app/webroot/index.php) and the console entry point (app/Console/cake.php), so any filesystem call on a caller-influenced path that resolves to a phar archive silently triggers an unserialize() of attacker-controlled metadata, or can reach executable code inside an uploaded phar under a relocated application root. The vendor's fix (commit 08fa755b6) simply unregisters the wrapper at startup, confirming that nothing in MISP, vendored CakePHP, or runtime libraries legitimately uses phar archives. Real-world risk is lower than the 7.7 CVSS 4.0 score suggests: the vector requires authentication (PR:L - a valid MISP account) and High attack complexity (AC:H), because no MISP/CakePHP/library code natively feeds a caller-influenced path into a phar-resolving operation, so a separate path-influence bug must be chained and no public exploit code has been identified at time of analysis.
Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (Access Policy Manager) access policy and an OAuth profile, where crafted malicious traffic can trigger a heap-based buffer overflow in the data plane. The flaw is remotely reachable, unauthenticated and low complexity per the vendor's CVSS 4.0 base score of 9.3, and the independent assessment confirms full confidentiality, integrity and availability impact (C:H/I:H/A:H) with no control-plane exposure; Appliance mode does not mitigate it. Exploitability is sharply limited by configuration - instances without APM or without an OAuth profile bound to a virtual server are not affected - and no public exploit code was identified at time of analysis, though the combination of unauthenticated RCE and a widely deployed enterprise appliance makes prompt hotfix deployment the priority.
Unauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a network-reachable attacker execute arbitrary operating system commands on the host, enabling code execution, data tampering, denial of service, and information disclosure. Per the NVIDIA-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), no credentials or user interaction are required, so an exposed controller interface is directly attackable; CISA's SSVC assessment rates technical impact as total, though exploitation has not been observed and the decision framework does not classify the issue as automatable. No public exploit code has been identified at time of analysis, and EPSS places the short-term exploitation likelihood at 2.10% (81st percentile) - elevated relative to the broader corpus but not indicative of active campaigns.
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds valid low-privilege credentials to inject arbitrary SQL through the management interface, with CVSS 3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could lead to code execution on the underlying database or controller services, tampering with stored data, denial of service, and disclosure of sensitive configuration or credential material held by the controller. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is remotely reachable without user interaction and any authenticated, network-exposed instance in the affected range should be treated as priority-worthy rather than emergency-level, given the authentication prerequisite and the niche datacenter/DPU deployment footprint.
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path that an attacker can influence, which the vendor states may lead to code execution, privilege escalation, data tampering, and denial of service. Rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a low-complexity but not fully unauthenticated issue: the attacker must be able to reach the controller over the network and already hold a low-privileged authenticated account, at which point no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is a low 0.61% (48th percentile), so near-term mass exploitation is unlikely even though technical impact is total (C:H/I:H/A:H).
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is launched in disaggregated-diffusion mode, where the DiffusionServer orchestrator binds a ZeroMQ ROUTER socket to a network-reachable interface with no authentication and passes the final frame of every received multipart message directly into pickle.loads() before any validation is performed. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw lets any remote party that can deliver a multipart ZMQ message to that socket execute arbitrary Python code in the serving process, yielding full compromise of confidentiality, integrity and availability on the host. No public exploit identified at time of analysis; exploitation requires the exposed orchestrator socket to be reachable beyond localhost, so loopback-bound or single-node deployments are not remotely exploitable.
Code execution, data tampering, denial of service, and information disclosure are all reachable in NVIDIA NeMo Speech 0.0 through 2.9 because its TabularTokenizer class deserializes attacker-supplied .pkl artifacts through pickle.load() with no validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) marks this as unauthenticated but user-interaction-gated: nothing executes until a NeMo user obtains and loads the malicious tokenizer or model file, so the attack depends on a social-engineering or supply-chain delivery step rather than a directly triggerable remote request. Impact is rated high across all three security properties, but no public exploit code was identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; realistic exposure is further narrowed by the research and development orientation of the affected toolkit.
Code execution, data tampering, denial of service, and information disclosure in NVIDIA NeMo Speech (versions 0.0 through 2.9) stem from unsafe deserialization of parameters injected through a maliciously crafted model_config.yaml handled by the dataset-loading workflow. The issue is locally scoped: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:R with a base score of 7.8, meaning an attacker with low privileges must place the crafted config where the victim or an automated pipeline will parse it - for example inside a shared or downloaded model bundle or dataset - and exploitation depends on that untrusted NeMo config being loaded. There is no remote network-service exposure, and no public exploit identified at time of analysis; the CVE is not listed in CISA KEV.
Code injection in NVIDIA NeMo Speech versions 0.0 through 2.9 allows local attackers with low privileges to execute arbitrary code, disclose sensitive information, and tamper with data by supplying crafted input to the toolkit. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction; it has a CVSS 3.1 base score of 7.8 (High) and is classified as CWE-77 (command injection). No public exploit code has been identified at time of analysis, and the vendor advisory at GitHub NVIDIA product-security 2026/5885 should be consulted for patch details.
Code execution, information disclosure, and data tampering are possible in NVIDIA NeMo Speech versions 0.0 through 2.9 due to unsafe deserialization of untrusted data. Exploitation requires the victim to load attacker-crafted serialized data (dataset, manifest, or model checkpoint) on their own machine, making this a local, user-interaction-dependent flaw (AV:L/UI:R) that runs with the victim's privileges. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in the NVIDIA NeMo Speech 'Speech Data Explorer' component (affected versions 0.0 through 2.9, all platforms) lets an attacker who supplies crafted malicious data achieve code execution in the context of the user running the tool, with follow-on privilege escalation, information disclosure, and data tampering. The flaw requires no authentication on the target (PR:N) but is local in reach (AV:L) and depends on user interaction (UI:R) - a user must actively open or load the attacker-crafted dataset, manifest, or serialized artifact inside the Explorer, which confines exposure to developers and researchers running NeMo rather than production network services. No public exploit code was identified at time of analysis, there is no confirmed active exploitation (the CVE is not in CISA KEV), and the CVSS 3.1 base score is 7.8 (CWE-502).
Remote code execution in D-Link DAP-1360 firmware 6.14 and earlier allows unauthenticated attackers to execute arbitrary commands as root via crafted requests to the web management interface. Exploitation requires only network reachability to the device's HTTP management interface-no credentials, user interaction, or non-default configuration-and publicly available exploit code exists, making this a high-priority risk for exposed devices. Successful compromise enables persistent configuration changes and use of the device as a pivot into the local network.
Remote code execution affects Zohocorp ManageEngine ADSelfService Plus deployments running builds prior to 7001, where an OS command injection flaw (CWE-78) in the product's GINA / credential-provider client can be triggered with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning unauthenticated remote attackers with no user interaction could achieve full confidentiality, integrity, and availability impact on the endpoint. The vulnerable component is the optional Windows endpoint agent that enables lock-screen self-service password reset, and because it executes in a pre-logon SYSTEM context, successful injection yields the highest possible privileges on the host. Our independent assessment lowers the exploitability sub-score to AC:H: realistic attack requires the agent to be deployed on Windows endpoints and an attacker to occupy a machine-in-the-middle or rogue-server position on the client-to-server channel rather than being a trivial internet-wide unauthenticated shot against a default server. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory is available at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html.
Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.
Heap-based buffer overflow in libslirp's DHCPv6 and TFTP reply builders lets a malicious guest write attacker-controlled content and length past the end of the host-side reply buffer, causing host process crashes (denial of service) and potentially arbitrary code execution in the host. The flaw only manifests when the host interface is configured with a small, non-default MTU - the default MTU is explicitly unaffected - and requires the guest to reach libslirp's built-in DHCPv6 or TFTP service, which makes this a guest-to-host escape surface for QEMU user networking and slirp4netns rootless containers. Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 ship affected builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector is unauthenticated (PR:N) but high complexity (AC:H) because of the configuration prerequisite.
Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.0 or earlier can force the plugin's wte_get_template helper, reachable through one of its shortcodes, to include and execute arbitrary server-side .php files, enabling sensitive data disclosure, access-control bypass, or code execution. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as high because full remote code execution is gated on the attacker being able to place an attacker-controlled .php file on the server for inclusion; without that upload primitive, impact is limited to including and executing pre-existing PHP files. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so exploitation requires an attacker who already holds a legitimate low-privilege account.
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.
PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized payloads in user-submitted form field values that are later deserialized when an administrator exports submissions to CSV. Publicly available exploit code exists, but full impact - arbitrary file operations or remote code execution - is conditional on a suitable POP gadget chain being present in another installed plugin or theme; without such a chain, the object injection has limited practical impact. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5) reflects the admin-initiated export action and POP-chain prerequisites rather than guaranteed code execution.
CMSimple 5.24 ships with CSRF protection disabled by default, so an unauthenticated attacker can forge a content-save request that a currently logged-in administrator's browser submits (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), storing a text payload containing a scripting marker verbatim in content/content.php. Because evaluate_cmsimple_scripting() in functions.php subsequently runs that marker through PHP eval() on every page view, the result is persistent remote code execution on the web server for all visitors, including unauthenticated ones. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (26th percentile), and realistic risk is limited by the requirement to socially engineer a privileged, actively-authenticated administrator who holds a valid session cookie.
Unauthenticated remote code execution affects ZLMediaKit builds based on commit 9fd5152, where broken access control in the HTTP API allows a remote attacker to overwrite the ffmpeg.snap snapshot configuration parameter with arbitrary shell commands through the setServerConfig endpoint, which are then executed with the privileges of the ZLMediaKit process when getSnap is invoked. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8), no credentials or user interaction are required - the only practical prerequisite is network reachability to the exposed HTTP API service. Exploitation has not been confirmed as active (not in CISA KEV) and no public exploit code was identified at time of analysis; the EPSS score is low at 0.21% (11th percentile), but the unauthenticated, full-compromise nature of the flaw makes it a top-priority fix for any internet-facing or hostile-network-reachable deployment.
Authenticated OpenStack project members can inject arbitrary HAProxy configuration directives - and from there achieve code execution on Amphora load-balancer instances - by embedding newline characters in the tls_ciphers field of a TLS-enabled listener or pool in OpenStack Octavia before 18.0.1. The value is written verbatim into the HAProxy configuration generated on the amphora, so a crafted cipher string breaks out of the intended directive and appends attacker-controlled configuration (CWE-94). Only deployments using the Amphora provider driver are affected; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact that extends beyond the vulnerable component to the amphora instance itself.
Authenticated OpenStack project members who own a load balancer can inject arbitrary HAProxy directives into the amphora configuration produced by Octavia before 18.0.1, because the Amphora provider driver fails to reject control characters in L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, so newline-bearing payloads pass structural checks, but the raw value is stored and written verbatim into the generated HAProxy config - yielding code/directive injection with high confidentiality, integrity, and availability impact on the amphora and the traffic it proxies. Exploitation requires valid tenant credentials plus ownership of a load balancer (CVSS PR:L, unauthenticated paths do not exist), and only Amphora-provider deployments are affected; OVN and other Octavia providers are explicitly immune. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the assessment rates it a genuine high-priority problem rather than an inflated score.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Path traversal in Tautulli's configuration and database import handlers allows an authenticated administrator or anyone holding the instance API key to write files outside the intended CACHE_DIR by supplying a multipart filename containing parent-directory ('../') segments, enabling configuration tampering, service disruption, or potentially code execution before any file-content validation occurs. All Tautulli releases prior to 2.17.2 are affected (CPE cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*), and the flaw is reachable over the network without user interaction, though the high privilege requirement (PR:H in the CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) sharply narrows the attacker population. No public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 2.17.2.
KubeEdge keadm releases from 1.16.0 before 1.21.2, 1.22.2, and 1.23.1 contain a path traversal in DecompressTarGz that, on Windows edge nodes, can extract archive entries with parent-directory sequences, backslashes, absolute paths, or drive prefixes outside the intended destination. Exploitation requires the operator to run keadm join or installation using an archive obtained from a compromised, replaced, or untrusted download source, making this primarily a supply-chain trust-boundary bug rather than an attack against official artifacts. No public exploit was identified at time of analysis, and vendor fixes are released in 1.21.2, 1.22.2, and 1.23.1.
Authenticated users of the Ajenti server admin panel - at any privilege level - can achieve root-level code execution and full host compromise on installations below version 2.2.16 by invoking the task API endpoint /api/core/tasks/start, which enforces no plugin-management authorization before enqueuing InstallPlugin, UnInstallPlugin, or UpgradeAll tasks whose package specifications are built from unvalidated name and version fields and then executed by pip under root. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) confirms a network-reachable, low-privilege, no-interaction attack that escapes the panel's own security scope by gaining root on the underlying host, and exploitation works against default configurations since the missing permission check is the pre-2.2.16 default state. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV entry); nonetheless it is a genuine top-priority issue because a valid low-privileged account converts directly into root on the server.
Stack-based buffer overflow in Fluent Bit's out_forward Secure Forward plugin (versions 0.11.0 through releases prior to 5.0.8) lets an attacker who controls or can impersonate the configured forwarding destination overwrite stack memory while Fluent Bit processes the handshake PONG response. The vulnerable path is only reachable when the out_forward output plugin is configured in Secure Forward mode with Shared_Key or Empty_Shared_Key - not the default output configuration - and the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) plus the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) both characterize it as an unauthenticated network attack that depends on specific deployment preconditions. Impact ranges from reliable process termination on builds compiled with a stack canary to full remote code execution as the Fluent Bit process user on builds lacking canary protection or where a memory-disclosure primitive exists; the opt-in --supervisor mode with fork-only respawns further weakens hardened builds by preserving canary and address layout across restarts. No public exploit code has been identified at time of analysis, and the issue is fixed in version 5.0.8.
