RCE
Monthly
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
Unauthenticated remote code execution in Voltronic Power SNMP Web Pro 1.1 lets remote attackers gain root on the device by POSTing a crafted tar archive to the upload.cgi firmware-update endpoint. Because the archive is extracted into a privileged directory and its contents executed as root without any credential check, a single request yields full system compromise. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC); this is not yet listed in CISA KEV.
Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Remote code execution in LaVague 0.2.35, an LLM-driven web-automation agent framework, arises because PythonFromMarkdownExtractor.extract_as_object evaluates language-model output that is derived from attacker-influenced web page content. An attacker who controls or poisons a page the agent visits can use indirect prompt injection to coerce the model into emitting Python that is then eval'd and executed on the operator's host with no human review. Reported by VulnCheck (CWE-94); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in Plandex 2.2.1's ApplyFiles function allows an attacker who can influence the AI model's output - through poisoned repository files or attacker-controlled context - to write files to arbitrary locations outside the intended project directory. Targets such as shell initialization files (~/.bashrc, ~/.zshrc) and cron entries can be silently overwritten, resulting in persistent code execution under the developer's local account. No CISA KEV entry or confirmed public exploit exists at time of analysis, but the attack surface (indirect prompt injection combined with insecure file-write) is increasingly well-understood in the AI tooling threat landscape.
Unauthenticated arbitrary file read and write in TEN Framework 0.11.71 lets remote attackers hit the TMAN Designer file-content API (POST/PUT to /api/designer/v1/file-content) with no credentials, reading any file the service can access and writing attacker-controlled content to arbitrary system paths. Because the write primitive can drop SSH authorized_keys, cron jobs, or executable graph files, it escalates directly to remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted git repository containing a malicious `.aider.conf.yml` configuration file. The tool unconditionally reads this file at startup and passes `test-cmd` and `lint-cmd` values directly to Python's `subprocess` with `shell=True`, with no user confirmation, no LLM involvement, and no API key required. Confirmed present on version 0.86.2 and the 0.86.3.dev main branch per the VulnCheck advisory; no vendor-released patch has been identified at time of analysis, and no public exploit code has been identified beyond the mechanism documented in the public GitHub issue.
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.
Arbitrary command execution in goose v1.37.0 allows an attacker to embed shell commands inside recipe stdio extension definitions and retry.check fields that are silently executed under the victim user's OS privileges. The built-in recipe security scanner does not inspect these fields, providing a false safety guarantee and a clear bypass path. No public exploit is identified at time of analysis, but exploitation is low-complexity once a target user loads a malicious recipe.
Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Remote code execution and full site takeover affect the AI Website Builder WordPress plugin (GitHub build 1.0.0), whose REST API routes perform no authorisation or nonce validation. Unauthenticated attackers can install and activate arbitrary plugins and themes, import content from a URL they control, write an arbitrary file into wp-content/uploads, and delete site content and media - any of the code-installation paths yields RCE, and the arbitrary uploads file write is directly RCE on hosts that serve PHP from the uploads directory. No public exploit identified at time of analysis, but the trivial unauthenticated network attack surface (CVSS 9.8) makes this a critical-priority issue for any site running the affected build.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV.
Path traversal in Plesk web hosting control panel (versions ≤18.0.79.9 and 18.0.80-18.0.80.5) enables local users with low privileges to execute arbitrary code as the root user, resulting in full system compromise. The CVSS 4.0 score of 8.5 reflects high CIA impact with no special attack requirements beyond local OS access (AV:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the privilege escalation to root in a widely deployed hosting platform makes this a high-priority patch for server operators, particularly those running multi-tenant shared hosting environments.
Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.
Remote code execution in easyadmin v2.0.2.2 lets attackers with access to the background management interface upload a crafted file of a dangerous type (e.g. a PHP webshell) and execute arbitrary code, gaining server-level privileges. The flaw is a classic unrestricted file upload (CWE-434) in an admin-only feature; the description specifies authenticated access despite the provided CVSS vector marking it as requiring no privileges. EPSS is low (0.24%, 15th percentile) and there is no evidence of active exploitation, though a researcher issue writeup is referenced.
Remote code execution in esoTalk v1.0.0g4 arises from configuration comment injection that allows attacker-controlled input reaching ETMemberModel, ETMemberController and ET.class.php to be persisted into a PHP configuration file and subsequently interpreted as code (CWE-94). Documented only in a third-party Notion writeup with no public exploit tool; EPSS is low at 0.19% (9th percentile). No public exploit identified at time of analysis and the CVE is not in CISA KEV.
Unrestricted file upload in AppNitro MachForm v30 permits unauthenticated remote attackers to achieve code execution by uploading a crafted .phar (PHP Archive) file through the application's file upload functionality. Because the application fails to block .phar extensions alongside conventional dangerous types like .php, an attacker can cause the PHP runtime to execute attacker-supplied code upon accessing the uploaded file. A public proof-of-concept is available on GitHub and a write-up is hosted on PacketStorm Security, raising practical exploitability above the low EPSS score would suggest.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Command injection in MBS-Solutions X-Serie Gateway firmware V6_00_05 enables an authenticated low-privileged Standard-role user to execute arbitrary OS commands as root by exploiting the ugw-restart method in /cgi-bin/wwwugw.cgi. Unsanitized user input is passed directly to the dpcheck system utility, which runs with root privileges, yielding full device compromise from a minimal trust level. Publicly available exploit code exists via a GitHub proof-of-concept repository; EPSS is low (0.24%, 15th percentile), consistent with a niche product, though the public PoC substantially lowers the barrier for targeted attacks.
Unauthenticated remote code execution in PowerJob 4.x through 5.1.2 lets any actor that can reach the server's Server-Worker transport port send crafted messages to the /friend/process endpoint and execute arbitrary code in the PowerJob process context; the assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the root cause class is CWE-287 improper authentication. Publicly available exploit code exists (a PoC repository and a gist are linked from the CVE record), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is 0.62% (47th percentile), notably low relative to the 9.8 severity because exploitation is gated by network exposure rather than by any authentication or user-interaction prerequisite. Realistic risk therefore concentrates on flat networks, cloud deployments that publish the transport port (including default docker-compose setups), and post-perimeter attackers, while well-segmented deployments that keep worker communication internal are substantially less exposed.
Remote code execution in PowerJob Server 5.1.2 (and likely earlier releases) stems from a predictable/hardcoded HS256 signing key used for the server's JWT authentication, letting an unauthenticated remote attacker forge valid admin session tokens and drive PowerJob's job-execution features to run arbitrary code. PowerJob is an open-source distributed task-scheduling framework, and because the secret is derived by a default provider rather than randomly generated, any exposed instance is trivially impersonatable. Publicly available exploit code exists (a proof-of-concept gist), though there is no CISA KEV listing or confirmed in-the-wild exploitation at time of analysis.
