RCE
Monthly
Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. No public exploit has been identified at time of analysis; Linux and Windows hosts are explicitly unaffected.
Type confusion (CWE-843) in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Multiple product lines are affected, including Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383. No public exploit or CISA KEV listing has been identified at time of analysis, but the ubiquity of Acrobat Reader and routine delivery of PDFs via phishing make this a realistic and high-priority patching target.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.
Double Free memory corruption in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the victim user when a malicious PDF or document file is opened. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. Adobe PSIRT has published advisory APSB26-141 confirming the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer overflow in Adobe Photoshop Desktop enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. Both the Photoshop 2026 (≤27.6) and Photoshop 2025 (≤26.11.6) release lines are affected. No public exploit code or active exploitation has been identified at time of analysis, but the file-open attack surface is a historically well-worn delivery mechanism for creative-software exploits.
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. Affected versions span both the Photoshop 2025 line (≤26.11.6) and Photoshop 2026 line (≤27.6), covering a broad install base of creative and enterprise users. No public exploit has been identified at time of analysis, though the file-based delivery mechanism makes phishing or watering-hole distribution a natural attack path.
Out-of-bounds write in Adobe Photoshop Desktop allows arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted malicious file. Affected versions span both the Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6) release lines. Adobe's PSIRT has released advisory APSB26-130 addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side code execution in CMSimple 5.22's CoAuthors plugin enables an authenticated low-privileged user who can edit page content to achieve full remote code execution by passing crafted external or uploaded text through the plugin's content import feature. The vulnerability is rooted in CWE-94 (improper code generation control), where imported content is processed server-side without sufficient sanitization, allowing arbitrary PHP or server-side logic to execute in the web server context. Publicly available exploit code exists via a GitHub gist and associated issue tracker, though EPSS stands at 0.17%, reflecting limited observed exploitation at this time.
Code execution with the privileges of the management console is possible in Okta Access Gateway releases before 2026.9.1, where the console's exception-handling path passes user-supplied input to eval() without sanitization. Reaching that path requires an already-authenticated administrator SSH session (CVSS vector PR:H), so this is a privilege-boundary break that lets a trusted console operator escalate from constrained administrative commands to arbitrary code execution rather than an anonymous network entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation and no automatable attack path, and EPSS is a low 0.36% (29th percentile), so real-world priority is low despite the high confidentiality, integrity and availability impact scored in the CVSS 7.2 assessment.
Authenticated administrative users of Okta Access Gateway can achieve arbitrary command execution on the underlying gateway host by storing crafted values in an application's label field, which the product interpolates without sanitization into generated nginx server block configuration. The flaw affects Okta Access Gateway versions prior to 2026.9.1 (CPE cpe:2.3:a:okta:access_gateway), scores CVSS 3.1 base 7.2 (High) with total confidentiality, integrity, and availability impact under vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and requires high-privilege (PR:H) access to the management console to seed the malicious label - no user interaction is needed, and the injected directives take effect when the gateway regenerates and reloads its nginx configuration. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.36% (29th percentile), so this is best characterized as an admin-to-host privilege-abuse vector rather than a remotely exploitable unauthenticated issue.
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution when a victim opens a maliciously crafted file. The vulnerability affects Photoshop 2026 versions up to and including 27.6 and Photoshop 2025 versions up to and including 26.11.6, with scope change indicating code execution can escape the Photoshop process boundary. No public exploit identified at time of analysis; Adobe has released patches via APSB26-130.
Eval injection (CWE-95) in Adobe ColdFusion 2023 (≤Update 23) and ColdFusion 2025 (≤Update 12) enables unauthenticated, network-based arbitrary code execution without user interaction. User-supplied input reaching a dynamic code evaluation function is processed without sanitization, allowing injected CFML or Java expressions to execute server-side as the application user. The CVSS scope-change metric (S:C) indicates the impact can extend beyond the ColdFusion process itself; Adobe PSIRT issued formal advisory APSB26-119. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Adobe ColdFusion 2025 (≤update 12) and 2023 (≤update 23) allows a low-privileged attacker with adjacent network access to execute arbitrary code in the context of the victim user by delivering a malicious file for the target to open. The vulnerable component is confined to the administrative network zone by default, and the attack requires scope change - meaning successful exploitation can extend impact beyond the ColdFusion process itself. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. No public exploit identified at time of analysis, but the low attack complexity and full CIA impact across affected versions represent a meaningful and realistic risk.
Arbitrary code execution in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) is achievable when a victim opens a specially crafted malicious file, exploiting improper input validation (CWE-20) in the file-parsing subsystem. The CVSS scope-change indicator (S:C) signals that successful exploitation can affect resources beyond the Illustrator process boundary - i.e., impacts propagate to the broader user session or OS context. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis, though the file-delivery vector makes this a realistic phishing-grade threat against creative and design professionals.
Arbitrary code execution in Adobe Illustrator Desktop 2025 and 2026 is possible when a victim opens a specially crafted malicious file, exploiting an Incorrect Authorization flaw (CWE-863) that allows attacker-controlled file content to bypass authorization checks and trigger code execution in the current user's context. The changed-scope designation in the CVSS vector (S:C with C:H/I:H/A:H) indicates the impact extends beyond the Illustrator process itself, consistent with a sandbox or privilege boundary escape. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at this time, though SSVC also rates technical impact as 'total', meaning successful exploitation is fully compromising.
Integer overflow in Adobe Photoshop Desktop's file-parsing logic allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Affected versions span both Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6), covering a broad installed base of creative and enterprise users. No public exploit code or active exploitation has been identified at time of analysis; Adobe has published a fix under advisory APSB26-130.