Code execution with access to GCP, AWS, and Snowflake credentials is possible in Feast's own CI pipeline prior to version 0.65.0, because the pr_integration_tests.yml workflow uses pull_request_target together with the synchronize event and preserves ok-to-test, approved, or lgtm labels on newly pushed commits. A fork contributor can get maintainer approval for a benign revision and then push altered commits that are checked out from refs/pull/${{ github.event.pull_request.number }}/merge and run through privileged make targets, resulting in runner code execution, credential disclosure, and possible access to downstream cloud resources; the CVSS vector indicates the attacker needs only a low-privilege GitHub identity (PR:L) plus a maintainer's approval action (UI:P), and no public exploit code was identified at the time of analysis. This is a CI/CD pipeline misconfiguration in the upstream feast-dev/feast repository rather than a flaw in deployed Feast installations, and it is fixed in 0.65.0.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
Remote code execution in Univer v1.0.0-alpha.2 allows unauthenticated network attackers to execute arbitrary code via a crafted payload sent to the RemoteRegisterFunctionService endpoint (/remote/remote-register-function.service.ts). The vulnerability is rated CVSS 9.8 (critical) and requires the remote function-registration service to be reachable; only this pre-release alpha build is named as affected. No public exploit code or confirmed active exploitation has been identified, and EPSS indicates a low likelihood of exploitation (0.21%).
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute() function in /services/script-execution.service.ts evaluates attacker-influenced script content (CWE-94), allowing arbitrary code execution with the privileges of the hosting process. The input CVSS vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N), but the authoritative assessment refines the privilege requirement to PR:L, meaning an attacker generally needs a delivery channel - and for most deployments at least application-level access - to place a crafted script into the execution service, and the exposure is further limited to deployments that actually enable Uniscript on this early alpha build. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.21% (11th percentile), indicating low modeled near-term exploitation likelihood.
Authenticated remote code execution affects the Jazzware RT1000 Edge webUI version 20.0.1, where the upgrade-package upload feature accepts server-side executable files and stores them in a web-accessible, executable directory that can be invoked directly over HTTP without authentication. An attacker who already holds valid webUI credentials (CVSS vector PR:L) can reach the upload function, place a malicious executable, and trigger it remotely, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Exploitation status: no public exploit identified at time of analysis; the CVE is not in CISA KEV, and EPSS is low at 0.24% (16th percentile), reflecting the niche target and the credential prerequisite rather than weak impact.
Unrestricted file upload in CuteNews 2.1.2 allows an authenticated user who can reach the Media Manager panel to upload a file of a dangerous type - typically a PHP script - through core/modules/media.php and then request that file to execute arbitrary code in the web application's context; the researcher's disclosure notes this can be driven to a reverse shell and remote server access. The flaw is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning total confidentiality, integrity, and availability impact once triggered, but it is gated behind high privileges: the attacker must already hold a Media Manager-capable (administrative/editor-tier) account. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no vendor-released patch has been identified at time of analysis.
Arbitrary code execution in the npm front-matter parser gray-matter is reachable through its built-in JavaScript engine, which evaluates front matter with eval() whenever the document declares a js/javascript language fence. Any application that passes attacker-influenced markdown or front-matter text into gray-matter's parse call can be induced to run attacker-supplied JavaScript in the Node.js process - the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) rates this as unauthenticated remote code execution, with the practical caveat from our assessment that the attack surface is gated by whether the host application exposes gray-matter parsing to untrusted content. Affected coverage is broad rather than version-specific: the reporter states all versions are impacted and verified 4.0.3, while there is no CISA KEV entry, no confirmed public exploit code, and a low EPSS of 0.17% (7th percentile) indicating limited observed exploitation pressure at time of analysis.
Command injection in CrossWire Xiphos 4.3.2 and earlier lets a local attacker execute arbitrary shell commands with the privileges of the user running the application by placing shell metacharacters in data that Xiphos later interpolates into unsanitized popen() shell pipelines. Two code paths are involved: the personal-commentary rename action (on_rename_perscomm_activate in src/gtk/menu_popup.c), where the module section name is spliced into a cd/sed command, and the separate-image viewer (show_separate_image in src/main/url.cc), where an image filename is spliced into an external viewer's command line. Exploitation requires the victim to trigger one of those actions on attacker-supplied data (a crafted module or image file), the impact is confined to the victim's own account because no privilege escalation is demonstrated, and publicly available exploit code exists (SSVC records exploitation as 'poc'), although the issue is not in CISA KEV and EPSS is low at 0.15% (5th percentile).
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution in REDCap 13.3.0 and later allows an attacker who knows a valid public survey hash to reach an unintended controller route through the survey passthrough routing logic and then supply a crafted file-path/stream parameter to the Data Import processing logic, resulting in arbitrary code execution on the REDCap server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms remote, unauthenticated exploitation with no user interaction required, but the mandatory knowledge of a valid public survey hash is a meaningful prerequisite that rules out blind mass scanning and confines practical exposure to instances actively publishing public surveys. Exploitation status: no public exploit identified at time of analysis; the flaw was reported by Securifera.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Authenticated back-office users of NivoCart (through 2.4.0) holding only view-only privileges can upload and execute arbitrary PHP, turning a low-privilege admin account into full remote code execution on the hosting web server. The flaw is in the File Manager multi() upload endpoint, which skips file-extension validation whenever a new filename is supplied or the chunks parameter is set to 2 or higher, letting a .php payload land in the web-accessible image/data/ directory where it can simply be requested. Exploitation requires a valid low-privileged back-office session and no non-default configuration, there is no CISA KEV entry and no public exploit identified at time of analysis, and the available data does not name an exact fixed version, so exposure hinges on whether an attacker already holds or can obtain a view-only admin account.
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.
Authenticated remote code execution in openEQUELLA releases before 2026.1.0 lets any logged-in non-guest user execute arbitrary code on the server by sending a crafted serialized Java object to the HTTP invoker endpoint at /invoker/*. The flaw is a denylist bypass: the class-name filter in PluginAwareObjectInputStream is evaded by wrapping a malicious payload inside a java.security.SignedObject, whose inner stream is handled by a separate ObjectInputStream that never applies the denylist, ultimately routing into a JNDI lookup sink. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the practical barrier is only the low-privilege account requirement (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scored 8.7 under CVSS 4.0), which is trivial to satisfy on instances that permit self-registration or broad SSO/LDAP provisioning.
Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. No public exploit is identified at time of analysis, this CVE is not in CISA KEV, and no fixed version is published in the referenced sources, so mitigation currently rests on network segmentation rather than patching.
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates the MQTT broker that a device connects to corrupt heap/stack memory and potentially achieve full code execution on that device. Only devices built with lwIP's optional MQTT client compiled in are exposed, and because MQTT connections are client-initiated the device is not directly reachable inbound: the attacker must operate a malicious broker, compromise the legitimate broker, or hold a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or certificate validation is disabled). No authentication or user interaction is required once that broker-side position is achieved, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N) presents this as trivially exploitable, whereas the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the significant broker-control/MITM prerequisite.
