RCE
Monthly
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent network segments. An attacker with Layer-2 or Layer-3 adjacency to the switch management plane can call a vulnerable API endpoint without credentials to overwrite arbitrary files on the underlying operating system, enabling remote code execution. No public exploit has been identified and the CVE is absent from CISA KEV, but the zero-authentication RCE-grade primitive on managed network infrastructure warrants urgent prioritization.
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper handling of malformed or truncated input received from an external authentication server. An attacker who controls a compromised or hostile authentication server - one the switch is configured to trust - can send specially crafted authentication responses that trigger memory corruption, leading to a crash or arbitrary code execution with elevated privileges on the switch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential for unauthenticated-from-the-network-device-perspective RCE on core network infrastructure elevates the operational urgency.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deployment privileges to execute arbitrary attacker-controlled logic on the Elasticsearch host node by supplying a crafted trained model artifact. The flaw stems from unsafe deserialization (CWE-502) of model artifact data during the ML inference loading process, granting the attacker a broader OS system-call surface than the ML subsystem is intended to expose. Elastic has released fixed versions 8.19.2, 9.4.5, and 9.5.1 via ESA-2026-114; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-level privileges to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates exploitation requires only local, low-privileged access with no user interaction, making this a meaningful threat in multi-tenant AI training environments where shared compute access is common. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to execute arbitrary code, tamper with data, and disclose sensitive information on affected systems. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where a crafted malicious payload supplied to the Bridge component triggers unsafe deserialization, granting the attacker full control over the vulnerable process. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS 7.8 score reflects the severity of successful exploitation.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS:3.1 score of 7.8 (High) with a local attack vector reflects that exploitation requires an existing foothold on the system, but the low privilege requirement and no user interaction needed make post-access exploitation straightforward. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to code execution, data tampering, and information disclosure when an attacker with local user access supplies a malicious serialized payload to the Bridge process. The local attack vector (AV:L) and low-privilege requirement (PR:L) place this vulnerability in the context of shared AI/ML training infrastructure - multi-tenant GPU clusters where lateral movement between users is the realistic threat model. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The CVSS 7.8 score (AV:L/PR:L) constrains exploitation to local contexts, but the high impact across all three CIA triad components reflects the severity of a successful exploit. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information on affected systems. Rooted in CWE-502, the flaw arises when the bridge component deserializes attacker-influenced data without adequate validation - a well-understood attack class that is particularly dangerous in distributed AI training infrastructure where serialized model state or inter-process messages transit between components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes AI training infrastructure to code execution, data tampering, and information disclosure by local low-privileged attackers. The vulnerability (CWE-502) resides in a bridge component of the Megatron-LM distributed training framework, used extensively in large-scale LLM training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 7.8 (High) reflects the severity of a full triad (C:H/I:H/A:H) impact if exploitation succeeds.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker holding standard user privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the exploitation path is local and low-privilege - no network exposure or administrator rights are required, making insider threats, shared-access HPC environments, and compromised user accounts the primary risk vectors. No public exploit code or active exploitation has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability (CWE-502) stems from the application accepting and processing serialized data without adequate validation, enabling crafted payloads to subvert normal deserialization logic. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad indicates a severe outcome if exploited by a user with existing local access.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with data, and disclose sensitive information. The CVSS vector (AV:L/AC:L/PR:L) indicates the vulnerability is exploitable locally without elevated privileges or user interaction, making it a significant risk in multi-tenant distributed AI training environments where multiple users share infrastructure. No public exploit or KEV listing is confirmed at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with application data, and exfiltrate sensitive information. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is bounded to local authenticated users or processes, but the full C:H/I:H/A:H impact triad makes successful exploitation highly damaging within that local scope. No public exploit has been identified at time of analysis, and no CISA KEV listing has been observed.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The local attack vector (AV:L) and low-privilege requirement (PR:L) limit the attack surface to users or processes with existing system access, yet the full C:H/I:H/A:H impact triad makes successful exploitation highly consequential. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the NVIDIA PSIRT has published a security advisory via their product-security GitHub repository.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and sensitive information disclosure on the affected system. The CVSS 7.8 base score reflects a local attack vector requiring only low-privilege access with no user interaction, producing full high-impact compromise across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the severity of potential impact warrants prompt patching in AI training environments.