Integer overflow in Adobe Photoshop Desktop (versions 2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the authenticated user. The flaw is triggered during parsing of a specially crafted file - a social-engineering delivery step is required, as the victim must open the malicious file. Adobe has issued advisory APSB26-130 addressing both affected release lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer overflow in Adobe Photoshop Desktop (2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. The attack vector is local (AV:L) with mandatory user interaction (UI:R), making social engineering - phishing with a weaponized design file - the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad and Adobe PSIRT attribution confirm this is a serious file-parsing flaw covered under advisory APSB26-130.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) is possible through an SQL injection flaw (CWE-89) that a high-privileged authenticated attacker can escalate into code execution in the context of the current user. The CVSS vector marks the scope as changed, reflecting that database-layer injection pivots into broader application/OS impact. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds write in Adobe Photoshop Desktop enables arbitrary code execution in the context of the victim's user account when a malicious file is opened. Both the 2025 branch (through version 26.11.6) and the 2026 branch (through version 27.6) are confirmed affected per Adobe's EUVD entry and APSB26-130 advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open trigger and high CVSS C/I/A ratings make this a credible phishing-delivery vector in creative and design environments.
Remote code execution in Adobe ColdFusion 2023 (update ≤23) and ColdFusion 2025 (update ≤12) allows a low-privileged, authenticated attacker to inject directives into dynamically evaluated code (CWE-95, 'Eval Injection') and execute arbitrary code in the context of the current user without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable, low-complexity flaw with a scope change, meaning code executes beyond the initially authorized security context. No public exploit is identified at time of analysis, but ColdFusion RCE flaws are historically high-value targets and are frequently weaponized quickly after disclosure.
Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Adobe (PSIRT) rated it 9.9 critical and shipped a fix in APSB26-98; no public exploit is identified at time of analysis.
Stack-based buffer overflow in the TP-Link RE210 AC750 range extender's httpd component enables authenticated, adjacent-network attackers to achieve remote code execution by uploading a specially crafted configuration file that exceeds bounds in the `splitString` function. Affected firmware spans US builds through 3.14.2 Build 171205 Rel.71984n and EU builds through 3.14.2 Build 141218 Rel.36430n, per EUVD-2026-73942. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact triplet (C:H/I:H/A:H) indicates full device compromise upon successful exploitation.
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to execute arbitrary code in the context of the running user with no user interaction. Adobe PSIRT rates this a maximum-severity CVSS 10.0 issue with a changed scope, meaning a successful exploit can affect resources beyond the vulnerable component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in MLflow (all versions ≥ 0.0.1) is achievable through a maliciously crafted model artifact that exploits the platform's model-loading pipeline, triggering code execution on the end user's system when the artifact is deserialized. An attacker with the ability to publish or distribute a poisoned model to a shared registry can fully compromise any data scientist or ML engineer who loads it, gaining complete control over their workstation or compute environment. No public exploit has been identified at time of analysis, but SSVC rates technical impact as total; the HiddenLayer SAI advisory (2026-09) covers this class of ML supply-chain attack.
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Out-of-bounds write in Android's NFC RoutingManager (checkUikcListenConfigNeeded in RoutingManager.cpp) enables remote code execution from adjacent NFC proximity on Android 16-QPR2 and Android 17 without requiring user interaction. The missing bounds check in UICC listen configuration handling allows a proximal attacker to corrupt memory in the NFC daemon, leading to full code execution in that process context. No public exploit has been identified at time of analysis; SSVC rates technical impact as total but exploitation status as none.
Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.
Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.
Remote code execution is achievable in Android's NFC subsystem across Android 14 through 17, including Android 16-QPR2, via a heap buffer overflow in the MIFARE Classic tag reader function rw_mfc_handle_read_op() within rw_mfc.cc. An attacker within NFC proximity can present a crafted MIFARE Classic tag that overflows a heap-allocated buffer in the NFC daemon, yielding full device control with no victim interaction required and no privileges needed on the target. No public exploit has been identified at time of analysis, though the SSVC framework rates the technical impact as total given the unauthenticated RCE capability.
Local privilege escalation in Android 17's telephony stack allows a low-privileged app to achieve arbitrary code execution without user interaction. The logic error in the serviceClassExists method of InCallController.java (CWE-693, Protection Mechanism Failure) enables an attacker with local shell or app access to elevate privileges to those of the telecom service process, gaining full read, write, and execution control. No public exploit exists at time of analysis, and SSVC assesses exploitation as none, though the technical impact is rated total.
Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.
Heap buffer overflow in Android's Wi-Fi P2P (Wi-Fi Direct) provision discovery handler enables proximal unauthenticated attackers to achieve remote code execution on affected devices without requiring user interaction. The flaw resides in `p2p_process_prov_disc_bootstrap_req()` within `p2p_pd.c`, where a malformed provision discovery bootstrap request triggers an out-of-bounds write on the heap. Android 16, Android 16-QPR2, and Android 17 are confirmed affected per the September 2026 Android Security Bulletin; no public exploit code exists and EPSS at 0.13% (3rd percentile) reflects minimal current exploitation activity.
Heap buffer overflow in Android's OAPV video codec decoder (oapv.c) enables remote code execution on Android 16 and 17 without requiring user interaction. The flaw resides in dec_frm_prepare(), where insufficient bounds checking during frame decoding preparation allows an attacker to overwrite heap memory via crafted video content. EPSS sits at 0.18% (8th percentile) with SSVC exploitation status rated 'none', but technical impact is classified as 'total' and no public exploit has been identified at time of analysis.
Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. No public exploit has been identified at time of analysis, and EPSS stands at 0.15%, though the zero-interaction requirement and full-impact CVSS 8.8 rating warrant prompt patching.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Code injection in Microsoft Remote Desktop Client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) enables an unauthenticated network attacker to execute arbitrary code on the connecting client machine. The vulnerability is triggered when a user connects to an attacker-controlled RDP server that delivers malicious server-side responses exploiting CWE-94 code generation flaws in the client. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Microsoft Dynamics 365 Customer Engagement V9.1 (versions below 9.1.0048.0004) is achievable by authenticated network attackers through a code injection vulnerability (CWE-94). An attacker holding a low-privilege account can submit a crafted request that causes the server to generate and execute attacker-controlled code, resulting in full confidentiality, integrity, and availability compromise of the affected instance. Microsoft has released a patch via the MSRC update guide, and no public exploit code has been identified at time of analysis.