Local cross-user code execution with privilege-escalation potential affects the Windows builds of GNU wget distributed by eternallybored.org (releases 0 through 1.21.4 inclusive). The flaw is a hardcoded configuration location, C:\msys64, that unprivileged users can write to: a low-privileged local attacker who plants a wgetrc there can abuse the use_askpass directive so that arbitrary code is executed in the security context of a higher-privileged user who later runs the affected wget build. The attack is not remotely reachable and does not trigger on its own, which is captured by the UI:R component of the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code was identified at time of analysis.
Local code execution on Windows hosts running the Apache Lounge distribution of Apache HTTP Server (builds before Apache 2.4.68-260920 Win64) is possible because the build hardcodes the path to openssl.cnf, allowing a local attacker who can write to that path to plant a malicious OpenSSL configuration that the server loads when TLS is initialized. The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified CWE-732, meaning the weakness is an incorrect permission assignment for a critical resource; exploitation requires the attacker to already have local interactive or code-execution access on the host and the hardcoded path to be writable at the attacker's privilege level, with successful exploitation affecting confidentiality, integrity, and availability at high impact. No public exploit identified at time of analysis and no CISA KEV listing applies, and the issue is specific to the third-party Apache Lounge Windows build rather than the upstream Apache Software Foundation source or Linux distributions.
Arbitrary server-side code execution in the Plone process is possible through the Classic portlet shipped in plone.app.portlets 5.0.0 through 7.0.1, where user-supplied template and macro fields are assembled into a TALES path expression and then evaluated by the TAL path() helper, allowing a crafted value to be interpreted as a full expression rather than a constrained path. Any authenticated user who can add or edit a Classic portlet can execute code, and under Plone's default role map that includes ordinary registered users on their personal dashboard, so the issue amounts to a post-authentication privilege escalation across the trust boundary between a web user and the server-side Plone process (CVSS 3.1 9.9, scope changed: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, but vendor patches are available in 5.0.8, 6.0.4, and 7.0.2.
Unauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent network to execute arbitrary code via deserialization of untrusted data, but only when the deployment is configured to use a specific non-default communication mode. Default-configured instances are not exploitable, and the adjacent-network attack vector (AV:A) further narrows the exposed population. No public exploit code has been identified at time of analysis, and no credentials or user interaction are required once the mode is enabled and reachable.
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first establishes a man-in-the-middle position on the network path to the appliance's administrative component and an administrator then interacts with that component. The CVSS 7.1 vector (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no authentication is needed once the MitM and user-interaction preconditions are met, and successful exploitation grants root privileges. No public exploit code has been identified at time of analysis, and the provided data does not specify a patched version.
Unauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a non-default and non-secure configuration, allowing an attacker who can reach the service to execute arbitrary code with no credentials and no user interaction. The root cause is insufficient integrity checking (CWE-345): when the insecure configuration is present, integrity validation that would otherwise block attacker-supplied content is weakened or bypassed. SolarWinds scores the issue 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that base score does not reflect the environmental gate - default and hardened deployments are not exploitable, so real-world exposure is confined to operators who have deviated from the vendor's documented secure-configuration guidance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.
Opening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an attacker execute arbitrary code in the context of the current user. The flaw is client-side and local in nature - there is no network-facing exposure - so exploitation depends on social engineering to convince a victim to open a poisoned file, and any code that runs inherits only that user's privileges (no privilege escalation). The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches that assessment: high confidentiality and integrity impact, but gated behind the requirement that the user opens the file; no public exploit code or confirmed active exploitation was identified at time of analysis.
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.
Incorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenticated attacker to bypass intended access controls and execute arbitrary code in the context of the running AEM service account, with no user interaction required. The scope-change (S:C) rating and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H produce a maximum 10.0 base score, reflecting that successful exploitation can affect resources beyond the vulnerable component itself. Exposure is limited to deployments where the Forms JEE component is installed and network-reachable - typically internet- or intranet-facing AEM Forms servers - and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) was identified, though the pre-authorization nature of the flaw makes it an attractive target for rapid weaponization.
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper input validation weakness (CWE-20) that is reachable over the network with low attack complexity and no user interaction. Exploitation is gated by a mandatory prerequisite: the attacker must already hold a high-privilege account on the affected AEM Forms JEE instance (CVSS vector PR:H), so only administrative-level users, or an attacker who has first compromised such an account, can reach the vulnerable code path - the assessed risk is genuine but access-gated. Code runs in the context of the current user, and the changed scope (S:C) means impact can extend beyond the vulnerable component; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution with the privileges of the user running Bridge (CVE-2026-75649, CVSS 7.8). The attack is local-host only and depends on user interaction - a victim must open an attacker-supplied malicious file - so it cannot be triggered remotely or automatically, and code executes in the current user's context with no privilege escalation (AV:L/PR:N/UI:R/S:U). At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, but because the advisory is vendor-published and the flaw is a memory-corruption RCE class, it should be treated as a genuine but conditional risk requiring social engineering to deliver.
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of the user who opens it (CVSS 7.8, CWE-121). The attack is local and requires user interaction - an attacker must deliver a malicious file and convince the victim to open it in Bridge (AV:L/AC:L/PR:N/UI:R/S:U), after which code runs in the current user's context without privilege escalation. Impact is limited by the strong social-engineering and delivery prerequisites, and no public exploit identified at time of analysis; risk is concentrated in users who routinely open files from untrusted or external sources.
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controlled code to run with the privileges of the current user. The issue is scored 7.8 (HIGH) and is a client-side, file-format-triggered flaw with a local attack vector and mandatory user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the attacker does not authenticate to the product, but delivery depends entirely on social engineering the victim into opening the malicious file. Only unpatched Adobe Bridge versions addressed by vendor advisory APSB26-148 are affected, and no public exploit identified at time of analysis.
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning the attacker needs no prior privileges but must rely on social engineering to get the target to open a malicious file locally; successful exploitation yields full confidentiality, integrity, and availability impact within the user's own security context, with no privilege escalation to system level. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but non-urgent priority that should be handled through routine vendor patching; Adobe has published an advisory (APSB26-148) with fixed builds.
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chosen files into the server's working directory, because validate_safe_path defaults its base directory to os.getcwd() and the Confluence attachment call sites omit base_dir. Overwriting an importable Python module in that location can escalate to code execution once the application imports the modified module, and the vector intentionally bypasses the earlier remediation tracked as CVE-2026-27825. Exploitation requires permitted MCP tool access (CVSS vector shows PR:L, i.e. authenticated with low privileges) and a subsequent import or re-import of the overwritten module, so code execution is not immediate; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. The vendor rates this 8.3, while an independent assessment confirms it is a genuine remote-exploitable code-execution path whose real-world priority is moderated by those preconditions.