Remote code execution in DocsGPT 0.15.0 and earlier arises from its custom-prompt feature, which passes user-supplied prompt content into Jinja template rendering with no sanitization or sandboxing. An unauthenticated attacker can submit crafted template expressions to achieve server-side template injection (SSTI) that escalates to full RCE on the host running the chatbot backend. VulDB has published an entry and a public writeup/PoC repository exists, though the flaw is not listed in CISA KEV and SSVC records exploitation status as 'none'.
Authenticated remote code execution in seacms v13.6 allows a low-privileged attacker to execute arbitrary OS commands by sending a crafted POST request to the admin_config.php component, exploiting a CWE-78 OS command injection flaw. The vulnerability achieves full system compromise (C:H/I:H/A:H) over the network with no user interaction required beyond authentication. No public exploit has been identified at time of analysis and EPSS sits at 0.24% (15th percentile), indicating minimal observed exploitation pressure currently.
Stack buffer overflow in the uMS graphical operator tool of MOOS ui-moos through commit 50b9c6c allows an unauthenticated network attacker to achieve code execution on an operator workstation by injecting excessively long client or variable names into the MOOSDB pub-sub middleware. When the operator subsequently selects a malicious process list entry or pokes an oversized variable through the uMS interface, unchecked sprintf calls in ScopeTabPane.cpp and ScopeGrid.cpp overflow fixed 1024-byte stack buffers, enabling memory corruption and control-flow hijack. The upstream fix (PR #5, commit a6ebc0bc) is confirmed by direct patch diff evidence replacing all three vulnerable sprintf calls with snprintf; no public exploit code or KEV listing has been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from unsanitized shell metacharacters passed to a `system("mkdir ...")` call inside `SplitHandler::handlePreCheckSplitDir()`, reachable via the `alogsplit` log-processing utility. An attacker who controls either a log file's pathname - including its filename - or the `--dir` command-line parameter can embed shell syntax (e.g., backtick substitution or `$(...)` sequences) that executes arbitrary commands with the privileges of the operator invoking `alogsplit`. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in upstream GitHub PR #127, replacing the dangerous `system()` call with a direct `mkdir(2)` syscall.
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP function string decoders (FunctionEncoder.cpp / FunctionEncoderMK.cpp), which copy attacker-controlled encoded strings into fixed buffers while trusting declared length fields and scanning for delimiters without any bounds or end-of-string checks. Any actor able to publish a crafted value to a MOOS variable (via the typically unauthenticated MOOSDB) or supply a malicious .alog file can overflow these buffers, potentially achieving code execution on the autonomy stack of a marine vehicle. Publicly available exploit code exists per the VulnCheck advisory; there is no public exploit identified in CISA KEV, so it is not confirmed as actively exploited.
Remote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary programs on a robot/vehicle host by publishing a crafted MISSION_FILE variable to the MOOSDB. pAntler's headless remote-control path parses the mission file's Run entries and launches them via execvp() with no check on who published the message, so anyone able to write to the MOOSDB can spawn processes. Reported by VulnCheck with an upstream fix (PR #17); no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbitrary shell commands as the iSay process user. The SAY_MOOS variable handler in Sayer.cpp builds a speech command string and passes it straight to system(), so a published message containing backticks or $() command-substitution syntax is executed by the shell. Reported by VulnCheck with a vendor patch available; no public exploit is identified at time of analysis, though the source-level root cause is fully disclosed in the upstream fix commit.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Sandbox-escape remote code execution affects Google Chrome on iOS prior to 152.0.7977.82, where improper input validation (CWE-20) in the browser's Transactions Platform component lets a remote attacker potentially run arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Google shipped a fix in the stable channel and Chromium rated the underlying issue Medium severity, though the supplied CVSS vector scores it 9.6. There is no public exploit identified and CISA's SSVC framework records exploitation status as none.
Type confusion (CWE-843) in the Compositing subsystem of Google Chrome prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within the renderer sandbox by delivering a crafted HTML page to a victim. Execution is confined to Chrome's renderer process rather than the underlying OS - a full host compromise would require chaining with a separate sandbox escape primitive. No public exploit or active exploitation (KEV) has been identified at time of analysis; SSVC rates Exploitation: none and Automatable: no.
Use-after-free in Skia, Chrome's 2D graphics rendering engine, allows remote attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.82 across desktop platforms. The sandbox confinement means this vulnerability alone does not yield full system compromise - a chained sandbox escape would be required for that - but the renderer-process code execution is rated high impact by Chromium's internal severity team. No public exploit or CISA KEV listing is present at time of analysis; SSVC labels exploitation as none and the attack as non-automatable due to the required user interaction.
Remote code execution in Google Chrome's DevTools component before 152.0.7977.82 lets a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and carries a CVSS 9.6 with scope change, reflecting sandbox escape. Google has shipped a fix; per CISA's SSVC assessment there is no evidence of active exploitation and no public exploit identified at time of analysis.
Sandboxed remote code execution in Google Chrome's CacheStorage API (prior to 152.0.7977.82) allows a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by luring a user to visit a specially crafted HTML page. The root cause is CWE-668 (Exposure of Resource to Wrong Sphere), where CacheStorage improperly exposes resources to an unintended security context. No public exploit code has been identified and SSVC reports exploitation status as none, though the patch is available and update is strongly recommended.
Remote code execution in Google Chrome for Android before 152.0.7977.82 stems from an out-of-bounds write in the WebGL implementation, letting a remote attacker escape the browser sandbox and run arbitrary code simply by luring a victim to a crafted HTML page. Rated Chromium severity High and CVSS 9.6, the flaw is notable because exploitation breaks out of the renderer sandbox rather than being contained by it. There is no public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none.
In-sandbox arbitrary code execution in Google Chrome's V8 JavaScript engine (all versions prior to 152.0.7977.82) is achievable by a remote unauthenticated attacker who tricks a user into visiting a specially crafted HTML page. The underlying flaw is a CWE-367 Time-of-Check Time-of-Use (TOCTOU) race condition within V8, allowing the attacker to win a memory-access race and redirect execution flow inside the Chrome renderer sandbox. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, though the technical impact is rated 'total' within the sandbox boundary.