Code injection in Adobe Animate allows a low-privileged attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. Both the 2023 and 2024 major release lines are affected, covering all versions up to and including 23.0.16 and 24.0.14 respectively. SSVC assessment indicates no current exploitation activity, but the technical impact is rated total due to full C/I/A compromise and a scope change beyond the vulnerable component.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network-positioned attacker to execute arbitrary code with system privileges on affected Windows hosts by sending crafted requests to the RRAS service, a consequence of a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The exposure is conditioned on the host actually running the RRAS role: RRAS is not installed or enabled in default Windows and Windows Server configurations, so only machines explicitly deployed as routers, VPN concentrators, or remote-access gateways (and reachable from the attacker's network path) are at risk, which is consistent with the low EPSS score of 0.89% (57th percentile). Exploitation status at the time of analysis is "no public exploit identified at time of analysis" per CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total), and Microsoft has released vendor patches, making prompt patching of any internet- or WAN-exposed RRAS deployment the priority action.
Remote code execution in Microsoft's Routing and Remote Access Service (RRAS) lets a network-positioned attacker with no credentials (PR:N) and no user interaction (UI:N) execute code with high impact to confidentiality, integrity and availability on affected Windows hosts by triggering a use-after-free (CWE-416) in the service. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 including Server Core installations, but the flaw is only reachable where an administrator has installed and enabled the RRAS role - it is not enabled by default, concentrating real exposure on routing, RAS/dial-up and VPN servers that are network-reachable. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' (and non-automatable), and EPSS is low at 0.42% (36th percentile); the High attack complexity (AC:H) reflects the race-condition/heap-grooming reliability problem typical of use-after-free bugs.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Out-of-bounds memory corruption in Tapdisk, the XAPI toolstack's userspace xen-blkback implementation, allows a malicious guest VM to achieve code execution inside the tapdisk process, which normally runs as root in dom0. CVE-2026-79606 specifically concerns the gcopy_segs[] array: the bounds check incorrectly permits nr_segments values between 12 and 32, causing out-of-bounds writes that corrupt adjacent process memory. All versions of tapdisk are confirmed vulnerable, no mitigations exist, and patches are available via XSA-513.
Out-of-bounds memory corruption in Xen's Tapdisk (userspace xen-blkback) enables a malicious guest VM to achieve code execution within the tapdisk process, which runs as root in Dom0, constituting a full guest-to-host escape. CVE-2026-79605 specifically covers the absent upper bounds check on blkif->last_sect: guest-supplied values greater than 7 trigger reads or writes beyond the mapped grant region. All versions of tapdisk are confirmed vulnerable per XSA-513, no mitigations exist, and patch application is the sole remediation path. No public exploit or CISA KEV listing is identified at time of analysis.
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on hosts running Nutch versions 1.11 through 1.22. The vulnerability chains missing authorization controls with unsafe reflection and dynamic code execution in the Nutch REST API, enabling full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor's definitive fix in version 1.23 removes the Nutch Server component entirely.
Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.
Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.
Authenticated remote code execution in Ivanti Neurons for ITSM (all versions before the 2026.2 patch) lets any holder of a valid low-privilege account invoke a server-side function that performs no authorization check, yielding total loss of confidentiality, integrity, and availability on the ITSM server. Exploitation requires credentials and network reachability to the application (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), so this is not a pre-authentication flaw; CISA's SSVC assessment rates exploitation as none and automatability as no, meaning targeted rather than mass abuse, and no public exploit code or confirmed active exploitation (KEV) has been identified at time of analysis. EPSS is 1.19% (66th percentile), a moderate score consistent with a high-impact but credential-gated issue that is not currently an emergency, though the impact per successful exploitation is severe.
Missing authorization in Ivanti Neurons for ITSM allows an authenticated attacker holding any valid account on the instance to reach server-side functionality they should not access, ultimately achieving arbitrary code execution on the host (CWE-862, CVSS 8.8). Only deployments running versions prior to 2026.2 are affected, and the flaw cannot be triggered without first obtaining valid credentials, since the CVSS vector is PR:L (low-privileged, authenticated) with no user interaction required. Exploitation is rated as not automatable by SSVC, EPSS remains low at 1.19% (66th percentile), and no public exploit was identified at time of analysis, so this is a high-priority patching item rather than an emergency.
Remote code execution in Ivanti Neurons for ITSM before 2026.2 allows an authenticated attacker holding only a low-privilege account to invoke server-side functionality that lacks a proper authorization check and use it to run arbitrary code on the underlying server. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, the attacker needs a valid credential but nothing more - no user interaction, no administrative role, and the vulnerable path is reachable over the network. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, with the exploit rated non-automatable because it cannot be triggered pre-authentication against default configurations; EPSS is modest at roughly 1.2% (67th percentile), but CISA SSVC grades the technical impact as total, so the combination of an easy-to-reach authenticated path and full confidentiality, integrity and availability loss makes this a high-priority item for any organization running the affected versions.
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention.
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch.
Arbitrary code execution in AMI APTIOV BIOS firmware is achievable by a locally-present privileged user exploiting an incomplete input blocklist (CWE-184) in the BIOS implementation. The flaw affects systems running AMI's APTIOV UEFI/BIOS platform - licensed to a wide range of OEM server and workstation vendors - and successful exploitation compromises confidentiality, integrity, and availability at both the firmware and OS layers, with cascading impact on the entire system stack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators holding style-import permissions to write arbitrary files outside the intended extraction directory. By crafting a ZIP archive with backslash-delimited member names, an attacker bypasses the forward-slash-only traversal validation enforced on Linux/macOS, writing arbitrary bytes to any path writable by the web-server account - including the public web root - resulting in persistent server-side code execution. The flaw is fixed in XenForo 2.3.13; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in fastify-cli 1.5.0 through 8.0.0 when the Node.js Inspector is activated via a debug flag: the CLI ignores the user-supplied bind address and instead binds the Inspector to an overly broad network interface, exposing it beyond the local loopback. Because the Node.js Inspector protocol (Chrome DevTools Protocol) permits unrestricted JavaScript evaluation, any remote party that can reach the exposed Inspector port gains full code execution on the developer's machine with no authentication required. No public exploit code has been identified at time of analysis, and the EPSS signal is not provided, but the Inspector protocol itself is well-understood and trivially exploitable once the port is reachable.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote code execution in mpush v0.8.1 lets attackers run arbitrary code on the gateway server by sending a crafted broadcast message that is unsafely processed (CWE-94 code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with full confidentiality, integrity, and availability impact. Publicly available exploit documentation exists (GitHub write-up), though EPSS is low (0.17%, 6th percentile) and the flaw is not in CISA KEV.