Remote code execution in the FS-Poster WordPress plugin (versions up to and including 8.0.1) allows any authenticated user with subscriber-level access to execute arbitrary OS commands on the underlying web server. The vulnerability combines two weaknesses: the FFmpeg path parameter accepted by the plugin's REST API is passed unsanitized to PHP's exec() function (CWE-77 command injection), and the REST API endpoints responsible for this functionality lack proper authorization checks. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - a standard subscriber account - makes this accessible to any registered WordPress user.
Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges to execute arbitrary code at the operating system's highest privilege level. Affecting the full PowerStore T and Q product families (500T through 7000T confirmed via CPE), this CWE-829 flaw exploits the inclusion of functionality from an untrusted control sphere - meaning a low-privileged local user can influence a privileged execution path by supplying or manipulating untrusted code or configuration loaded by a higher-privileged process. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure installation directory permissions in Rockwell Automation ControlFLASH™ expose any local user account to arbitrary code execution by allowing write access to the product's installation folder for the Windows 'Everyone' group. An attacker with low-privileged local access can plant a malicious binary or DLL in the installation directory, which then executes at the permission level of whichever user subsequently launches ControlFLASH - potentially a privileged operator in an OT environment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allows an authenticated user with limited privileges to execute arbitrary code at root privilege level, achieving full appliance compromise. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms that exploitation requires only local authenticated access with low-level credentials and no user interaction, with the resulting code execution crossing a privilege boundary into a root context. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote code execution in Klemsan KIO (Klemsan Internet Objects) versions prior to v1.9 allows attackers to inject and execute arbitrary code against the network-facing application. The flaw, reported by TR-CERT (Turkey's national CSIRT), carries a CVSS 9.8 and requires no authentication or user interaction, giving full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial attack profile makes it a high-priority patch.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in LibreNMS's libvirt discovery module (VminfoLibvirt.php) enables any authenticated administrator to execute arbitrary OS commands on the discovery worker host by setting a crafted device hostname. Affected deployments span LibreNMS 23.10.0 through 26.3.x wherever the enable_libvirt option is explicitly set to true; the vendor-released fix is version 26.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is straightforward for any actor holding admin credentials.
Remote code execution in LibreNMS versions before 26.5.0 stems from the AboutController passing the snmpget configuration value directly to shell_exec() with a validation mechanism rendered ineffective by a PHP assignment operator bug. An authenticated administrator can update the snmpget setting to reference any executable already present on the server filesystem, then trigger code execution by visiting the /about endpoint, yielding full host compromise under web server privileges. No public exploit has been identified and this vulnerability is absent from CISA KEV; vendor-released patch 26.5.0 is available.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.12) allows remote attackers to remove any server-accessible file via path traversal in the move_folders function. Deleting critical files such as wp-config.php triggers WordPress's reinstallation routine, cascading directly to full remote code execution and site takeover. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero-authentication requirement on publicly visible forms make this a critical-priority remediation.
Arbitrary file upload in Master Addons for Elementor (all versions through 3.1.9) enables WordPress users with editor-level access to achieve remote code execution by exploiting a misconfigured AJAX authorization check. The upload_template_kit() handler incorrectly enforces only the upload_files capability-held by editors by default-rather than the manage_options capability required by every sibling handler, and performs no file-type filtering on content extracted from uploaded ZIP archives, allowing PHP webshells and other executable files to land on the server. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and clear code-level proof in the plugin SVN repository make this a high-priority remediation for any multi-user WordPress site running Elementor.
Unauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, versions up to and including 4.4.1, allows remote attackers to plant executable files on the server and potentially achieve remote code execution. The flaw stems from missing file-type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints, so no login is required. Reported by Wordfence and carrying a CVSS of 9.8; no public exploit identified at time of analysis.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Remote code execution in the Tenda A18 Wi-Fi router (firmware v15.13.07.09) arises from an unauthenticated buffer overflow in the fromSetCmdlineRun function, letting a remote attacker corrupt memory and run arbitrary code on the device. The CVSS 9.8 vector indicates network-reachable, no-authentication, no-interaction exploitation, and a public repository (github.com/momo8877847/Tenda-A18) appears to document the flaw, so publicly available exploit code likely exists. There is no CISA KEV listing and EPSS is low (0.30%), indicating no confirmed widespread active exploitation at this time.
Remote code execution in lllyasviel Fooocus 2.1.854 through 2.5.5 allows any user who can upload an image to execute arbitrary Python code on the hosting server. The vulnerability stems from the `get_list` function in `modules/meta_parser.py` passing a `styles` field extracted from image EXIF metadata directly to Python's `eval()` without sanitization or sandboxing. A detailed technical writeup exists at mrbruh.com/fooocus and the vulnerable code path is publicly visible in the repository; no confirmed active exploitation has been identified at time of analysis, and EPSS stands at 0.24% (15th percentile).
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
Remote code execution in OpenSearch's SQL plugin cursor pagination component allows authenticated users holding only basic read/search permissions to execute arbitrary code on the server by supplying a crafted serialized cursor parameter to the plugins/sql endpoint. Affecting all versions of self-hosted OpenSearch and Amazon OpenSearch Service up to the patched releases, this CWE-502 deserialization flaw is particularly dangerous because the low privilege bar means any cluster user - not just administrators - can trigger it. Vendor-released patches exist in OpenSearch 2.19.6 and 3.7.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.
Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. Because path arguments derive from LLM output, an indirect prompt injection attack embedded in developer-loaded content can steer writes to host-executed files and escalate to backend code execution; Agent Mode applies writes silently with no confirmation dialog. No public exploit code or CISA KEV listing exists at time of analysis, though the prompt-injection attack surface is realistic in cloud IDE deployments.
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. No public exploit has been identified at time of analysis, but the primitive directly enables remote code execution by overwriting application modules, static assets, cron jobs, or SSH authorized_keys files.
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests.
Arbitrary code execution is achievable in Readest versions prior to 0.11.16 by embedding a malicious EPUB file that bypasses the application's DOMPurify-based HTML sanitizer via a crafted srcdoc attribute on an iframe element. DOMPurify treats srcdoc as an opaque string and does not sanitize its contents, allowing a complete HTML document containing JavaScript to survive sanitization and execute inside an iframe configured with sandbox="allow-same-origin allow-scripts"; the executing script can then call parent.parent.__TAURI_INTERNALS__.invoke() to access the full Tauri IPC command surface and achieve OS-level arbitrary code execution. The attack requires only that a victim open a specially crafted EPUB file, and the payload can be rendered invisibly as a zero-size transparent iframe. No public exploit code has been identified at time of analysis; vendor-released patch version 0.11.16 is available.
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Pimcore (all releases up to 12.3.9, plus 2026.1.0 through 2026.1.5) lets any authenticated user holding only the ordinary low-privilege 'objects' DataObjects permission import a DataObject class definition whose field name breaks out of the generated 'protected $<name>;' property and injects attacker-controlled PHP into the class file Pimcore emits, executing arbitrary code as the web-server user when an object of that class is instantiated. The same unvalidated field name is concatenated into ALTER TABLE DDL, giving a parallel SQL-injection primitive. It is an incomplete-fix sibling of CVE-2026-5394, which hardened only the composite-index sink; the advisory (GHSA-9x44-4gxf-8c25) ships a working browser-console PoC, but there is no CISA KEV entry and no EPSS score in the provided data.