Use-after-free in Chrome's Compositing component (versions prior to 152.0.7977.82) enables a sandbox escape when chained with a renderer-process compromise - an attacker who has already gained control of the renderer can corrupt memory in the Compositing layer and execute arbitrary code outside Chrome's sandbox boundary on the host operating system. The CVSS S:C (scope changed) metric confirms this is a privilege-escalation-across-boundary primitive, delivering full C:H/I:H/A:H impact against the underlying OS. A vendor patch is available in Chrome 152.0.7977.82, and no public exploit has been identified at time of analysis.
Type confusion in V8 (Chrome's JavaScript engine) in versions prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within Chrome's renderer sandbox by enticing a user to visit a specially crafted HTML page. The flaw exploits V8's type system, allowing an attacker to manipulate object type metadata in the JavaScript heap to gain controlled memory access and code execution inside the renderer process. No public exploit or CISA KEV listing has been identified at time of analysis, though V8 type confusion vulnerabilities in Chrome have historically attracted rapid weaponization given the browser's enormous attack surface and attacker interest.
Privilege escalation to root in the AWS FPGA Development Kit (aws-fpga) before version 2.3.4 is achievable when a local low-privileged user pre-places malicious shell content at the predictable path `/tmp/sdk_root_env.exp`, which the `sdk_setup.sh` installation script sources after elevating its own privileges. The root cause (CWE-379) is the installation component writing a shell function file to the world-writable `/tmp` directory without using secure temporary file practices, making the path guessable and controllable by any local account. Amazon released a fix in v2.3.4 that removes the offending write step entirely, sourcing the function directly from `shared/bin/set_common_functions.sh` instead; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's security context when a victim opens a specially crafted malicious file. The vulnerability resides in file-parsing logic (CWE-122), and successful exploitation grants full C:H/I:H/A:H impact without requiring elevated privileges on the victim's system. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has released a security advisory (APSB26-121) addressing the issue.
Arbitrary OS command execution in GeoNetwork before 4.4.12 and 4.2.17 arises because the Saxon XSLT processor that renders formatters runs without FEATURE_SECURE_PROCESSING and with Java extension functions (ALLOW_EXTERNAL_FUNCTIONS) enabled. A user privileged enough to upload a formatter can supply a malicious .xsl stylesheet that invokes java.lang.Runtime.exec() or java.lang.ProcessBuilder, running commands as the GeoNetwork process user. No public exploit is identified at time of analysis, though the vendor GHSA advisory and public reporting describe the technique in detail.
Remote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary OS commands in the victim's process context by supplying a malicious git repository containing a crafted `.git/config` that sets `core.fsmonitor` to an attacker-controlled binary or script. Exploitation is triggered the moment a user opens the malicious repository and sends any message, causing the agent's internal git status call to invoke the injected command and expose the full process environment - including configured LLM provider API keys. A public exploit writeup exists (manifold.security), and a patch was released as commit f6234d0.
Remote code execution in Rockwell Automation Arena's DOE file parser allows a network-reachable attacker to write beyond the boundary of an allocated object and execute arbitrary code within the context of the running Arena process. Affected users must be socially engineered into opening a maliciously crafted Design of Experiments (DOE) file or visiting a page that triggers the parse. The CVSS 4.0 score of 7.5 reflects high attack complexity and mandatory active user interaction, reducing real-world exploitability despite the high-severity memory corruption impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authenticated administrator to upload a PHP webshell that, once processed, runs arbitrary code as the web-service account. The upload routine trusts the client-supplied filename and never validates file content or securely restricts extensions (CWE-434), so a benign-looking CSV import becomes a code-execution primitive. Disclosed via INCIBE as part of a multi-vulnerability advisory for Ocsreports; no public exploit identified at time of analysis, and no EPSS or KEV signal is present in the input.
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis.
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat.
Python bytecode scanning gap in agentverus-scanner allows supply-chain attackers to smuggle malicious __pycache__ .pyc files past the tool's static and semantic analysis engines, which only inspect source .py files in companion code directories. Packages carrying malicious bytecode alongside benign source receive a CERTIFIED verdict with elevated trust scores, causing downstream environments that trust the scanner to silently execute attacker-controlled code on import. No public exploit code has been identified at time of analysis, but the VulnCheck advisory and GitHub issue #27 document the bypass technique in sufficient detail for reproduction.
Tencent AI-Infra-Guard's skill-scan component allows scanner bypass via hardcoded exclusion of Python compiled bytecode, enabling malicious skill packages to pass a false SAFE verdict and execute arbitrary code on operator hosts. Attackers supply a skill with benign `.py` source decoys alongside malicious `.pyc/.pyo/.pyd` bytecode in `__pycache__` directories; because three separate scanning surfaces in versions through v4.6.0 unconditionally skip these artifacts, the auditing LLM never sees the malicious payload. CPython's PEP 552 UNCHECKED_HASH behavior executes `.pyc` at import time regardless of source presence, triggering code execution when an operator installs the skill. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Issue #531 confirm the flaw.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise.
Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score.
PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-level user to trigger deserialization of attacker-controlled field values by reopening a previously submitted post in the plugin's frontend editing form. If a suitable PHP gadget chain is present in the WordPress installation - supplied by other installed themes or plugins - this escalates to full remote code execution. A public proof-of-concept is available via WPScan, making exploitation accessible to low-skilled attackers on vulnerable installs.
Arbitrary file deletion in the SigmaForms Pro - AI Generated Forms plugin for WordPress (all versions through 1.4.11) lets unauthenticated attackers submit a path-traversal string through a form's file-upload field, which is stored in the database and processed by the vulnerable delete_submission_files function. When an administrator later deletes the submission record, the plugin removes the attacker-specified file - deleting wp-config.php (or similar) can escalate to full site takeover/remote code execution. Reported by Wordfence; no public exploit identified at time of analysis and no CISA KEV listing.
Remote code execution is possible in the DevKit Pro WordPress plugin (versions ≤ 2.3.0) by any authenticated user holding Subscriber-level access or higher. The DPDEV_install_themes_func() function, registered on the wp_ajax_DPDEV_install_themes AJAX action, lacks both a WordPress capability check and nonce validation, allowing low-privileged users to upload and extract arbitrary theme ZIP packages - including PHP webshells - into the web-accessible wp-content/themes/ directory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege requirement (Subscriber) makes this a realistic risk on any WordPress site with open user registration.
Arbitrary file deletion in the WP File Download WordPress plugin (all versions, by JoomUnited) allows any authenticated subscriber-level user to delete files outside the plugin's intended directory, with trivial escalation to remote code execution by targeting wp-config.php. The vulnerability stems from two AJAX endpoints - file.save and file.delete - that lack both WordPress capability checks and nonce enforcement, permitting the two-stage exploit chain against any authenticated session. No public exploit code has been confirmed at time of analysis, but the Wordfence advisory describes the precise two-request mechanism in sufficient detail to enable rapid weaponization.