Missing authorization on the MarketplaceModuleBrowser installModule Livewire action in Lara Dashboard before 1.3.2 permits any authenticated non-Superadmin administrator to install arbitrary PHP modules from the marketplace. Because module downloads occur over unsigned HTTP without integrity verification, an attacker holding an administrator credential can pull and auto-activate attacker-chosen PHP code, achieving remote code execution on the underlying server. The fix is available in v1.3.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Host-level code execution in JetBrains IntelliJ IDEA before 2026.2.2 is triggered when a developer opens a malicious project containing a crafted Dev Container configuration, which the IDE proceeds to build without first requesting the standard project-trust confirmation. The flaw (CWE-829) allows untrusted, project-defined container build scripts and Docker commands to execute directly on the developer's host machine, bypassing the IDE's safety gate. JetBrains confirmed the issue and released a fix in version 2026.2.2; no public exploit has been identified at time of analysis.
Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to the IJent gRPC server running without TLS encryption or any authentication mechanism. The IJent agent, deployed on remote hosts when the Remote Development feature is in use, accepts connections from any local process without requiring credentials, enabling arbitrary command execution under the agent's security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach protected endpoints by submitting a small integer (0-9) in place of a string API token, abusing MySQL loose type coercion so the integer matches a stored token hash. Successful bypass exposes device credentials and administrative functionality, and can be chained to remote code execution through alert templates. Reported by VulnCheck; no public exploit is identified at time of analysis, though the type-confusion technique is fully described in the advisory.
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00) lets a remote, unauthenticated attacker run commands on the target by sending a specially crafted request that bypasses intended authorization checks. Dell has released fixed versions and the flaw is rated critical (CVSS 9.4). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation and arbitrary code execution in PostgreSQL Anonymizer (by Dalibo) allow authenticated masked users to break out of their restricted data-access context by embedding malicious expressions inside operators, domain casts, or view subqueries. When the extension's masking engine evaluates these objects during data anonymization, the embedded code runs with the elevated privileges of the extension owner or superuser, granting full database compromise from a nominally low-privilege account. No public exploit or KEV listing is recorded at time of analysis, but the CVSS score of 8.8 and the availability of a confirmed patch version make this a high-priority upgrade for any deployment relying on PostgreSQL Anonymizer for compliance or access control.
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.
Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. No public exploit has been identified at time of analysis, and it is not yet listed in CISA KEV, but the pre-auth, network-reachable nature warrants emergency patching.
Authentication bypass in Lara Dashboard before 1.3.0 lets unauthenticated attackers log in as any registered user by requesting GET /screenshot-login/{email}, provided the deployment runs with APP_ENV set to anything other than production. The route was a demo-screenshot helper (used by an internal Browsershot command with superadmin@example.com) that was reachable in non-production environments, granting a fully authenticated session that reaches user administration, settings, database contents, and arbitrary code execution via the module installer. Reported by VulnCheck with a vendor patch available (v1.3.0); no public exploit identified at time of analysis, though the trivial GET-based technique is effectively self-documenting.
Remote code execution in Axolotl through 0.18.0 allows an attacker who controls a Hugging Face model repository to execute arbitrary Python code on any machine running an Axolotl training job with multipack patches enabled. The root cause is a logic flaw in `_apply_multipack_patches()`: when a user has not explicitly set `trust_remote_code` in their YAML config (leaving it as Python `None`), the guard condition `self.cfg.trust_remote_code is not None` evaluates to `False`, skipping the override assignment and leaving `has_remote_code=True` from the model's own metadata claim. Downstream code in `multipack.py` then calls `AutoModelForCausalLM.from_pretrained` with `trust_remote_code=True` hardcoded, executing whatever Python the model repository supplies. No public exploit is identified at time of analysis, but the attack surface is broad for teams running automated fine-tuning pipelines that source models from HuggingFace without explicit config hardening.
Unauthenticated remote code execution in HKUDS AutoAgent's sandbox environment allows any network-reachable attacker to run arbitrary bash commands as root. The framework's TCP command server binds to all interfaces (0.0.0.0) and executes received commands with no authentication, so attackers who reach the port gain root inside the agent container and can read or tamper with bind-mounted host workspace directories. Reported by VulnCheck with a public advisory; no public exploit code or active exploitation is confirmed at time of analysis.
PHP Object Injection in the Welcart e-Commerce WordPress plugin (all versions ≤ 2.12.1) enables unauthenticated attackers to inject a serialized POP-chain payload as order metadata during a public checkout, then trigger deserialization through the unprotected Telecom EDY payment callback. Exploitation via a bundled TCPDF POP chain can delete arbitrary server files - including wp-config.php - and culminates in full remote code execution when the attacker re-runs the WordPress installer against an attacker-controlled database. Successful file deletion requires an administrator to print an order invoice, captured by UI:R in the CVSS vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. There is no public exploit identified at time of analysis and no KEV listing.
Remote code execution in Nango before 0.71.6 allows unauthenticated attackers to run arbitrary JavaScript inside the runner process by invoking the runner tRPC server's exposed 'start' procedure. The runner fails to enforce the RUNNER_SECRET_KEY environment variable, so any actor with network reach to the runner port can trigger code execution. Reported by VulnCheck; a vendor patch is available (v0.71.6) and publicly available exploit code exists via the VulnCheck advisory, though it is not listed in CISA KEV.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. No public exploit has been identified at time of analysis; Linux and Windows hosts are explicitly unaffected.
Type confusion (CWE-843) in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Multiple product lines are affected, including Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383. No public exploit or CISA KEV listing has been identified at time of analysis, but the ubiquity of Acrobat Reader and routine delivery of PDFs via phishing make this a realistic and high-priority patching target.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.