Remote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting a PHP object injection flaw in the billing module handler, where untrusted serialized data in the billing_data POST field is passed to unserialize() without allowed_classes restrictions. Publicly available exploit code exists. Our assessment rates this 9.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N), while the vendor's CVSS 4.0 score is 9.2 (AC:H), reflecting the dependency on a reachable POP chain; no authentication or user interaction is required.
Arbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attackers run code in the context of the running ACC service. The vendor's CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks it as maximum severity: network-reachable, low-complexity, unauthenticated, requiring no user interaction, with a scope change and full loss of confidentiality, integrity, and availability. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, so the practical exposure driver is whether an unpatched ACC instance is reachable over the network.
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary code in the context of the affected process, and the CVSS 3.1 base score is the maximum 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope changed, meaning a successful compromise can cross the component's security boundary and affect resources beyond its intended authority. No user interaction and no authentication prerequisite are required, so the practical exposure is driven almost entirely by whether an ACC instance is reachable from untrusted networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the structural severity signals make this a top-priority patch item; Adobe's bulletin APSB26-142 is the authoritative source for fixed builds.
Code injection in Adobe Campaign Classic allows an authenticated attacker holding only a low-privileged account to execute arbitrary code on the server in the context of the current user, with no user interaction required (CVSS 9.9, Critical). The flaw is network-reachable and low-complexity, but the required low-privilege account is the primary limiting factor - this is not exploitable by fully unauthenticated remote attackers, unlike some sibling Adobe Campaign issues. No public exploit code and no confirmed active exploitation were identified at time of analysis; Adobe has published a security advisory (APSB26-142) for the issue.
Improper input validation in Adobe Campaign Classic allows a low-privileged, authenticated attacker with network reachability to achieve arbitrary code execution in the context of the current user, with the impact scoped beyond the vulnerable component (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, but Adobe explicitly notes that exploitability depends on conditions beyond the attacker's control, reflected as AC:H - meaning successful exploitation is gated by specific environmental, timing, or deployment state rather than being a reliably reproducible remote attack against default installs. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), and the specific vulnerable feature or endpoint is not named in the advisory summary.
SQL injection in Adobe Campaign Classic allows an attacker who already holds a high-privileged operator account to execute arbitrary SQL against the platform's database and, per Adobe, achieve arbitrary code execution in the context of the current user, with the scope change indicating impact that reaches beyond the vulnerable component. The flaw is remotely reachable, low-complexity, and requires no user interaction, but it is gated behind the PR:H prerequisite in the assessed vector, meaning the attacker must first hold or compromise a privileged ACC session and be able to reach the instance over the network. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 9.1 base score with a scope change reflects a serious post-compromise escalation path rather than a pre-authentication remote takeover.
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arbitrary code in the context of the current user, as described by the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score 10.0). The flaw is a CWE-94 code injection issue tracked via CPE cpe:2.3:a:adobe:adobe_campaign_classic, with exact vulnerable and fixed builds enumerated only in Adobe advisory APSB26-142, which the provided data points to but does not quote. No public exploit code and no confirmed active exploitation were identified at time of analysis, but because exploitation requires no authentication and no user interaction, any ACC instance reachable from untrusted networks should be treated as high risk.
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that should have been access-controlled, achieving arbitrary code execution in the context of the current application user without any user interaction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) reflects a scope-changing flaw, meaning the vulnerable component can affect resources beyond its own security boundary - a combination that makes this a genuine top-priority vulnerability for any internet- or partner-reachable ACC deployment. As of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Adobe's advisory APSB26-142 is the authoritative source for affected and fixed builds.
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to execute arbitrary code with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); no user interaction is required, and the scope change means impact is not necessarily confined to the vulnerable component. The affected version range and fixed build are not enumerated in the available intelligence, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, so risk is currently driven by structural severity rather than observed attacks. Because ACC is an internet-reachable marketing automation platform that typically stores customer data and holds credentials for downstream systems, this should be treated as a top-priority patch item even though corroborating sources are limited to Adobe's own advisory.
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems running Adobe Campaign Classic, tracked as CVE-2026-73369, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with a base score of 10.0 (CWE-94 code injection). Exploitation requires no authentication, no user interaction, and no confirmed special configuration; the vector's changed scope (S:C) means the compromise can affect resources beyond the vulnerable component's security authority, though the code itself runs as the current application user rather than as a privileged system account. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but the impact, the low attack complexity, and the two practical limiting factors - network reachability of the ACC instance and the currently unspecified affected version range (CPE is a wildcard) - make this a genuine top-tier priority for any deployment confirmed affected by Adobe advisory APSB26-142.
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the context of the current user without any victim interaction, because the platform fails to properly validate input reaching an exposed processing component. The flaw scores 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and its scope change means a successful exploit can affect resources beyond the vulnerable component, raising the blast radius for confidentiality, integrity, and availability. The decisive prerequisite is authentication: per the assessed vector (PR:L), any valid low-privilege ACC account that can reach the component over the network is enough, but a fully anonymous remote attacker cannot trigger it; there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so the exploitation signals remain thin even though the severity math is high.
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current user, carrying a maximum-severity CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with no user interaction required under the vendor vector. The CPE data flags the product with a wildcard version, so the specific affected release range is not enumerated in the supplied intelligence, and Adobe's advisory (APSB26-142) is the only reference. Exploitation status: no public exploit identified at time of analysis; independent analysis cautions that the advisory is sparse and that the description's 'current user' wording may imply an existing session context, so the PR:N unauthenticated rating should be confirmed with Adobe.
Unauthenticated remote code execution in Adobe Campaign Classic allows attackers to execute arbitrary code in the context of the current user due to an incorrect authorization flaw (CWE-863). The flaw is network-reachable with low complexity and no user interaction (CVSS 9.1), though code execution is limited to the application user context rather than system privileges. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in Adobe Campaign Classic allows an authenticated low-privileged user to execute arbitrary code in the context of the current user, with no victim interaction required, carrying a CVSS base score of 9.9. The vulnerability is exploitable over the network with low attack complexity (AV:N/AC:L/PR:L/UI:N) and is rated Scope Changed, meaning a successful attack can escape the ACC application boundary and affect the underlying database or host rather than remaining confined to the web tier. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the credential-only precondition and the low privilege bar make this a priority fix for any broadly provisioned or externally reachable Campaign Classic instance.
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array inside PluginsManager::loadPluginFromPath(), corrupting adjacent control data and potentially yielding arbitrary code execution in the Notepad++ process; the flaw affects all releases prior to 8.9.8. The attack is local and requires user interaction (the victim must install and load the malicious native plugin DLL), and because any loaded native plugin already runs in-process with full editor privileges, the incremental risk over simply distributing malicious plugin code is minimal - no public exploit identified at time of analysis, and the issue is not reachable remotely or through opened documents. Vendor-released patch: 8.9.8 (CVSS 8.6 base score; our assessment keeps the same 8.6 but treats scope as Unchanged rather than Changed).