Sandbox escape and out-of-sandbox arbitrary code execution in Google Chrome (desktop) before 152.0.7977.75, rooted in an incorrect authorization flaw in the FileSystem component. A remote attacker who lures a victim into opening a crafted HTML page can break out of the renderer sandbox and run code with the privileges of the browser process. Rated High by Chromium and CVSS 9.6; the vendor has shipped a stable-channel patch, though no public exploit code or active exploitation has been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the Shared Tab Groups feature (CWE-416). A remote attacker who lures a victim into visiting a crafted HTML page can corrupt freed memory to execute arbitrary code outside the renderer sandbox. Chromium rates the severity Critical (CVSS 9.6); the vendor has shipped a fix, but no public exploit has been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.
Stack-based buffer overflow in the GPU component of Google Chrome on Windows (prior to 152.0.7977.75) enables full sandbox escape and arbitrary code execution on the host operating system. Exploitation is a two-stage chained attack: an attacker must first compromise the renderer process (via a separate vulnerability or exploit), then leverage this GPU flaw to break out of Chrome's sandbox and execute code with elevated host privileges. Google has released a patch in the stable channel update for desktop; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Chrome's TabStrip component enables remote code execution outside the renderer sandbox in Google Chrome versions prior to 152.0.7977.75. An attacker must social-engineer a user into a specific UI interaction to trigger the memory-corruption primitive, after which arbitrary code executes at browser-process privilege - a full sandbox escape. Google has issued a stable channel patch; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Google Chrome's Browser process prior to version 152.0.7977.75 enables sandbox escape, allowing an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The CVSS vector (AV:N/AC:H/S:C/C:H/I:H/A:H) reflects both the network-reachable delivery and the scope change from renderer to host-level execution. No public exploit or CISA KEV listing has been identified at time of analysis, but sandbox-escape primitives of this class are highly valued in exploit chains.
Remote code execution inside Chrome's sandbox is achievable via a use-after-free in WebRTC, triggered when a victim visits a specially crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75 across desktop platforms. No public exploit code or CISA KEV listing has been identified at time of analysis, though the sandboxed execution boundary limits the practical impact compared to the raw CVSS 8.8 score - Google's own Chromium severity rating of 'Medium' reflects this containment.
Sandbox escape in Google Chrome's TabStrip component (versions prior to 152.0.7977.75) allows a remote attacker who has already achieved renderer process compromise to execute arbitrary code outside the Chrome sandbox via incorrect authorization in tab management IPC. The attack chain requires two conditions to be met simultaneously: a prior renderer exploit and social engineering to deliver a crafted HTML page - placing this firmly in the chained-exploit category despite the high CVSS base score. A vendor-released patch is available in Chrome 152.0.7977.75; no public exploit code or active exploitation has been identified at time of analysis.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox via a crafted local program, affecting all Chrome for Windows versions prior to 152.0.7977.75. The root cause is incorrect authorization (CWE-863) within the Chromoting subsystem, where flawed authorization logic fails to restrict a local program from interacting with Chromoting in a way that crosses the sandbox boundary. Google has released a patched version (152.0.7977.75), and no public exploit has been identified at time of analysis, though the full post-sandbox C:H/I:H/A:H impact warrants prompt remediation.
Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.
Remote code execution within the browser sandbox is possible in Google Chrome versions prior to 152.0.7977.75 due to a use-of-uninitialized-resource flaw (CWE-908) in the V8 JavaScript engine. An attacker can trigger the vulnerability by luring a user to a crafted HTML page, with no authentication or special privileges required beyond normal web browsing. Google has released the patched build 152.0.7977.75; SSVC rates exploitation status as none and no CISA KEV listing has been identified at time of analysis.
Remote code execution in Google Chrome desktop before 152.0.7977.75 stems from a use-after-free in the Proxy component that a remote attacker can trigger with crafted network traffic to run arbitrary code OUTSIDE the browser sandbox. Google rates the Chromium severity High and a patched Stable channel build is available; no public exploit code has been identified at time of analysis. Because the flaw yields a sandbox escape rather than a contained renderer bug, successful exploitation gives attacker-controlled code on the host at browser-process privilege.
GitHub Enterprise Server SSRF chain delivers remote code execution by allowing malicious pre-receive hook code to impersonate trusted internal GHES services and redirect requests to privileged internal endpoints. All GHES versions prior to 3.22 are affected; GitHub has released patches across five supported branches (3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5). No public exploit code or CISA KEV listing exists at time of analysis, and exploitation requires both a non-default networking configuration and at minimum write-level repository access, materially limiting realistic attacker population.
Remote code execution via a time-of-check time-of-use race condition in GitHub Enterprise Server affects all versions prior to 3.22. An authenticated user holding repository write access can trigger the vulnerability by issuing precisely timed concurrent upload requests, exploiting the window between a security check and the file operation it guards. No public exploit code or CISA KEV listing has been identified; the issue was responsibly disclosed through GitHub's Bug Bounty program and patched across five active release branches.
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administrator to execute arbitrary OS commands under specific conditions, achieving full remote code execution on the appliance. The vulnerability (CWE-78) is post-authentication and gated by administrator-level credentials, narrowing the exploitable attack surface to compromised or malicious admin accounts. No public exploit code or active exploitation has been identified at time of analysis, though SMA1000 appliances are high-value targets as network edge remote-access devices.
Path traversal in Laravel Excel (versions 3.1.8-3.1.69) allows authenticated low-privilege users to overwrite arbitrary existing files on the server by supplying a crafted destination path to `Excel::store()`, `$export->store()`, or `storeExcel()`. The vulnerable `Disk::copy()` method resolves caller-controlled paths via `realpath()` against the process working directory, then opens matched files directly with `fopen(rb+)` and `stream_copy_to_stream()`, bypassing Flysystem's path confinement entirely. When the overwritten target is a web-accessible PHP file, this escalates to remote code execution; no public exploit is identified at time of analysis.
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
PHP object injection in Cypht before 2.12.2 allows authenticated users to execute arbitrary OS commands as the web server process by submitting a crafted serialized payload via the logout handler. The `back_query` GET parameter is base64-decoded and passed directly to PHP's `unserialize()` with no allow-list, signature check, or type restriction, enabling gadget-chain exploitation. A vendor patch is available in v2.12.2 and no public exploit code has been identified at time of analysis.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
Unauthenticated remote code execution in Voltronic Power SNMP Web Pro 1.1 lets remote attackers gain root on the device by POSTing a crafted tar archive to the upload.cgi firmware-update endpoint. Because the archive is extracted into a privileged directory and its contents executed as root without any credential check, a single request yields full system compromise. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC); this is not yet listed in CISA KEV.
Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Remote code execution in LaVague 0.2.35, an LLM-driven web-automation agent framework, arises because PythonFromMarkdownExtractor.extract_as_object evaluates language-model output that is derived from attacker-influenced web page content. An attacker who controls or poisons a page the agent visits can use indirect prompt injection to coerce the model into emitting Python that is then eval'd and executed on the operator's host with no human review. Reported by VulnCheck (CWE-94); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in Plandex 2.2.1's ApplyFiles function allows an attacker who can influence the AI model's output - through poisoned repository files or attacker-controlled context - to write files to arbitrary locations outside the intended project directory. Targets such as shell initialization files (~/.bashrc, ~/.zshrc) and cron entries can be silently overwritten, resulting in persistent code execution under the developer's local account. No CISA KEV entry or confirmed public exploit exists at time of analysis, but the attack surface (indirect prompt injection combined with insecure file-write) is increasingly well-understood in the AI tooling threat landscape.
Unauthenticated arbitrary file read and write in TEN Framework 0.11.71 lets remote attackers hit the TMAN Designer file-content API (POST/PUT to /api/designer/v1/file-content) with no credentials, reading any file the service can access and writing attacker-controlled content to arbitrary system paths. Because the write primitive can drop SSH authorized_keys, cron jobs, or executable graph files, it escalates directly to remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted git repository containing a malicious `.aider.conf.yml` configuration file. The tool unconditionally reads this file at startup and passes `test-cmd` and `lint-cmd` values directly to Python's `subprocess` with `shell=True`, with no user confirmation, no LLM involvement, and no API key required. Confirmed present on version 0.86.2 and the 0.86.3.dev main branch per the VulnCheck advisory; no vendor-released patch has been identified at time of analysis, and no public exploit code has been identified beyond the mechanism documented in the public GitHub issue.
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.
Arbitrary command execution in goose v1.37.0 allows an attacker to embed shell commands inside recipe stdio extension definitions and retry.check fields that are silently executed under the victim user's OS privileges. The built-in recipe security scanner does not inspect these fields, providing a false safety guarantee and a clear bypass path. No public exploit is identified at time of analysis, but exploitation is low-complexity once a target user loads a malicious recipe.
Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Remote code execution and full site takeover affect the AI Website Builder WordPress plugin (GitHub build 1.0.0), whose REST API routes perform no authorisation or nonce validation. Unauthenticated attackers can install and activate arbitrary plugins and themes, import content from a URL they control, write an arbitrary file into wp-content/uploads, and delete site content and media - any of the code-installation paths yields RCE, and the arbitrary uploads file write is directly RCE on hosts that serve PHP from the uploads directory. No public exploit identified at time of analysis, but the trivial unauthenticated network attack surface (CVSS 9.8) makes this a critical-priority issue for any site running the affected build.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV.
Path traversal in Plesk web hosting control panel (versions ≤18.0.79.9 and 18.0.80-18.0.80.5) enables local users with low privileges to execute arbitrary code as the root user, resulting in full system compromise. The CVSS 4.0 score of 8.5 reflects high CIA impact with no special attack requirements beyond local OS access (AV:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the privilege escalation to root in a widely deployed hosting platform makes this a high-priority patch for server operators, particularly those running multi-tenant shared hosting environments.
Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.
Remote code execution in easyadmin v2.0.2.2 lets attackers with access to the background management interface upload a crafted file of a dangerous type (e.g. a PHP webshell) and execute arbitrary code, gaining server-level privileges. The flaw is a classic unrestricted file upload (CWE-434) in an admin-only feature; the description specifies authenticated access despite the provided CVSS vector marking it as requiring no privileges. EPSS is low (0.24%, 15th percentile) and there is no evidence of active exploitation, though a researcher issue writeup is referenced.
Remote code execution in esoTalk v1.0.0g4 arises from configuration comment injection that allows attacker-controlled input reaching ETMemberModel, ETMemberController and ET.class.php to be persisted into a PHP configuration file and subsequently interpreted as code (CWE-94). Documented only in a third-party Notion writeup with no public exploit tool; EPSS is low at 0.19% (9th percentile). No public exploit identified at time of analysis and the CVE is not in CISA KEV.
Unrestricted file upload in AppNitro MachForm v30 permits unauthenticated remote attackers to achieve code execution by uploading a crafted .phar (PHP Archive) file through the application's file upload functionality. Because the application fails to block .phar extensions alongside conventional dangerous types like .php, an attacker can cause the PHP runtime to execute attacker-supplied code upon accessing the uploaded file. A public proof-of-concept is available on GitHub and a write-up is hosted on PacketStorm Security, raising practical exploitability above the low EPSS score would suggest.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Command injection in MBS-Solutions X-Serie Gateway firmware V6_00_05 enables an authenticated low-privileged Standard-role user to execute arbitrary OS commands as root by exploiting the ugw-restart method in /cgi-bin/wwwugw.cgi. Unsanitized user input is passed directly to the dpcheck system utility, which runs with root privileges, yielding full device compromise from a minimal trust level. Publicly available exploit code exists via a GitHub proof-of-concept repository; EPSS is low (0.24%, 15th percentile), consistent with a niche product, though the public PoC substantially lowers the barrier for targeted attacks.
Unauthenticated remote code execution in PowerJob 4.x through 5.1.2 lets any actor that can reach the server's Server-Worker transport port send crafted messages to the /friend/process endpoint and execute arbitrary code in the PowerJob process context; the assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the root cause class is CWE-287 improper authentication. Publicly available exploit code exists (a PoC repository and a gist are linked from the CVE record), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is 0.62% (47th percentile), notably low relative to the 9.8 severity because exploitation is gated by network exposure rather than by any authentication or user-interaction prerequisite. Realistic risk therefore concentrates on flat networks, cloud deployments that publish the transport port (including default docker-compose setups), and post-perimeter attackers, while well-segmented deployments that keep worker communication internal are substantially less exposed.
Remote code execution in PowerJob Server 5.1.2 (and likely earlier releases) stems from a predictable/hardcoded HS256 signing key used for the server's JWT authentication, letting an unauthenticated remote attacker forge valid admin session tokens and drive PowerJob's job-execution features to run arbitrary code. PowerJob is an open-source distributed task-scheduling framework, and because the secret is derived by a default provider rather than randomly generated, any exposed instance is trivially impersonatable. Publicly available exploit code exists (a proof-of-concept gist), though there is no CISA KEV listing or confirmed in-the-wild exploitation at time of analysis.