Double Free memory corruption in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the victim user when a malicious PDF or document file is opened. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. Adobe PSIRT has published advisory APSB26-141 confirming the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer overflow in Adobe Photoshop Desktop enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. Both the Photoshop 2026 (≤27.6) and Photoshop 2025 (≤26.11.6) release lines are affected. No public exploit code or active exploitation has been identified at time of analysis, but the file-open attack surface is a historically well-worn delivery mechanism for creative-software exploits.
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. Affected versions span both the Photoshop 2025 line (≤26.11.6) and Photoshop 2026 line (≤27.6), covering a broad install base of creative and enterprise users. No public exploit has been identified at time of analysis, though the file-based delivery mechanism makes phishing or watering-hole distribution a natural attack path.
Out-of-bounds write in Adobe Photoshop Desktop allows arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted malicious file. Affected versions span both the Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6) release lines. Adobe's PSIRT has released advisory APSB26-130 addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side code execution in CMSimple 5.22's CoAuthors plugin enables an authenticated low-privileged user who can edit page content to achieve full remote code execution by passing crafted external or uploaded text through the plugin's content import feature. The vulnerability is rooted in CWE-94 (improper code generation control), where imported content is processed server-side without sufficient sanitization, allowing arbitrary PHP or server-side logic to execute in the web server context. Publicly available exploit code exists via a GitHub gist and associated issue tracker, though EPSS stands at 0.17%, reflecting limited observed exploitation at this time.
Code execution with the privileges of the management console is possible in Okta Access Gateway releases before 2026.9.1, where the console's exception-handling path passes user-supplied input to eval() without sanitization. Reaching that path requires an already-authenticated administrator SSH session (CVSS vector PR:H), so this is a privilege-boundary break that lets a trusted console operator escalate from constrained administrative commands to arbitrary code execution rather than an anonymous network entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation and no automatable attack path, and EPSS is a low 0.36% (29th percentile), so real-world priority is low despite the high confidentiality, integrity and availability impact scored in the CVSS 7.2 assessment.
Authenticated administrative users of Okta Access Gateway can achieve arbitrary command execution on the underlying gateway host by storing crafted values in an application's label field, which the product interpolates without sanitization into generated nginx server block configuration. The flaw affects Okta Access Gateway versions prior to 2026.9.1 (CPE cpe:2.3:a:okta:access_gateway), scores CVSS 3.1 base 7.2 (High) with total confidentiality, integrity, and availability impact under vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and requires high-privilege (PR:H) access to the management console to seed the malicious label - no user interaction is needed, and the injected directives take effect when the gateway regenerates and reloads its nginx configuration. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.36% (29th percentile), so this is best characterized as an admin-to-host privilege-abuse vector rather than a remotely exploitable unauthenticated issue.
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution when a victim opens a maliciously crafted file. The vulnerability affects Photoshop 2026 versions up to and including 27.6 and Photoshop 2025 versions up to and including 26.11.6, with scope change indicating code execution can escape the Photoshop process boundary. No public exploit identified at time of analysis; Adobe has released patches via APSB26-130.
Eval injection (CWE-95) in Adobe ColdFusion 2023 (≤Update 23) and ColdFusion 2025 (≤Update 12) enables unauthenticated, network-based arbitrary code execution without user interaction. User-supplied input reaching a dynamic code evaluation function is processed without sanitization, allowing injected CFML or Java expressions to execute server-side as the application user. The CVSS scope-change metric (S:C) indicates the impact can extend beyond the ColdFusion process itself; Adobe PSIRT issued formal advisory APSB26-119. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Adobe ColdFusion 2025 (≤update 12) and 2023 (≤update 23) allows a low-privileged attacker with adjacent network access to execute arbitrary code in the context of the victim user by delivering a malicious file for the target to open. The vulnerable component is confined to the administrative network zone by default, and the attack requires scope change - meaning successful exploitation can extend impact beyond the ColdFusion process itself. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. No public exploit identified at time of analysis, but the low attack complexity and full CIA impact across affected versions represent a meaningful and realistic risk.
Arbitrary code execution in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) is achievable when a victim opens a specially crafted malicious file, exploiting improper input validation (CWE-20) in the file-parsing subsystem. The CVSS scope-change indicator (S:C) signals that successful exploitation can affect resources beyond the Illustrator process boundary - i.e., impacts propagate to the broader user session or OS context. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis, though the file-delivery vector makes this a realistic phishing-grade threat against creative and design professionals.
Arbitrary code execution in Adobe Illustrator Desktop 2025 and 2026 is possible when a victim opens a specially crafted malicious file, exploiting an Incorrect Authorization flaw (CWE-863) that allows attacker-controlled file content to bypass authorization checks and trigger code execution in the current user's context. The changed-scope designation in the CVSS vector (S:C with C:H/I:H/A:H) indicates the impact extends beyond the Illustrator process itself, consistent with a sandbox or privilege boundary escape. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at this time, though SSVC also rates technical impact as 'total', meaning successful exploitation is fully compromising.
Integer overflow in Adobe Photoshop Desktop's file-parsing logic allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Affected versions span both Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6), covering a broad installed base of creative and enterprise users. No public exploit code or active exploitation has been identified at time of analysis; Adobe has published a fix under advisory APSB26-130.
Integer overflow in Adobe Photoshop Desktop (versions 2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the authenticated user. The flaw is triggered during parsing of a specially crafted file - a social-engineering delivery step is required, as the victim must open the malicious file. Adobe has issued advisory APSB26-130 addressing both affected release lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer overflow in Adobe Photoshop Desktop (2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. The attack vector is local (AV:L) with mandatory user interaction (UI:R), making social engineering - phishing with a weaponized design file - the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad and Adobe PSIRT attribution confirm this is a serious file-parsing flaw covered under advisory APSB26-130.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) is possible through an SQL injection flaw (CWE-89) that a high-privileged authenticated attacker can escalate into code execution in the context of the current user. The CVSS vector marks the scope as changed, reflecting that database-layer injection pivots into broader application/OS impact. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds write in Adobe Photoshop Desktop enables arbitrary code execution in the context of the victim's user account when a malicious file is opened. Both the 2025 branch (through version 26.11.6) and the 2026 branch (through version 27.6) are confirmed affected per Adobe's EUVD entry and APSB26-130 advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open trigger and high CVSS C/I/A ratings make this a credible phishing-delivery vector in creative and design environments.