PHP Object Injection leading to remote code execution affects the Pimcore DXP/CMS (composer pimcore/pimcore) in versions 2026.1.0-2026.1.5 and all 12.3.x through 12.3.9, where the Hotspotimage DataObject field marshaller deserializes the persisted `*__hotspots` object-store column with no class allowlist. Any attacker able to write crafted PHP-serialized bytes into that column gains arbitrary object instantiation on the next object load, chainable to RCE via gadgets in Pimcore's own bundled dependencies (guzzlehttp/guzzle 7.11.0). A working proof-of-concept demonstrating attacker-controlled file write is published in the vendor advisory; publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided.
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in the aws:downloadContent plugin of amazon-ssm-agent before 3.3.4515.0 allows an authenticated attacker with a specifically scoped ssm:SendCommand IAM permission to write arbitrary files outside the intended download directory with root privileges on targeted managed instances. By directing the AWS-DownloadContent SSM document to retrieve from a controlled S3 source containing crafted object keys with path traversal sequences, an attacker can overwrite sensitive system files and escalate to full remote code execution as root. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root-privilege arbitrary write primitive represents a high-impact capability in compromised-credential scenarios.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Unbounded native-token (KLV) minting in the Klever blockchain node (klever-go < 1.7.19) lets any funded account inflate the ledger at will. Split-royalty percentages on a KDA asset are validated by summing per-entry values into a uint32 accumulator with no per-entry cap, so two entries near 0x80000000 wrap the sum below the 10000 (100%) limit and pass validation while each stored percentage stays astronomically large; at payout every split recipient is credited pool × hugePct / 10000 and the negative remainder is silently dropped, minting KLV out of thin air. A full working proof-of-concept is published in the GitHub Security Advisory (GHSA-cgc5-v3f2-8m2v); it is not in CISA KEV and no EPSS score was provided, but the flaw is exploitable on current mainnet and not gated by any fork flag.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent network segments. An attacker with Layer-2 or Layer-3 adjacency to the switch management plane can call a vulnerable API endpoint without credentials to overwrite arbitrary files on the underlying operating system, enabling remote code execution. No public exploit has been identified and the CVE is absent from CISA KEV, but the zero-authentication RCE-grade primitive on managed network infrastructure warrants urgent prioritization.
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper handling of malformed or truncated input received from an external authentication server. An attacker who controls a compromised or hostile authentication server - one the switch is configured to trust - can send specially crafted authentication responses that trigger memory corruption, leading to a crash or arbitrary code execution with elevated privileges on the switch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential for unauthenticated-from-the-network-device-perspective RCE on core network infrastructure elevates the operational urgency.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deployment privileges to execute arbitrary attacker-controlled logic on the Elasticsearch host node by supplying a crafted trained model artifact. The flaw stems from unsafe deserialization (CWE-502) of model artifact data during the ML inference loading process, granting the attacker a broader OS system-call surface than the ML subsystem is intended to expose. Elastic has released fixed versions 8.19.2, 9.4.5, and 9.5.1 via ESA-2026-114; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-level privileges to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates exploitation requires only local, low-privileged access with no user interaction, making this a meaningful threat in multi-tenant AI training environments where shared compute access is common. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to execute arbitrary code, tamper with data, and disclose sensitive information on affected systems. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where a crafted malicious payload supplied to the Bridge component triggers unsafe deserialization, granting the attacker full control over the vulnerable process. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS 7.8 score reflects the severity of successful exploitation.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS:3.1 score of 7.8 (High) with a local attack vector reflects that exploitation requires an existing foothold on the system, but the low privilege requirement and no user interaction needed make post-access exploitation straightforward. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to code execution, data tampering, and information disclosure when an attacker with local user access supplies a malicious serialized payload to the Bridge process. The local attack vector (AV:L) and low-privilege requirement (PR:L) place this vulnerability in the context of shared AI/ML training infrastructure - multi-tenant GPU clusters where lateral movement between users is the realistic threat model. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The CVSS 7.8 score (AV:L/PR:L) constrains exploitation to local contexts, but the high impact across all three CIA triad components reflects the severity of a successful exploit. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information on affected systems. Rooted in CWE-502, the flaw arises when the bridge component deserializes attacker-influenced data without adequate validation - a well-understood attack class that is particularly dangerous in distributed AI training infrastructure where serialized model state or inter-process messages transit between components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes AI training infrastructure to code execution, data tampering, and information disclosure by local low-privileged attackers. The vulnerability (CWE-502) resides in a bridge component of the Megatron-LM distributed training framework, used extensively in large-scale LLM training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 7.8 (High) reflects the severity of a full triad (C:H/I:H/A:H) impact if exploitation succeeds.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker holding standard user privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the exploitation path is local and low-privilege - no network exposure or administrator rights are required, making insider threats, shared-access HPC environments, and compromised user accounts the primary risk vectors. No public exploit code or active exploitation has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability (CWE-502) stems from the application accepting and processing serialized data without adequate validation, enabling crafted payloads to subvert normal deserialization logic. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad indicates a severe outcome if exploited by a user with existing local access.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with data, and disclose sensitive information. The CVSS vector (AV:L/AC:L/PR:L) indicates the vulnerability is exploitable locally without elevated privileges or user interaction, making it a significant risk in multi-tenant distributed AI training environments where multiple users share infrastructure. No public exploit or KEV listing is confirmed at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with application data, and exfiltrate sensitive information. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is bounded to local authenticated users or processes, but the full C:H/I:H/A:H impact triad makes successful exploitation highly damaging within that local scope. No public exploit has been identified at time of analysis, and no CISA KEV listing has been observed.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The local attack vector (AV:L) and low-privilege requirement (PR:L) limit the attack surface to users or processes with existing system access, yet the full C:H/I:H/A:H impact triad makes successful exploitation highly consequential. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the NVIDIA PSIRT has published a security advisory via their product-security GitHub repository.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and sensitive information disclosure on the affected system. The CVSS 7.8 base score reflects a local attack vector requiring only low-privilege access with no user interaction, producing full high-impact compromise across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the severity of potential impact warrants prompt patching in AI training environments.
Remote code execution in the FS-Poster WordPress plugin (versions up to and including 8.0.1) allows any authenticated user with subscriber-level access to execute arbitrary OS commands on the underlying web server. The vulnerability combines two weaknesses: the FFmpeg path parameter accepted by the plugin's REST API is passed unsanitized to PHP's exec() function (CWE-77 command injection), and the REST API endpoints responsible for this functionality lack proper authorization checks. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - a standard subscriber account - makes this accessible to any registered WordPress user.
Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges to execute arbitrary code at the operating system's highest privilege level. Affecting the full PowerStore T and Q product families (500T through 7000T confirmed via CPE), this CWE-829 flaw exploits the inclusion of functionality from an untrusted control sphere - meaning a low-privileged local user can influence a privileged execution path by supplying or manipulating untrusted code or configuration loaded by a higher-privileged process. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insecure installation directory permissions in Rockwell Automation ControlFLASH™ expose any local user account to arbitrary code execution by allowing write access to the product's installation folder for the Windows 'Everyone' group. An attacker with low-privileged local access can plant a malicious binary or DLL in the installation directory, which then executes at the permission level of whichever user subsequently launches ControlFLASH - potentially a privileged operator in an OT environment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allows an authenticated user with limited privileges to execute arbitrary code at root privilege level, achieving full appliance compromise. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms that exploitation requires only local authenticated access with low-level credentials and no user interaction, with the resulting code execution crossing a privilege boundary into a root context. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote code execution in Klemsan KIO (Klemsan Internet Objects) versions prior to v1.9 allows attackers to inject and execute arbitrary code against the network-facing application. The flaw, reported by TR-CERT (Turkey's national CSIRT), carries a CVSS 9.8 and requires no authentication or user interaction, giving full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial attack profile makes it a high-priority patch.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in LibreNMS's libvirt discovery module (VminfoLibvirt.php) enables any authenticated administrator to execute arbitrary OS commands on the discovery worker host by setting a crafted device hostname. Affected deployments span LibreNMS 23.10.0 through 26.3.x wherever the enable_libvirt option is explicitly set to true; the vendor-released fix is version 26.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is straightforward for any actor holding admin credentials.