Remote code execution in DocsGPT 0.15.0 and earlier arises from its custom-prompt feature, which passes user-supplied prompt content into Jinja template rendering with no sanitization or sandboxing. An unauthenticated attacker can submit crafted template expressions to achieve server-side template injection (SSTI) that escalates to full RCE on the host running the chatbot backend. VulDB has published an entry and a public writeup/PoC repository exists, though the flaw is not listed in CISA KEV and SSVC records exploitation status as 'none'.
Authenticated remote code execution in seacms v13.6 allows a low-privileged attacker to execute arbitrary OS commands by sending a crafted POST request to the admin_config.php component, exploiting a CWE-78 OS command injection flaw. The vulnerability achieves full system compromise (C:H/I:H/A:H) over the network with no user interaction required beyond authentication. No public exploit has been identified at time of analysis and EPSS sits at 0.24% (15th percentile), indicating minimal observed exploitation pressure currently.
Stack buffer overflow in the uMS graphical operator tool of MOOS ui-moos through commit 50b9c6c allows an unauthenticated network attacker to achieve code execution on an operator workstation by injecting excessively long client or variable names into the MOOSDB pub-sub middleware. When the operator subsequently selects a malicious process list entry or pokes an oversized variable through the uMS interface, unchecked sprintf calls in ScopeTabPane.cpp and ScopeGrid.cpp overflow fixed 1024-byte stack buffers, enabling memory corruption and control-flow hijack. The upstream fix (PR #5, commit a6ebc0bc) is confirmed by direct patch diff evidence replacing all three vulnerable sprintf calls with snprintf; no public exploit code or KEV listing has been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from unsanitized shell metacharacters passed to a `system("mkdir ...")` call inside `SplitHandler::handlePreCheckSplitDir()`, reachable via the `alogsplit` log-processing utility. An attacker who controls either a log file's pathname - including its filename - or the `--dir` command-line parameter can embed shell syntax (e.g., backtick substitution or `$(...)` sequences) that executes arbitrary commands with the privileges of the operator invoking `alogsplit`. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in upstream GitHub PR #127, replacing the dangerous `system()` call with a direct `mkdir(2)` syscall.
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP function string decoders (FunctionEncoder.cpp / FunctionEncoderMK.cpp), which copy attacker-controlled encoded strings into fixed buffers while trusting declared length fields and scanning for delimiters without any bounds or end-of-string checks. Any actor able to publish a crafted value to a MOOS variable (via the typically unauthenticated MOOSDB) or supply a malicious .alog file can overflow these buffers, potentially achieving code execution on the autonomy stack of a marine vehicle. Publicly available exploit code exists per the VulnCheck advisory; there is no public exploit identified in CISA KEV, so it is not confirmed as actively exploited.
Remote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary programs on a robot/vehicle host by publishing a crafted MISSION_FILE variable to the MOOSDB. pAntler's headless remote-control path parses the mission file's Run entries and launches them via execvp() with no check on who published the message, so anyone able to write to the MOOSDB can spawn processes. Reported by VulnCheck with an upstream fix (PR #17); no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbitrary shell commands as the iSay process user. The SAY_MOOS variable handler in Sayer.cpp builds a speech command string and passes it straight to system(), so a published message containing backticks or $() command-substitution syntax is executed by the shell. Reported by VulnCheck with a vendor patch available; no public exploit is identified at time of analysis, though the source-level root cause is fully disclosed in the upstream fix commit.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Sandbox-escape remote code execution affects Google Chrome on iOS prior to 152.0.7977.82, where improper input validation (CWE-20) in the browser's Transactions Platform component lets a remote attacker potentially run arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Google shipped a fix in the stable channel and Chromium rated the underlying issue Medium severity, though the supplied CVSS vector scores it 9.6. There is no public exploit identified and CISA's SSVC framework records exploitation status as none.
Type confusion (CWE-843) in the Compositing subsystem of Google Chrome prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within the renderer sandbox by delivering a crafted HTML page to a victim. Execution is confined to Chrome's renderer process rather than the underlying OS - a full host compromise would require chaining with a separate sandbox escape primitive. No public exploit or active exploitation (KEV) has been identified at time of analysis; SSVC rates Exploitation: none and Automatable: no.
Use-after-free in Skia, Chrome's 2D graphics rendering engine, allows remote attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.82 across desktop platforms. The sandbox confinement means this vulnerability alone does not yield full system compromise - a chained sandbox escape would be required for that - but the renderer-process code execution is rated high impact by Chromium's internal severity team. No public exploit or CISA KEV listing is present at time of analysis; SSVC labels exploitation as none and the attack as non-automatable due to the required user interaction.
Remote code execution in Google Chrome's DevTools component before 152.0.7977.82 lets a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and carries a CVSS 9.6 with scope change, reflecting sandbox escape. Google has shipped a fix; per CISA's SSVC assessment there is no evidence of active exploitation and no public exploit identified at time of analysis.
Sandboxed remote code execution in Google Chrome's CacheStorage API (prior to 152.0.7977.82) allows a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by luring a user to visit a specially crafted HTML page. The root cause is CWE-668 (Exposure of Resource to Wrong Sphere), where CacheStorage improperly exposes resources to an unintended security context. No public exploit code has been identified and SSVC reports exploitation status as none, though the patch is available and update is strongly recommended.
Remote code execution in Google Chrome for Android before 152.0.7977.82 stems from an out-of-bounds write in the WebGL implementation, letting a remote attacker escape the browser sandbox and run arbitrary code simply by luring a victim to a crafted HTML page. Rated Chromium severity High and CVSS 9.6, the flaw is notable because exploitation breaks out of the renderer sandbox rather than being contained by it. There is no public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none.
In-sandbox arbitrary code execution in Google Chrome's V8 JavaScript engine (all versions prior to 152.0.7977.82) is achievable by a remote unauthenticated attacker who tricks a user into visiting a specially crafted HTML page. The underlying flaw is a CWE-367 Time-of-Check Time-of-Use (TOCTOU) race condition within V8, allowing the attacker to win a memory-access race and redirect execution flow inside the Chrome renderer sandbox. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, though the technical impact is rated 'total' within the sandbox boundary.
Use-after-free in Chrome's Compositing component (versions prior to 152.0.7977.82) enables a sandbox escape when chained with a renderer-process compromise - an attacker who has already gained control of the renderer can corrupt memory in the Compositing layer and execute arbitrary code outside Chrome's sandbox boundary on the host operating system. The CVSS S:C (scope changed) metric confirms this is a privilege-escalation-across-boundary primitive, delivering full C:H/I:H/A:H impact against the underlying OS. A vendor patch is available in Chrome 152.0.7977.82, and no public exploit has been identified at time of analysis.