Remote code execution in Adobe ColdFusion 2023 (update ≤23) and ColdFusion 2025 (update ≤12) allows a low-privileged, authenticated attacker to inject directives into dynamically evaluated code (CWE-95, 'Eval Injection') and execute arbitrary code in the context of the current user without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable, low-complexity flaw with a scope change, meaning code executes beyond the initially authorized security context. No public exploit is identified at time of analysis, but ColdFusion RCE flaws are historically high-value targets and are frequently weaponized quickly after disclosure.
Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Adobe (PSIRT) rated it 9.9 critical and shipped a fix in APSB26-98; no public exploit is identified at time of analysis.
Stack-based buffer overflow in the TP-Link RE210 AC750 range extender's httpd component enables authenticated, adjacent-network attackers to achieve remote code execution by uploading a specially crafted configuration file that exceeds bounds in the `splitString` function. Affected firmware spans US builds through 3.14.2 Build 171205 Rel.71984n and EU builds through 3.14.2 Build 141218 Rel.36430n, per EUVD-2026-73942. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact triplet (C:H/I:H/A:H) indicates full device compromise upon successful exploitation.
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to execute arbitrary code in the context of the running user with no user interaction. Adobe PSIRT rates this a maximum-severity CVSS 10.0 issue with a changed scope, meaning a successful exploit can affect resources beyond the vulnerable component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in MLflow (all versions ≥ 0.0.1) is achievable through a maliciously crafted model artifact that exploits the platform's model-loading pipeline, triggering code execution on the end user's system when the artifact is deserialized. An attacker with the ability to publish or distribute a poisoned model to a shared registry can fully compromise any data scientist or ML engineer who loads it, gaining complete control over their workstation or compute environment. No public exploit has been identified at time of analysis, but SSVC rates technical impact as total; the HiddenLayer SAI advisory (2026-09) covers this class of ML supply-chain attack.
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Out-of-bounds write in Android's NFC RoutingManager (checkUikcListenConfigNeeded in RoutingManager.cpp) enables remote code execution from adjacent NFC proximity on Android 16-QPR2 and Android 17 without requiring user interaction. The missing bounds check in UICC listen configuration handling allows a proximal attacker to corrupt memory in the NFC daemon, leading to full code execution in that process context. No public exploit has been identified at time of analysis; SSVC rates technical impact as total but exploitation status as none.
Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.
Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.
Remote code execution is achievable in Android's NFC subsystem across Android 14 through 17, including Android 16-QPR2, via a heap buffer overflow in the MIFARE Classic tag reader function rw_mfc_handle_read_op() within rw_mfc.cc. An attacker within NFC proximity can present a crafted MIFARE Classic tag that overflows a heap-allocated buffer in the NFC daemon, yielding full device control with no victim interaction required and no privileges needed on the target. No public exploit has been identified at time of analysis, though the SSVC framework rates the technical impact as total given the unauthenticated RCE capability.
Local privilege escalation in Android 17's telephony stack allows a low-privileged app to achieve arbitrary code execution without user interaction. The logic error in the serviceClassExists method of InCallController.java (CWE-693, Protection Mechanism Failure) enables an attacker with local shell or app access to elevate privileges to those of the telecom service process, gaining full read, write, and execution control. No public exploit exists at time of analysis, and SSVC assesses exploitation as none, though the technical impact is rated total.
Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.
Heap buffer overflow in Android's Wi-Fi P2P (Wi-Fi Direct) provision discovery handler enables proximal unauthenticated attackers to achieve remote code execution on affected devices without requiring user interaction. The flaw resides in `p2p_process_prov_disc_bootstrap_req()` within `p2p_pd.c`, where a malformed provision discovery bootstrap request triggers an out-of-bounds write on the heap. Android 16, Android 16-QPR2, and Android 17 are confirmed affected per the September 2026 Android Security Bulletin; no public exploit code exists and EPSS at 0.13% (3rd percentile) reflects minimal current exploitation activity.
Heap buffer overflow in Android's OAPV video codec decoder (oapv.c) enables remote code execution on Android 16 and 17 without requiring user interaction. The flaw resides in dec_frm_prepare(), where insufficient bounds checking during frame decoding preparation allows an attacker to overwrite heap memory via crafted video content. EPSS sits at 0.18% (8th percentile) with SSVC exploitation status rated 'none', but technical impact is classified as 'total' and no public exploit has been identified at time of analysis.
Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. No public exploit has been identified at time of analysis, and EPSS stands at 0.15%, though the zero-interaction requirement and full-impact CVSS 8.8 rating warrant prompt patching.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Code injection in Microsoft Remote Desktop Client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) enables an unauthenticated network attacker to execute arbitrary code on the connecting client machine. The vulnerability is triggered when a user connects to an attacker-controlled RDP server that delivers malicious server-side responses exploiting CWE-94 code generation flaws in the client. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Microsoft Dynamics 365 Customer Engagement V9.1 (versions below 9.1.0048.0004) is achievable by authenticated network attackers through a code injection vulnerability (CWE-94). An attacker holding a low-privilege account can submit a crafted request that causes the server to generate and execute attacker-controlled code, resulting in full confidentiality, integrity, and availability compromise of the affected instance. Microsoft has released a patch via the MSRC update guide, and no public exploit code has been identified at time of analysis.