Authenticated code execution in Sentry's relocation import worker lets a user with a valid account on an affected instance run arbitrary code in the worker process by uploading a crafted relocation archive. Only instances that have explicitly enabled the relocation (backup import/export) feature are exposed, since that feature is disabled by default in self-hosted installations; affected versions run from 23.11.0 up to but not including 26.7.0, which contains the fix. Severity is high (7.7 under CVSS 4.0), requires authenticated access and a non-default feature flag, and no public exploit has been identified at time of analysis.
Unsafe reflection in Apache Calcite Avatica before 1.29.0 allows an attacker who can influence plugin-instantiation parameters to force the loading and static initialization of arbitrary classes on the server classpath. Exploitation requires low privileges (PR:L per the assessed CVSS vector) and a dangerous static-initializer gadget already present on the classpath; the vendor states no well-known class currently satisfies this, so real-world risk is low despite the RCE tag. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Deserialization-based code execution is possible in MISP because PHP's phar stream wrapper is left registered in both the web entry point (app/webroot/index.php) and the console entry point (app/Console/cake.php), so any filesystem call on a caller-influenced path that resolves to a phar archive silently triggers an unserialize() of attacker-controlled metadata, or can reach executable code inside an uploaded phar under a relocated application root. The vendor's fix (commit 08fa755b6) simply unregisters the wrapper at startup, confirming that nothing in MISP, vendored CakePHP, or runtime libraries legitimately uses phar archives. Real-world risk is lower than the 7.7 CVSS 4.0 score suggests: the vector requires authentication (PR:L - a valid MISP account) and High attack complexity (AC:H), because no MISP/CakePHP/library code natively feeds a caller-influenced path into a phar-resolving operation, so a separate path-influence bug must be chained and no public exploit code has been identified at time of analysis.
Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (Access Policy Manager) access policy and an OAuth profile, where crafted malicious traffic can trigger a heap-based buffer overflow in the data plane. The flaw is remotely reachable, unauthenticated and low complexity per the vendor's CVSS 4.0 base score of 9.3, and the independent assessment confirms full confidentiality, integrity and availability impact (C:H/I:H/A:H) with no control-plane exposure; Appliance mode does not mitigate it. Exploitability is sharply limited by configuration - instances without APM or without an OAuth profile bound to a virtual server are not affected - and no public exploit code was identified at time of analysis, though the combination of unauthenticated RCE and a widely deployed enterprise appliance makes prompt hotfix deployment the priority.
Unauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a network-reachable attacker execute arbitrary operating system commands on the host, enabling code execution, data tampering, denial of service, and information disclosure. Per the NVIDIA-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), no credentials or user interaction are required, so an exposed controller interface is directly attackable; CISA's SSVC assessment rates technical impact as total, though exploitation has not been observed and the decision framework does not classify the issue as automatable. No public exploit code has been identified at time of analysis, and EPSS places the short-term exploitation likelihood at 2.10% (81st percentile) - elevated relative to the broader corpus but not indicative of active campaigns.
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds valid low-privilege credentials to inject arbitrary SQL through the management interface, with CVSS 3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could lead to code execution on the underlying database or controller services, tampering with stored data, denial of service, and disclosure of sensitive configuration or credential material held by the controller. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is remotely reachable without user interaction and any authenticated, network-exposed instance in the affected range should be treated as priority-worthy rather than emergency-level, given the authentication prerequisite and the niche datacenter/DPU deployment footprint.
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path that an attacker can influence, which the vendor states may lead to code execution, privilege escalation, data tampering, and denial of service. Rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a low-complexity but not fully unauthenticated issue: the attacker must be able to reach the controller over the network and already hold a low-privileged authenticated account, at which point no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is a low 0.61% (48th percentile), so near-term mass exploitation is unlikely even though technical impact is total (C:H/I:H/A:H).
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is launched in disaggregated-diffusion mode, where the DiffusionServer orchestrator binds a ZeroMQ ROUTER socket to a network-reachable interface with no authentication and passes the final frame of every received multipart message directly into pickle.loads() before any validation is performed. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw lets any remote party that can deliver a multipart ZMQ message to that socket execute arbitrary Python code in the serving process, yielding full compromise of confidentiality, integrity and availability on the host. No public exploit identified at time of analysis; exploitation requires the exposed orchestrator socket to be reachable beyond localhost, so loopback-bound or single-node deployments are not remotely exploitable.
Code execution, data tampering, denial of service, and information disclosure are all reachable in NVIDIA NeMo Speech 0.0 through 2.9 because its TabularTokenizer class deserializes attacker-supplied .pkl artifacts through pickle.load() with no validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) marks this as unauthenticated but user-interaction-gated: nothing executes until a NeMo user obtains and loads the malicious tokenizer or model file, so the attack depends on a social-engineering or supply-chain delivery step rather than a directly triggerable remote request. Impact is rated high across all three security properties, but no public exploit code was identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; realistic exposure is further narrowed by the research and development orientation of the affected toolkit.
Code execution, data tampering, denial of service, and information disclosure in NVIDIA NeMo Speech (versions 0.0 through 2.9) stem from unsafe deserialization of parameters injected through a maliciously crafted model_config.yaml handled by the dataset-loading workflow. The issue is locally scoped: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:R with a base score of 7.8, meaning an attacker with low privileges must place the crafted config where the victim or an automated pipeline will parse it - for example inside a shared or downloaded model bundle or dataset - and exploitation depends on that untrusted NeMo config being loaded. There is no remote network-service exposure, and no public exploit identified at time of analysis; the CVE is not listed in CISA KEV.
Code injection in NVIDIA NeMo Speech versions 0.0 through 2.9 allows local attackers with low privileges to execute arbitrary code, disclose sensitive information, and tamper with data by supplying crafted input to the toolkit. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction; it has a CVSS 3.1 base score of 7.8 (High) and is classified as CWE-77 (command injection). No public exploit code has been identified at time of analysis, and the vendor advisory at GitHub NVIDIA product-security 2026/5885 should be consulted for patch details.
Code execution, information disclosure, and data tampering are possible in NVIDIA NeMo Speech versions 0.0 through 2.9 due to unsafe deserialization of untrusted data. Exploitation requires the victim to load attacker-crafted serialized data (dataset, manifest, or model checkpoint) on their own machine, making this a local, user-interaction-dependent flaw (AV:L/UI:R) that runs with the victim's privileges. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in the NVIDIA NeMo Speech 'Speech Data Explorer' component (affected versions 0.0 through 2.9, all platforms) lets an attacker who supplies crafted malicious data achieve code execution in the context of the user running the tool, with follow-on privilege escalation, information disclosure, and data tampering. The flaw requires no authentication on the target (PR:N) but is local in reach (AV:L) and depends on user interaction (UI:R) - a user must actively open or load the attacker-crafted dataset, manifest, or serialized artifact inside the Explorer, which confines exposure to developers and researchers running NeMo rather than production network services. No public exploit code was identified at time of analysis, there is no confirmed active exploitation (the CVE is not in CISA KEV), and the CVSS 3.1 base score is 7.8 (CWE-502).