Type confusion in V8 (Chrome's JavaScript engine) in versions prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within Chrome's renderer sandbox by enticing a user to visit a specially crafted HTML page. The flaw exploits V8's type system, allowing an attacker to manipulate object type metadata in the JavaScript heap to gain controlled memory access and code execution inside the renderer process. No public exploit or CISA KEV listing has been identified at time of analysis, though V8 type confusion vulnerabilities in Chrome have historically attracted rapid weaponization given the browser's enormous attack surface and attacker interest.
Privilege escalation to root in the AWS FPGA Development Kit (aws-fpga) before version 2.3.4 is achievable when a local low-privileged user pre-places malicious shell content at the predictable path `/tmp/sdk_root_env.exp`, which the `sdk_setup.sh` installation script sources after elevating its own privileges. The root cause (CWE-379) is the installation component writing a shell function file to the world-writable `/tmp` directory without using secure temporary file practices, making the path guessable and controllable by any local account. Amazon released a fix in v2.3.4 that removes the offending write step entirely, sourcing the function directly from `shared/bin/set_common_functions.sh` instead; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's security context when a victim opens a specially crafted malicious file. The vulnerability resides in file-parsing logic (CWE-122), and successful exploitation grants full C:H/I:H/A:H impact without requiring elevated privileges on the victim's system. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has released a security advisory (APSB26-121) addressing the issue.
Arbitrary OS command execution in GeoNetwork before 4.4.12 and 4.2.17 arises because the Saxon XSLT processor that renders formatters runs without FEATURE_SECURE_PROCESSING and with Java extension functions (ALLOW_EXTERNAL_FUNCTIONS) enabled. A user privileged enough to upload a formatter can supply a malicious .xsl stylesheet that invokes java.lang.Runtime.exec() or java.lang.ProcessBuilder, running commands as the GeoNetwork process user. No public exploit is identified at time of analysis, though the vendor GHSA advisory and public reporting describe the technique in detail.
Remote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary OS commands in the victim's process context by supplying a malicious git repository containing a crafted `.git/config` that sets `core.fsmonitor` to an attacker-controlled binary or script. Exploitation is triggered the moment a user opens the malicious repository and sends any message, causing the agent's internal git status call to invoke the injected command and expose the full process environment - including configured LLM provider API keys. A public exploit writeup exists (manifold.security), and a patch was released as commit f6234d0.
Remote code execution in Rockwell Automation Arena's DOE file parser allows a network-reachable attacker to write beyond the boundary of an allocated object and execute arbitrary code within the context of the running Arena process. Affected users must be socially engineered into opening a maliciously crafted Design of Experiments (DOE) file or visiting a page that triggers the parse. The CVSS 4.0 score of 7.5 reflects high attack complexity and mandatory active user interaction, reducing real-world exploitability despite the high-severity memory corruption impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. All n8n deployments running versions below 1.123.73 (v1 track), 2.35.4, or 2.36.2 (v2 track) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (prototype chain walk to Function constructor) is well-understood and reliable once sandbox access is obtained.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authenticated administrator to upload a PHP webshell that, once processed, runs arbitrary code as the web-service account. The upload routine trusts the client-supplied filename and never validates file content or securely restricts extensions (CWE-434), so a benign-looking CSV import becomes a code-execution primitive. Disclosed via INCIBE as part of a multi-vulnerability advisory for Ocsreports; no public exploit identified at time of analysis, and no EPSS or KEV signal is present in the input.
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis.
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat.
Python bytecode scanning gap in agentverus-scanner allows supply-chain attackers to smuggle malicious __pycache__ .pyc files past the tool's static and semantic analysis engines, which only inspect source .py files in companion code directories. Packages carrying malicious bytecode alongside benign source receive a CERTIFIED verdict with elevated trust scores, causing downstream environments that trust the scanner to silently execute attacker-controlled code on import. No public exploit code has been identified at time of analysis, but the VulnCheck advisory and GitHub issue #27 document the bypass technique in sufficient detail for reproduction.
Tencent AI-Infra-Guard's skill-scan component allows scanner bypass via hardcoded exclusion of Python compiled bytecode, enabling malicious skill packages to pass a false SAFE verdict and execute arbitrary code on operator hosts. Attackers supply a skill with benign `.py` source decoys alongside malicious `.pyc/.pyo/.pyd` bytecode in `__pycache__` directories; because three separate scanning surfaces in versions through v4.6.0 unconditionally skip these artifacts, the auditing LLM never sees the malicious payload. CPython's PEP 552 UNCHECKED_HASH behavior executes `.pyc` at import time regardless of source presence, triggering code execution when an operator installs the skill. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Issue #531 confirm the flaw.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise.
Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis.
Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score.
PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-level user to trigger deserialization of attacker-controlled field values by reopening a previously submitted post in the plugin's frontend editing form. If a suitable PHP gadget chain is present in the WordPress installation - supplied by other installed themes or plugins - this escalates to full remote code execution. A public proof-of-concept is available via WPScan, making exploitation accessible to low-skilled attackers on vulnerable installs.
Arbitrary file deletion in the SigmaForms Pro - AI Generated Forms plugin for WordPress (all versions through 1.4.11) lets unauthenticated attackers submit a path-traversal string through a form's file-upload field, which is stored in the database and processed by the vulnerable delete_submission_files function. When an administrator later deletes the submission record, the plugin removes the attacker-specified file - deleting wp-config.php (or similar) can escalate to full site takeover/remote code execution. Reported by Wordfence; no public exploit identified at time of analysis and no CISA KEV listing.
Remote code execution is possible in the DevKit Pro WordPress plugin (versions ≤ 2.3.0) by any authenticated user holding Subscriber-level access or higher. The DPDEV_install_themes_func() function, registered on the wp_ajax_DPDEV_install_themes AJAX action, lacks both a WordPress capability check and nonce validation, allowing low-privileged users to upload and extract arbitrary theme ZIP packages - including PHP webshells - into the web-accessible wp-content/themes/ directory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege requirement (Subscriber) makes this a realistic risk on any WordPress site with open user registration.
Arbitrary file deletion in the WP File Download WordPress plugin (all versions, by JoomUnited) allows any authenticated subscriber-level user to delete files outside the plugin's intended directory, with trivial escalation to remote code execution by targeting wp-config.php. The vulnerability stems from two AJAX endpoints - file.save and file.delete - that lack both WordPress capability checks and nonce enforcement, permitting the two-stage exploit chain against any authenticated session. No public exploit code has been confirmed at time of analysis, but the Wordfence advisory describes the precise two-request mechanism in sufficient detail to enable rapid weaponization.
