Code Injection

Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.

Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.

Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.

Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.

Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.

Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.

Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious repository to exfiltrate arbitrary files outside the repository boundary through submodule metadata. When Repository::submodules() processes a worktree .gitmodules that is a symlink, std::fs::read() transparently follows it to an attacker-chosen target, and the resulting bytes are parsed as submodule configuration, exposing attacker-controlled name, path, and url values. A proof-of-concept is publicly confirmed in the GHSA advisory; no CISA KEV listing was present at time of analysis.

Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker-specified hosts by embedding bare carriage return characters in URLs supplied to gitoxide operations. Because gitoxide fails to sanitize these control characters before constructing credential helper protocol messages, injected fields override the legitimate host value, causing helpers to return stored credentials for a host the attacker controls rather than the intended repository host. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 2.3 reflects the high complexity, attack prerequisites, and user interaction requirements that substantially constrain real-world exploitability.

Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.

Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.

Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. No public exploit exists and no active exploitation is confirmed; EPSS stands at 0.18% (7th percentile), reflecting the niche attack surface.

In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() It's pointless to call WARN_ON() in case of an allocation failure in dev_change_net_namespace() and device_rename(), since it only leads to useless splats caused by deliberate fault injections, so avoid it. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

HTTP response splitting in cpp-httplib 0.49.0 allows an attacker who can influence chunked response trailer values to inject arbitrary headers into the HTTP response stream, potentially forging responses seen by downstream clients. The trailer-writing path in write_content_chunked() is the sole code path in the library that omits the CRLF validation applied by set_header() and every other header-writing function, meaning attacker-controlled CR/LF sequences pass directly to the socket. No public exploit code and no CISA KEV listing have been identified; the fix is confirmed in version 0.50.0 via upstream security advisory GHSA-2r2h-jc8w-w66c.

Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.

Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.

Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.

Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.

Sandbox escape in ServiceNow's Now Platform enables remote code execution within the platform environment, potentially granting attackers access beyond their intended permission level. Scored 8.7 under CVSS 4.0, the vulnerability is network-accessible with low complexity and high impacts on confidentiality, integrity, and availability of the vulnerable system. ServiceNow has deployed patches to hosted SaaS instances and provided updates to partners and self-hosted customers; no public exploit code and no known malicious exploitation have been identified at time of analysis.

Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.

NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.

RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.

Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Safe Import filter, which fails to mark the shareTemplate relation as dangerous. An attacker distributes a crafted export archive containing a malicious EJS template; when a user imports it and subsequently publishes the note, the public share renderer passes raw EJS content to ejs.render() in the server's Node.js process, executing attacker-controlled JavaScript with full access to the filesystem, network, and Node.js runtime. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed public advisory significantly lowers the barrier to exploit development.

Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-supplied plugin to run in the host process at import time. Because the plugin signature policy defaulted to WARN, an unsigned or unverifiable non-built-in plugin was compiled and executed before the runtime sandbox was installed, with only a bypassable AST denylist as a gate. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw yields full code execution as the invoking user once a malicious plugin is loaded.

Output-encoding text injection in jahlives openssl_encrypt before 1.4.9 lets an attacker forge the desktop GUI's irreversible-removal confirmation dialog. By embedding bidirectional-override and line-separator control characters in the recovery-slot identifier of a crafted encrypted file, an attacker can rewrite the warning text a victim sees, tricking them into approving destructive file-removal operations. No public exploit is identified at time of analysis, and the record is not in CISA KEV; the published 9.3 CVSS 4.0 rating appears inflated relative to the spoofing-only mechanism.

Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.

Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines by supplying email values containing CR/LF characters at the login endpoint. The vulnerability traces to a misuse of WTForms validation - the code constructed a validator object via Email(email) without invoking it, leaving attacker-controlled input unsanitized before it was interpolated into both the standard warning logger and the custom audit logger via Python f-strings. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially executable with a single HTTP request against any network-exposed deployment, and its impact falls directly on security logging integrity rather than application confidentiality or availability.