Remote code execution in LibreNMS versions before 26.5.0 stems from the AboutController passing the snmpget configuration value directly to shell_exec() with a validation mechanism rendered ineffective by a PHP assignment operator bug. An authenticated administrator can update the snmpget setting to reference any executable already present on the server filesystem, then trigger code execution by visiting the /about endpoint, yielding full host compromise under web server privileges. No public exploit has been identified and this vulnerability is absent from CISA KEV; vendor-released patch 26.5.0 is available.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.12) allows remote attackers to remove any server-accessible file via path traversal in the move_folders function. Deleting critical files such as wp-config.php triggers WordPress's reinstallation routine, cascading directly to full remote code execution and site takeover. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero-authentication requirement on publicly visible forms make this a critical-priority remediation.
Arbitrary file upload in Master Addons for Elementor (all versions through 3.1.9) enables WordPress users with editor-level access to achieve remote code execution by exploiting a misconfigured AJAX authorization check. The upload_template_kit() handler incorrectly enforces only the upload_files capability-held by editors by default-rather than the manage_options capability required by every sibling handler, and performs no file-type filtering on content extracted from uploaded ZIP archives, allowing PHP webshells and other executable files to land on the server. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and clear code-level proof in the plugin SVN repository make this a high-priority remediation for any multi-user WordPress site running Elementor.
Unauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, versions up to and including 4.4.1, allows remote attackers to plant executable files on the server and potentially achieve remote code execution. The flaw stems from missing file-type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints, so no login is required. Reported by Wordfence and carrying a CVSS of 9.8; no public exploit identified at time of analysis.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Remote code execution in the Tenda A18 Wi-Fi router (firmware v15.13.07.09) arises from an unauthenticated buffer overflow in the fromSetCmdlineRun function, letting a remote attacker corrupt memory and run arbitrary code on the device. The CVSS 9.8 vector indicates network-reachable, no-authentication, no-interaction exploitation, and a public repository (github.com/momo8877847/Tenda-A18) appears to document the flaw, so publicly available exploit code likely exists. There is no CISA KEV listing and EPSS is low (0.30%), indicating no confirmed widespread active exploitation at this time.
Remote code execution in lllyasviel Fooocus 2.1.854 through 2.5.5 allows any user who can upload an image to execute arbitrary Python code on the hosting server. The vulnerability stems from the `get_list` function in `modules/meta_parser.py` passing a `styles` field extracted from image EXIF metadata directly to Python's `eval()` without sanitization or sandboxing. A detailed technical writeup exists at mrbruh.com/fooocus and the vulnerable code path is publicly visible in the repository; no confirmed active exploitation has been identified at time of analysis, and EPSS stands at 0.24% (15th percentile).
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
Remote code execution in OpenSearch's SQL plugin cursor pagination component allows authenticated users holding only basic read/search permissions to execute arbitrary code on the server by supplying a crafted serialized cursor parameter to the plugins/sql endpoint. Affecting all versions of self-hosted OpenSearch and Amazon OpenSearch Service up to the patched releases, this CWE-502 deserialization flaw is particularly dangerous because the low privilege bar means any cluster user - not just administrators - can trigger it. Vendor-released patches exist in OpenSearch 2.19.6 and 3.7.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.
Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. Because path arguments derive from LLM output, an indirect prompt injection attack embedded in developer-loaded content can steer writes to host-executed files and escalate to backend code execution; Agent Mode applies writes silently with no confirmation dialog. No public exploit code or CISA KEV listing exists at time of analysis, though the prompt-injection attack surface is realistic in cloud IDE deployments.
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. No public exploit has been identified at time of analysis, but the primitive directly enables remote code execution by overwriting application modules, static assets, cron jobs, or SSH authorized_keys files.
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests.
Arbitrary code execution is achievable in Readest versions prior to 0.11.16 by embedding a malicious EPUB file that bypasses the application's DOMPurify-based HTML sanitizer via a crafted srcdoc attribute on an iframe element. DOMPurify treats srcdoc as an opaque string and does not sanitize its contents, allowing a complete HTML document containing JavaScript to survive sanitization and execute inside an iframe configured with sandbox="allow-same-origin allow-scripts"; the executing script can then call parent.parent.__TAURI_INTERNALS__.invoke() to access the full Tauri IPC command surface and achieve OS-level arbitrary code execution. The attack requires only that a victim open a specially crafted EPUB file, and the payload can be rendered invisibly as a zero-size transparent iframe. No public exploit code has been identified at time of analysis; vendor-released patch version 0.11.16 is available.
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Pimcore (all releases up to 12.3.9, plus 2026.1.0 through 2026.1.5) lets any authenticated user holding only the ordinary low-privilege 'objects' DataObjects permission import a DataObject class definition whose field name breaks out of the generated 'protected $<name>;' property and injects attacker-controlled PHP into the class file Pimcore emits, executing arbitrary code as the web-server user when an object of that class is instantiated. The same unvalidated field name is concatenated into ALTER TABLE DDL, giving a parallel SQL-injection primitive. It is an incomplete-fix sibling of CVE-2026-5394, which hardened only the composite-index sink; the advisory (GHSA-9x44-4gxf-8c25) ships a working browser-console PoC, but there is no CISA KEV entry and no EPSS score in the provided data.
PHP Object Injection leading to remote code execution affects the Pimcore DXP/CMS (composer pimcore/pimcore) in versions 2026.1.0-2026.1.5 and all 12.3.x through 12.3.9, where the Hotspotimage DataObject field marshaller deserializes the persisted `*__hotspots` object-store column with no class allowlist. Any attacker able to write crafted PHP-serialized bytes into that column gains arbitrary object instantiation on the next object load, chainable to RCE via gadgets in Pimcore's own bundled dependencies (guzzlehttp/guzzle 7.11.0). A working proof-of-concept demonstrating attacker-controlled file write is published in the vendor advisory; publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided.
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in the aws:downloadContent plugin of amazon-ssm-agent before 3.3.4515.0 allows an authenticated attacker with a specifically scoped ssm:SendCommand IAM permission to write arbitrary files outside the intended download directory with root privileges on targeted managed instances. By directing the AWS-DownloadContent SSM document to retrieve from a controlled S3 source containing crafted object keys with path traversal sequences, an attacker can overwrite sensitive system files and escalate to full remote code execution as root. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root-privilege arbitrary write primitive represents a high-impact capability in compromised-credential scenarios.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Unbounded native-token (KLV) minting in the Klever blockchain node (klever-go < 1.7.19) lets any funded account inflate the ledger at will. Split-royalty percentages on a KDA asset are validated by summing per-entry values into a uint32 accumulator with no per-entry cap, so two entries near 0x80000000 wrap the sum below the 10000 (100%) limit and pass validation while each stored percentage stays astronomically large; at payout every split recipient is credited pool × hugePct / 10000 and the negative remainder is silently dropped, minting KLV out of thin air. A full working proof-of-concept is published in the GitHub Security Advisory (GHSA-cgc5-v3f2-8m2v); it is not in CISA KEV and no EPSS score was provided, but the flaw is exploitable on current mainnet and not gated by any fork flag.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.