Sandbox escape and out-of-sandbox arbitrary code execution in Google Chrome (desktop) before 152.0.7977.75, rooted in an incorrect authorization flaw in the FileSystem component. A remote attacker who lures a victim into opening a crafted HTML page can break out of the renderer sandbox and run code with the privileges of the browser process. Rated High by Chromium and CVSS 9.6; the vendor has shipped a stable-channel patch, though no public exploit code or active exploitation has been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the Shared Tab Groups feature (CWE-416). A remote attacker who lures a victim into visiting a crafted HTML page can corrupt freed memory to execute arbitrary code outside the renderer sandbox. Chromium rates the severity Critical (CVSS 9.6); the vendor has shipped a fix, but no public exploit has been identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.
Stack-based buffer overflow in the GPU component of Google Chrome on Windows (prior to 152.0.7977.75) enables full sandbox escape and arbitrary code execution on the host operating system. Exploitation is a two-stage chained attack: an attacker must first compromise the renderer process (via a separate vulnerability or exploit), then leverage this GPU flaw to break out of Chrome's sandbox and execute code with elevated host privileges. Google has released a patch in the stable channel update for desktop; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Chrome's TabStrip component enables remote code execution outside the renderer sandbox in Google Chrome versions prior to 152.0.7977.75. An attacker must social-engineer a user into a specific UI interaction to trigger the memory-corruption primitive, after which arbitrary code executes at browser-process privilege - a full sandbox escape. Google has issued a stable channel patch; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Google Chrome's Browser process prior to version 152.0.7977.75 enables sandbox escape, allowing an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The CVSS vector (AV:N/AC:H/S:C/C:H/I:H/A:H) reflects both the network-reachable delivery and the scope change from renderer to host-level execution. No public exploit or CISA KEV listing has been identified at time of analysis, but sandbox-escape primitives of this class are highly valued in exploit chains.
Remote code execution inside Chrome's sandbox is achievable via a use-after-free in WebRTC, triggered when a victim visits a specially crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75 across desktop platforms. No public exploit code or CISA KEV listing has been identified at time of analysis, though the sandboxed execution boundary limits the practical impact compared to the raw CVSS 8.8 score - Google's own Chromium severity rating of 'Medium' reflects this containment.
Sandbox escape in Google Chrome's TabStrip component (versions prior to 152.0.7977.75) allows a remote attacker who has already achieved renderer process compromise to execute arbitrary code outside the Chrome sandbox via incorrect authorization in tab management IPC. The attack chain requires two conditions to be met simultaneously: a prior renderer exploit and social engineering to deliver a crafted HTML page - placing this firmly in the chained-exploit category despite the high CVSS base score. A vendor-released patch is available in Chrome 152.0.7977.75; no public exploit code or active exploitation has been identified at time of analysis.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox via a crafted local program, affecting all Chrome for Windows versions prior to 152.0.7977.75. The root cause is incorrect authorization (CWE-863) within the Chromoting subsystem, where flawed authorization logic fails to restrict a local program from interacting with Chromoting in a way that crosses the sandbox boundary. Google has released a patched version (152.0.7977.75), and no public exploit has been identified at time of analysis, though the full post-sandbox C:H/I:H/A:H impact warrants prompt remediation.
Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.
Remote code execution within the browser sandbox is possible in Google Chrome versions prior to 152.0.7977.75 due to a use-of-uninitialized-resource flaw (CWE-908) in the V8 JavaScript engine. An attacker can trigger the vulnerability by luring a user to a crafted HTML page, with no authentication or special privileges required beyond normal web browsing. Google has released the patched build 152.0.7977.75; SSVC rates exploitation status as none and no CISA KEV listing has been identified at time of analysis.
Remote code execution in Google Chrome desktop before 152.0.7977.75 stems from a use-after-free in the Proxy component that a remote attacker can trigger with crafted network traffic to run arbitrary code OUTSIDE the browser sandbox. Google rates the Chromium severity High and a patched Stable channel build is available; no public exploit code has been identified at time of analysis. Because the flaw yields a sandbox escape rather than a contained renderer bug, successful exploitation gives attacker-controlled code on the host at browser-process privilege.
GitHub Enterprise Server SSRF chain delivers remote code execution by allowing malicious pre-receive hook code to impersonate trusted internal GHES services and redirect requests to privileged internal endpoints. All GHES versions prior to 3.22 are affected; GitHub has released patches across five supported branches (3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5). No public exploit code or CISA KEV listing exists at time of analysis, and exploitation requires both a non-default networking configuration and at minimum write-level repository access, materially limiting realistic attacker population.
Remote code execution via a time-of-check time-of-use race condition in GitHub Enterprise Server affects all versions prior to 3.22. An authenticated user holding repository write access can trigger the vulnerability by issuing precisely timed concurrent upload requests, exploiting the window between a security check and the file operation it guards. No public exploit code or CISA KEV listing has been identified; the issue was responsibly disclosed through GitHub's Bug Bounty program and patched across five active release branches.
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administrator to execute arbitrary OS commands under specific conditions, achieving full remote code execution on the appliance. The vulnerability (CWE-78) is post-authentication and gated by administrator-level credentials, narrowing the exploitable attack surface to compromised or malicious admin accounts. No public exploit code or active exploitation has been identified at time of analysis, though SMA1000 appliances are high-value targets as network edge remote-access devices.
Path traversal in Laravel Excel (versions 3.1.8-3.1.69) allows authenticated low-privilege users to overwrite arbitrary existing files on the server by supplying a crafted destination path to `Excel::store()`, `$export->store()`, or `storeExcel()`. The vulnerable `Disk::copy()` method resolves caller-controlled paths via `realpath()` against the process working directory, then opens matched files directly with `fopen(rb+)` and `stream_copy_to_stream()`, bypassing Flysystem's path confinement entirely. When the overwritten target is a web-accessible PHP file, this escalates to remote code execution; no public exploit is identified at time of analysis.
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
PHP object injection in Cypht before 2.12.2 allows authenticated users to execute arbitrary OS commands as the web server process by submitting a crafted serialized payload via the logout handler. The `back_query` GET parameter is base64-decoded and passed directly to PHP's `unserialize()` with no allow-list, signature check, or type restriction, enabling gadget-chain exploitation. A vendor patch is available in v2.12.2 and no public exploit code has been identified at time of analysis.