CSV injection in Dool through version 1.3.8 allows a local attacker who can control process names on a monitored host to plant malicious spreadsheet formulas into CSV exports. When an administrator or analyst opens the exported file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the injected formula executes in that application's context. Reported by CERT-PL and tracked as EUVD-2026-67128, the issue has an upstream fix via GitHub PR #117, though no officially tagged release containing the patch has been independently confirmed. No public exploit code or CISA KEV listing is identified at time of analysis.

Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.

Arbitrary code execution across entire WordPress multisite networks is possible in the Defender Security plugin (versions 5.0.0 through 6.1.x) due to a missing access control check on a network-wide setting. Any site-level administrator on a multisite installation - a role with significantly lower trust than a network/super administrator - can modify this setting to inject and execute code affecting all sites on the network. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), but SSVC rates technical impact as 'total', consistent with the network-wide RCE consequence if exploited by a malicious or compromised site admin.

Privilege escalation to network-wide remote code execution in the Smush WordPress plugin (versions 3.22.1 through 4.3.2) allows any authenticated single-site administrator on a WordPress multisite network to execute arbitrary code across all sites in that network. The flaw arises because the plugin's network-wide configuration interface fails to restrict access to network administrators only, permitting lower-privileged site admins to reach settings with cross-network impact. No public exploit has been identified and SSVC confirms no active exploitation, though the technical impact is rated 'total' given successful exploitation grants full control over the entire multisite infrastructure.

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.

Symlink following in Dell PowerProtect Cyber Recovery versions prior to 20.3 allows a local low-privileged attacker to redirect privileged file operations to attacker-controlled paths, resulting in script injection. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with elevated complexity - likely a race condition - but the integrity impact is rated High, meaning successful exploitation can alter critical scripts or configurations. No public exploit or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate for well-controlled environments.

Code injection in whichllm's run and snippet CLI commands allows a network-positioned attacker who controls a HuggingFace repository to achieve full arbitrary code execution on any victim's machine by publishing a repository containing a crafted GGUF filename with Python metacharacters. The script generation function in cli.py interpolates the HuggingFace Hub API siblings rfilename field directly into dynamically generated Python source without escaping, enabling a string-literal breakout that fires injected code before any model download occurs. No active exploitation is confirmed in CISA KEV and no public proof-of-concept is referenced; vendor-released patch v0.5.16 is available and directly remediates the root cause.

LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. No public exploit code or active exploitation has been identified at time of analysis, but the primitive (credential-bearing lateral identity escalation at the API gateway layer) is high-value in multi-tenant or zero-trust deployments.

Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.

Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.

LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.

Persistent root escalation in Admin By Request (ABR) on macOS allows a low-privileged local user to inject malicious entries into the sudoers file during an ABR privilege elevation session, achieving root access that outlasts the session itself. The flaw is tracked under advisory ABR-MAC-26-02 and was flagged by Singapore's Cyber Security Agency (CSA). No public exploit or CISA KEV listing is present at time of analysis, but the nature of the impact - permanent, session-independent privilege escalation - makes this high priority for any enterprise fleet running ABR on macOS.

Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding the author role or higher to invoke arbitrary PHP functions on the server by submitting a crafted display callback that bypasses the plugin's blocked-function comparison logic. Exploitation is limited to sites where restricted display-callback mode is active - the automatic default on installations first deployed on Pods versions predating 3.1 - meaning a large subset of long-running Pods deployments are in-scope. A public exploit exists per WPScan reporting, though EPSS at 0.21% (11th percentile) indicates low observed exploitation activity and no CISA KEV listing at time of analysis.

Code injection through CorvusSKK's embedded Lua scripting engine permits arbitrary code execution on Windows systems running versions prior to 3.3.4. Vendor release notes for the fixed version explicitly confirm that dangerous Lua engine features were disabled to address this vulnerability (CWE-94). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though CISA's SSVC framework rates the technical impact as total, reflecting full compromise of confidentiality, integrity, and availability on affected hosts.

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands

Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.

Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.

Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.