Remote code execution in D-Link DAP-1360 firmware 6.14 and earlier allows unauthenticated attackers to execute arbitrary commands as root via crafted requests to the web management interface. Exploitation requires only network reachability to the device's HTTP management interface-no credentials, user interaction, or non-default configuration-and publicly available exploit code exists, making this a high-priority risk for exposed devices. Successful compromise enables persistent configuration changes and use of the device as a pivot into the local network.
Remote code execution affects Zohocorp ManageEngine ADSelfService Plus deployments running builds prior to 7001, where an OS command injection flaw (CWE-78) in the product's GINA / credential-provider client can be triggered with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning unauthenticated remote attackers with no user interaction could achieve full confidentiality, integrity, and availability impact on the endpoint. The vulnerable component is the optional Windows endpoint agent that enables lock-screen self-service password reset, and because it executes in a pre-logon SYSTEM context, successful injection yields the highest possible privileges on the host. Our independent assessment lowers the exploitability sub-score to AC:H: realistic attack requires the agent to be deployed on Windows endpoints and an attacker to occupy a machine-in-the-middle or rogue-server position on the client-to-server channel rather than being a trivial internet-wide unauthenticated shot against a default server. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory is available at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html.
Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.
Heap-based buffer overflow in libslirp's DHCPv6 and TFTP reply builders lets a malicious guest write attacker-controlled content and length past the end of the host-side reply buffer, causing host process crashes (denial of service) and potentially arbitrary code execution in the host. The flaw only manifests when the host interface is configured with a small, non-default MTU - the default MTU is explicitly unaffected - and requires the guest to reach libslirp's built-in DHCPv6 or TFTP service, which makes this a guest-to-host escape surface for QEMU user networking and slirp4netns rootless containers. Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 ship affected builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector is unauthenticated (PR:N) but high complexity (AC:H) because of the configuration prerequisite.
Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.0 or earlier can force the plugin's wte_get_template helper, reachable through one of its shortcodes, to include and execute arbitrary server-side .php files, enabling sensitive data disclosure, access-control bypass, or code execution. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as high because full remote code execution is gated on the attacker being able to place an attacker-controlled .php file on the server for inclusion; without that upload primitive, impact is limited to including and executing pre-existing PHP files. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so exploitation requires an attacker who already holds a legitimate low-privilege account.
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.
PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized payloads in user-submitted form field values that are later deserialized when an administrator exports submissions to CSV. Publicly available exploit code exists, but full impact - arbitrary file operations or remote code execution - is conditional on a suitable POP gadget chain being present in another installed plugin or theme; without such a chain, the object injection has limited practical impact. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5) reflects the admin-initiated export action and POP-chain prerequisites rather than guaranteed code execution.
CMSimple 5.24 ships with CSRF protection disabled by default, so an unauthenticated attacker can forge a content-save request that a currently logged-in administrator's browser submits (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), storing a text payload containing a scripting marker verbatim in content/content.php. Because evaluate_cmsimple_scripting() in functions.php subsequently runs that marker through PHP eval() on every page view, the result is persistent remote code execution on the web server for all visitors, including unauthenticated ones. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (26th percentile), and realistic risk is limited by the requirement to socially engineer a privileged, actively-authenticated administrator who holds a valid session cookie.
Unauthenticated remote code execution affects ZLMediaKit builds based on commit 9fd5152, where broken access control in the HTTP API allows a remote attacker to overwrite the ffmpeg.snap snapshot configuration parameter with arbitrary shell commands through the setServerConfig endpoint, which are then executed with the privileges of the ZLMediaKit process when getSnap is invoked. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8), no credentials or user interaction are required - the only practical prerequisite is network reachability to the exposed HTTP API service. Exploitation has not been confirmed as active (not in CISA KEV) and no public exploit code was identified at time of analysis; the EPSS score is low at 0.21% (11th percentile), but the unauthenticated, full-compromise nature of the flaw makes it a top-priority fix for any internet-facing or hostile-network-reachable deployment.
Authenticated OpenStack project members can inject arbitrary HAProxy configuration directives - and from there achieve code execution on Amphora load-balancer instances - by embedding newline characters in the tls_ciphers field of a TLS-enabled listener or pool in OpenStack Octavia before 18.0.1. The value is written verbatim into the HAProxy configuration generated on the amphora, so a crafted cipher string breaks out of the intended directive and appends attacker-controlled configuration (CWE-94). Only deployments using the Amphora provider driver are affected; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact that extends beyond the vulnerable component to the amphora instance itself.
Authenticated OpenStack project members who own a load balancer can inject arbitrary HAProxy directives into the amphora configuration produced by Octavia before 18.0.1, because the Amphora provider driver fails to reject control characters in L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, so newline-bearing payloads pass structural checks, but the raw value is stored and written verbatim into the generated HAProxy config - yielding code/directive injection with high confidentiality, integrity, and availability impact on the amphora and the traffic it proxies. Exploitation requires valid tenant credentials plus ownership of a load balancer (CVSS PR:L, unauthenticated paths do not exist), and only Amphora-provider deployments are affected; OVN and other Octavia providers are explicitly immune. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the assessment rates it a genuine high-priority problem rather than an inflated score.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Path traversal in Tautulli's configuration and database import handlers allows an authenticated administrator or anyone holding the instance API key to write files outside the intended CACHE_DIR by supplying a multipart filename containing parent-directory ('../') segments, enabling configuration tampering, service disruption, or potentially code execution before any file-content validation occurs. All Tautulli releases prior to 2.17.2 are affected (CPE cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*), and the flaw is reachable over the network without user interaction, though the high privilege requirement (PR:H in the CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) sharply narrows the attacker population. No public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 2.17.2.
KubeEdge keadm releases from 1.16.0 before 1.21.2, 1.22.2, and 1.23.1 contain a path traversal in DecompressTarGz that, on Windows edge nodes, can extract archive entries with parent-directory sequences, backslashes, absolute paths, or drive prefixes outside the intended destination. Exploitation requires the operator to run keadm join or installation using an archive obtained from a compromised, replaced, or untrusted download source, making this primarily a supply-chain trust-boundary bug rather than an attack against official artifacts. No public exploit was identified at time of analysis, and vendor fixes are released in 1.21.2, 1.22.2, and 1.23.1.
Authenticated users of the Ajenti server admin panel - at any privilege level - can achieve root-level code execution and full host compromise on installations below version 2.2.16 by invoking the task API endpoint /api/core/tasks/start, which enforces no plugin-management authorization before enqueuing InstallPlugin, UnInstallPlugin, or UpgradeAll tasks whose package specifications are built from unvalidated name and version fields and then executed by pip under root. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) confirms a network-reachable, low-privilege, no-interaction attack that escapes the panel's own security scope by gaining root on the underlying host, and exploitation works against default configurations since the missing permission check is the pre-2.2.16 default state. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV entry); nonetheless it is a genuine top-priority issue because a valid low-privileged account converts directly into root on the server.