Code injection in Adobe Animate allows a low-privileged attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. Both the 2023 and 2024 major release lines are affected, covering all versions up to and including 23.0.16 and 24.0.14 respectively. SSVC assessment indicates no current exploitation activity, but the technical impact is rated total due to full C/I/A compromise and a scope change beyond the vulnerable component.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network-positioned attacker to execute arbitrary code with system privileges on affected Windows hosts by sending crafted requests to the RRAS service, a consequence of a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The exposure is conditioned on the host actually running the RRAS role: RRAS is not installed or enabled in default Windows and Windows Server configurations, so only machines explicitly deployed as routers, VPN concentrators, or remote-access gateways (and reachable from the attacker's network path) are at risk, which is consistent with the low EPSS score of 0.89% (57th percentile). Exploitation status at the time of analysis is "no public exploit identified at time of analysis" per CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total), and Microsoft has released vendor patches, making prompt patching of any internet- or WAN-exposed RRAS deployment the priority action.
Remote code execution in Microsoft's Routing and Remote Access Service (RRAS) lets a network-positioned attacker with no credentials (PR:N) and no user interaction (UI:N) execute code with high impact to confidentiality, integrity and availability on affected Windows hosts by triggering a use-after-free (CWE-416) in the service. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 including Server Core installations, but the flaw is only reachable where an administrator has installed and enabled the RRAS role - it is not enabled by default, concentrating real exposure on routing, RAS/dial-up and VPN servers that are network-reachable. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' (and non-automatable), and EPSS is low at 0.42% (36th percentile); the High attack complexity (AC:H) reflects the race-condition/heap-grooming reliability problem typical of use-after-free bugs.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Out-of-bounds memory corruption in Tapdisk, the XAPI toolstack's userspace xen-blkback implementation, allows a malicious guest VM to achieve code execution inside the tapdisk process, which normally runs as root in dom0. CVE-2026-79606 specifically concerns the gcopy_segs[] array: the bounds check incorrectly permits nr_segments values between 12 and 32, causing out-of-bounds writes that corrupt adjacent process memory. All versions of tapdisk are confirmed vulnerable, no mitigations exist, and patches are available via XSA-513.
Out-of-bounds memory corruption in Xen's Tapdisk (userspace xen-blkback) enables a malicious guest VM to achieve code execution within the tapdisk process, which runs as root in Dom0, constituting a full guest-to-host escape. CVE-2026-79605 specifically covers the absent upper bounds check on blkif->last_sect: guest-supplied values greater than 7 trigger reads or writes beyond the mapped grant region. All versions of tapdisk are confirmed vulnerable per XSA-513, no mitigations exist, and patch application is the sole remediation path. No public exploit or CISA KEV listing is identified at time of analysis.
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on hosts running Nutch versions 1.11 through 1.22. The vulnerability chains missing authorization controls with unsafe reflection and dynamic code execution in the Nutch REST API, enabling full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor's definitive fix in version 1.23 removes the Nutch Server component entirely.
Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.
Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.
Authenticated remote code execution in Ivanti Neurons for ITSM (all versions before the 2026.2 patch) lets any holder of a valid low-privilege account invoke a server-side function that performs no authorization check, yielding total loss of confidentiality, integrity, and availability on the ITSM server. Exploitation requires credentials and network reachability to the application (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), so this is not a pre-authentication flaw; CISA's SSVC assessment rates exploitation as none and automatability as no, meaning targeted rather than mass abuse, and no public exploit code or confirmed active exploitation (KEV) has been identified at time of analysis. EPSS is 1.19% (66th percentile), a moderate score consistent with a high-impact but credential-gated issue that is not currently an emergency, though the impact per successful exploitation is severe.
Missing authorization in Ivanti Neurons for ITSM allows an authenticated attacker holding any valid account on the instance to reach server-side functionality they should not access, ultimately achieving arbitrary code execution on the host (CWE-862, CVSS 8.8). Only deployments running versions prior to 2026.2 are affected, and the flaw cannot be triggered without first obtaining valid credentials, since the CVSS vector is PR:L (low-privileged, authenticated) with no user interaction required. Exploitation is rated as not automatable by SSVC, EPSS remains low at 1.19% (66th percentile), and no public exploit was identified at time of analysis, so this is a high-priority patching item rather than an emergency.
Remote code execution in Ivanti Neurons for ITSM before 2026.2 allows an authenticated attacker holding only a low-privilege account to invoke server-side functionality that lacks a proper authorization check and use it to run arbitrary code on the underlying server. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, the attacker needs a valid credential but nothing more - no user interaction, no administrative role, and the vulnerable path is reachable over the network. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, with the exploit rated non-automatable because it cannot be triggered pre-authentication against default configurations; EPSS is modest at roughly 1.2% (67th percentile), but CISA SSVC grades the technical impact as total, so the combination of an easy-to-reach authenticated path and full confidentiality, integrity and availability loss makes this a high-priority item for any organization running the affected versions.
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention.
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch.
Arbitrary code execution in AMI APTIOV BIOS firmware is achievable by a locally-present privileged user exploiting an incomplete input blocklist (CWE-184) in the BIOS implementation. The flaw affects systems running AMI's APTIOV UEFI/BIOS platform - licensed to a wide range of OEM server and workstation vendors - and successful exploitation compromises confidentiality, integrity, and availability at both the firmware and OS layers, with cascading impact on the entire system stack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators holding style-import permissions to write arbitrary files outside the intended extraction directory. By crafting a ZIP archive with backslash-delimited member names, an attacker bypasses the forward-slash-only traversal validation enforced on Linux/macOS, writing arbitrary bytes to any path writable by the web-server account - including the public web root - resulting in persistent server-side code execution. The flaw is fixed in XenForo 2.3.13; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in fastify-cli 1.5.0 through 8.0.0 when the Node.js Inspector is activated via a debug flag: the CLI ignores the user-supplied bind address and instead binds the Inspector to an overly broad network interface, exposing it beyond the local loopback. Because the Node.js Inspector protocol (Chrome DevTools Protocol) permits unrestricted JavaScript evaluation, any remote party that can reach the exposed Inspector port gains full code execution on the developer's machine with no authentication required. No public exploit code has been identified at time of analysis, and the EPSS signal is not provided, but the Inspector protocol itself is well-understood and trivially exploitable once the port is reachable.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote code execution in mpush v0.8.1 lets attackers run arbitrary code on the gateway server by sending a crafted broadcast message that is unsafely processed (CWE-94 code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with full confidentiality, integrity, and availability impact. Publicly available exploit documentation exists (GitHub write-up), though EPSS is low (0.17%, 6th percentile) and the flaw is not in CISA KEV.
Missing authorization on the MarketplaceModuleBrowser installModule Livewire action in Lara Dashboard before 1.3.2 permits any authenticated non-Superadmin administrator to install arbitrary PHP modules from the marketplace. Because module downloads occur over unsigned HTTP without integrity verification, an attacker holding an administrator credential can pull and auto-activate attacker-chosen PHP code, achieving remote code execution on the underlying server. The fix is available in v1.3.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Host-level code execution in JetBrains IntelliJ IDEA before 2026.2.2 is triggered when a developer opens a malicious project containing a crafted Dev Container configuration, which the IDE proceeds to build without first requesting the standard project-trust confirmation. The flaw (CWE-829) allows untrusted, project-defined container build scripts and Docker commands to execute directly on the developer's host machine, bypassing the IDE's safety gate. JetBrains confirmed the issue and released a fix in version 2026.2.2; no public exploit has been identified at time of analysis.
Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to the IJent gRPC server running without TLS encryption or any authentication mechanism. The IJent agent, deployed on remote hosts when the Remote Development feature is in use, accepts connections from any local process without requiring credentials, enabling arbitrary command execution under the agent's security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach protected endpoints by submitting a small integer (0-9) in place of a string API token, abusing MySQL loose type coercion so the integer matches a stored token hash. Successful bypass exposes device credentials and administrative functionality, and can be chained to remote code execution through alert templates. Reported by VulnCheck; no public exploit is identified at time of analysis, though the type-confusion technique is fully described in the advisory.
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00) lets a remote, unauthenticated attacker run commands on the target by sending a specially crafted request that bypasses intended authorization checks. Dell has released fixed versions and the flaw is rated critical (CVSS 9.4). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation and arbitrary code execution in PostgreSQL Anonymizer (by Dalibo) allow authenticated masked users to break out of their restricted data-access context by embedding malicious expressions inside operators, domain casts, or view subqueries. When the extension's masking engine evaluates these objects during data anonymization, the embedded code runs with the elevated privileges of the extension owner or superuser, granting full database compromise from a nominally low-privilege account. No public exploit or KEV listing is recorded at time of analysis, but the CVSS score of 8.8 and the availability of a confirmed patch version make this a high-priority upgrade for any deployment relying on PostgreSQL Anonymizer for compliance or access control.
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.
Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. No public exploit has been identified at time of analysis, and it is not yet listed in CISA KEV, but the pre-auth, network-reachable nature warrants emergency patching.
Authentication bypass in Lara Dashboard before 1.3.0 lets unauthenticated attackers log in as any registered user by requesting GET /screenshot-login/{email}, provided the deployment runs with APP_ENV set to anything other than production. The route was a demo-screenshot helper (used by an internal Browsershot command with superadmin@example.com) that was reachable in non-production environments, granting a fully authenticated session that reaches user administration, settings, database contents, and arbitrary code execution via the module installer. Reported by VulnCheck with a vendor patch available (v1.3.0); no public exploit identified at time of analysis, though the trivial GET-based technique is effectively self-documenting.
Remote code execution in Axolotl through 0.18.0 allows an attacker who controls a Hugging Face model repository to execute arbitrary Python code on any machine running an Axolotl training job with multipack patches enabled. The root cause is a logic flaw in `_apply_multipack_patches()`: when a user has not explicitly set `trust_remote_code` in their YAML config (leaving it as Python `None`), the guard condition `self.cfg.trust_remote_code is not None` evaluates to `False`, skipping the override assignment and leaving `has_remote_code=True` from the model's own metadata claim. Downstream code in `multipack.py` then calls `AutoModelForCausalLM.from_pretrained` with `trust_remote_code=True` hardcoded, executing whatever Python the model repository supplies. No public exploit is identified at time of analysis, but the attack surface is broad for teams running automated fine-tuning pipelines that source models from HuggingFace without explicit config hardening.
Unauthenticated remote code execution in HKUDS AutoAgent's sandbox environment allows any network-reachable attacker to run arbitrary bash commands as root. The framework's TCP command server binds to all interfaces (0.0.0.0) and executes received commands with no authentication, so attackers who reach the port gain root inside the agent container and can read or tamper with bind-mounted host workspace directories. Reported by VulnCheck with a public advisory; no public exploit code or active exploitation is confirmed at time of analysis.
PHP Object Injection in the Welcart e-Commerce WordPress plugin (all versions ≤ 2.12.1) enables unauthenticated attackers to inject a serialized POP-chain payload as order metadata during a public checkout, then trigger deserialization through the unprotected Telecom EDY payment callback. Exploitation via a bundled TCPDF POP chain can delete arbitrary server files - including wp-config.php - and culminates in full remote code execution when the attacker re-runs the WordPress installer against an attacker-controlled database. Successful file deletion requires an administrator to print an order invoice, captured by UI:R in the CVSS vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Hummingbird performance/caching plugin for WordPress (versions up to and including 3.21.0) lets unauthenticated attackers write arbitrary PHP into a web-accessible debug-log file and execute it with a single anonymous request. The plugin's protective '<?php die(); ?>' header is silently dropped due to a PHP namespace bug in a class_exists() check, and unsanitized cookie names are written straight into wp-content/wphb-logs/page-caching-log.php. Reported by Wordfence with no public exploit identified at time of analysis; exploitation depends on a non-default Debug Log configuration.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. There is no public exploit identified at time of analysis and no KEV listing.
Remote code execution in Nango before 0.71.6 allows unauthenticated attackers to run arbitrary JavaScript inside the runner process by invoking the runner tRPC server's exposed 'start' procedure. The runner fails to enforce the RUNNER_SECRET_KEY environment variable, so any actor with network reach to the runner port can trigger code execution. Reported by VulnCheck; a vendor patch is available (v0.71.6) and publicly available exploit code exists via the VulnCheck advisory, though it is not listed in CISA KEV.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.