Stack-based buffer overflow in Fluent Bit's out_forward Secure Forward plugin (versions 0.11.0 through releases prior to 5.0.8) lets an attacker who controls or can impersonate the configured forwarding destination overwrite stack memory while Fluent Bit processes the handshake PONG response. The vulnerable path is only reachable when the out_forward output plugin is configured in Secure Forward mode with Shared_Key or Empty_Shared_Key - not the default output configuration - and the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) plus the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) both characterize it as an unauthenticated network attack that depends on specific deployment preconditions. Impact ranges from reliable process termination on builds compiled with a stack canary to full remote code execution as the Fluent Bit process user on builds lacking canary protection or where a memory-disclosure primitive exists; the opt-in --supervisor mode with fork-only respawns further weakens hardened builds by preserving canary and address layout across restarts. No public exploit code has been identified at time of analysis, and the issue is fixed in version 5.0.8.
Code execution with access to GCP, AWS, and Snowflake credentials is possible in Feast's own CI pipeline prior to version 0.65.0, because the pr_integration_tests.yml workflow uses pull_request_target together with the synchronize event and preserves ok-to-test, approved, or lgtm labels on newly pushed commits. A fork contributor can get maintainer approval for a benign revision and then push altered commits that are checked out from refs/pull/${{ github.event.pull_request.number }}/merge and run through privileged make targets, resulting in runner code execution, credential disclosure, and possible access to downstream cloud resources; the CVSS vector indicates the attacker needs only a low-privilege GitHub identity (PR:L) plus a maintainer's approval action (UI:P), and no public exploit code was identified at the time of analysis. This is a CI/CD pipeline misconfiguration in the upstream feast-dev/feast repository rather than a flaw in deployed Feast installations, and it is fixed in 0.65.0.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
Remote code execution in Univer v1.0.0-alpha.2 allows unauthenticated network attackers to execute arbitrary code via a crafted payload sent to the RemoteRegisterFunctionService endpoint (/remote/remote-register-function.service.ts). The vulnerability is rated CVSS 9.8 (critical) and requires the remote function-registration service to be reachable; only this pre-release alpha build is named as affected. No public exploit code or confirmed active exploitation has been identified, and EPSS indicates a low likelihood of exploitation (0.21%).
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute() function in /services/script-execution.service.ts evaluates attacker-influenced script content (CWE-94), allowing arbitrary code execution with the privileges of the hosting process. The input CVSS vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N), but the authoritative assessment refines the privilege requirement to PR:L, meaning an attacker generally needs a delivery channel - and for most deployments at least application-level access - to place a crafted script into the execution service, and the exposure is further limited to deployments that actually enable Uniscript on this early alpha build. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.21% (11th percentile), indicating low modeled near-term exploitation likelihood.
Authenticated remote code execution affects the Jazzware RT1000 Edge webUI version 20.0.1, where the upgrade-package upload feature accepts server-side executable files and stores them in a web-accessible, executable directory that can be invoked directly over HTTP without authentication. An attacker who already holds valid webUI credentials (CVSS vector PR:L) can reach the upload function, place a malicious executable, and trigger it remotely, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Exploitation status: no public exploit identified at time of analysis; the CVE is not in CISA KEV, and EPSS is low at 0.24% (16th percentile), reflecting the niche target and the credential prerequisite rather than weak impact.
Unrestricted file upload in CuteNews 2.1.2 allows an authenticated user who can reach the Media Manager panel to upload a file of a dangerous type - typically a PHP script - through core/modules/media.php and then request that file to execute arbitrary code in the web application's context; the researcher's disclosure notes this can be driven to a reverse shell and remote server access. The flaw is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning total confidentiality, integrity, and availability impact once triggered, but it is gated behind high privileges: the attacker must already hold a Media Manager-capable (administrative/editor-tier) account. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no vendor-released patch has been identified at time of analysis.
Arbitrary code execution in the npm front-matter parser gray-matter is reachable through its built-in JavaScript engine, which evaluates front matter with eval() whenever the document declares a js/javascript language fence. Any application that passes attacker-influenced markdown or front-matter text into gray-matter's parse call can be induced to run attacker-supplied JavaScript in the Node.js process - the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) rates this as unauthenticated remote code execution, with the practical caveat from our assessment that the attack surface is gated by whether the host application exposes gray-matter parsing to untrusted content. Affected coverage is broad rather than version-specific: the reporter states all versions are impacted and verified 4.0.3, while there is no CISA KEV entry, no confirmed public exploit code, and a low EPSS of 0.17% (7th percentile) indicating limited observed exploitation pressure at time of analysis.
Command injection in CrossWire Xiphos 4.3.2 and earlier lets a local attacker execute arbitrary shell commands with the privileges of the user running the application by placing shell metacharacters in data that Xiphos later interpolates into unsanitized popen() shell pipelines. Two code paths are involved: the personal-commentary rename action (on_rename_perscomm_activate in src/gtk/menu_popup.c), where the module section name is spliced into a cd/sed command, and the separate-image viewer (show_separate_image in src/main/url.cc), where an image filename is spliced into an external viewer's command line. Exploitation requires the victim to trigger one of those actions on attacker-supplied data (a crafted module or image file), the impact is confined to the victim's own account because no privilege escalation is demonstrated, and publicly available exploit code exists (SSVC records exploitation as 'poc'), although the issue is not in CISA KEV and EPSS is low at 0.15% (5th percentile).
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution in REDCap 13.3.0 and later allows an attacker who knows a valid public survey hash to reach an unintended controller route through the survey passthrough routing logic and then supply a crafted file-path/stream parameter to the Data Import processing logic, resulting in arbitrary code execution on the REDCap server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms remote, unauthenticated exploitation with no user interaction required, but the mandatory knowledge of a valid public survey hash is a meaningful prerequisite that rules out blind mass scanning and confines practical exposure to instances actively publishing public surveys. Exploitation status: no public exploit identified at time of analysis; the flaw was reported by Securifera.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Authenticated back-office users of NivoCart (through 2.4.0) holding only view-only privileges can upload and execute arbitrary PHP, turning a low-privilege admin account into full remote code execution on the hosting web server. The flaw is in the File Manager multi() upload endpoint, which skips file-extension validation whenever a new filename is supplied or the chunks parameter is set to 2 or higher, letting a .php payload land in the web-accessible image/data/ directory where it can simply be requested. Exploitation requires a valid low-privileged back-office session and no non-default configuration, there is no CISA KEV entry and no public exploit identified at time of analysis, and the available data does not name an exact fixed version, so exposure hinges on whether an attacker already holds or can obtain a view-only admin account.
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.