Code injection in NVIDIA NemoClaw for Linux via its migration command enables a local attacker holding low-level privileges to inject and execute arbitrary code under specific high-complexity conditions. All tracked versions are affected per the wildcard CPE (cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*), with potential impact spanning full confidentiality breach, data tampering, and denial of service. No public exploit code or CISA KEV listing has been identified at time of analysis.

Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.

Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.

Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.

SQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Metastore RPCs manipulate the generated WHERE clause so operations intended for one partition match additional rows in the same table. Because client-supplied partition names are concatenated into direct-SQL statements instead of bound as parameters, a crafted name containing a single quote can redirect reads, statistics updates, truncate/drop targets, and file-metadata cache operations to unintended partitions. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; the input assigns CVSS 9.8, but the vendor description constrains impact to partition targeting within referenceable tables rather than arbitrary cross-database access.

Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.

Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arbitrary PHP files to server-accessible paths and execute OS commands. The vulnerability exploits an incomplete command denylist: while Adminer restricts the ATTACH statement to limit direct file access, the VACUUM INTO command - which writes the current SQLite database to an arbitrary file path - was not blocked. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploit mechanism is straightforward for any authenticated user with SQLite access.

Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMTP headers and introduce attacker-controlled fields. All supported release lines are affected - 4.5.x, 4.6.x, 5.1.x, 5.2.x, and 5.3.x - when applications pass user-controlled data to Message::setHeaders() or Message::addHeaders(). An attacker who can influence those header values can inject arbitrary SMTP headers (e.g., Bcc, Reply-To, Content-Type), potentially hijacking email routing or silently copying messages; no public exploit identified at time of analysis.

Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .readonly lockfile, which is the guard that blocks write operations and, once removed, re-opens privileged setup/configuration paths that lead to arbitrary code execution (CWE-94). Any internet-reachable iTop instance below 3.2.3 is affected, and the flaw carries a CVSS 4.0 score of 9.4 with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial precondition (a single unauthenticated file-deletion request) makes weaponization realistic.

Incomplete destructive-command denylist in Continue CLI's headless and auto modes enables indirect prompt injection to trigger irreversible data destruction on the invoking user's filesystem. The sole safety gate, isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, blocks only eight path prefixes and misses /home, /root, /var, /opt, and /srv entirely; a secondary bypass exists because shell-quote reduces $HOME to an empty token during the path check while the shell correctly re-expands the variable at execution. Because the agent autonomously consumes untrusted content - fetched web pages, repository files, and issue text - a malicious payload planted in any such source can cause an unattended run to destroy user data; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization group mismatch that exposes Liquidsoap custom configuration fields through the profile-edit API endpoint, which enforces only the lower-privilege StationPermissions::Profile rather than the StationPermissions::Broadcasting required by the dedicated Liquidsoap configuration endpoint. An attacker injects arbitrary Liquidsoap script constructs - including process.run() or process.exec() OS command primitives - into fields that ConfigWriter::writeCustomConfigurationSection() emits verbatim into the generated .liq script, with execution triggered automatically by the built-in sync task whenever needs_restart is set. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack path is fully described in advisory GHSA-q8wg-3qg7-8pc7 and presents a straightforward escalation from station manager to host OS command execution.

Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket message dispatch in routes that bridge an HTTP consumer into the producer. Because the dispatch headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) use dotted names outside the filtered Camel namespace, the inherited HttpHeaderFilterStrategy admits them in both directions, so an attacker-supplied header overrides the recipient the route selected - suppressing a notification meant for one client or redirecting it to another client whose connection key the sender knows. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and it is not in CISA KEV, though the vendor rates it CVSS 9.8.

MIME header injection in Apache Camel's camel-mail MimeMultipart data format allows unauthenticated network senders to plant Camel-internal namespace headers onto the Camel Exchange when headersInline is set to true, potentially redirecting what downstream route components - such as camel-sql - execute. Versions 2.17.0 through 4.14.8, 4.15.0 through 4.18.3, and 4.19.0 through 4.21.x are affected across all release lines until the current fixes. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% and SSVC rates exploitation status as none, making this a patch-priority rather than emergency-response item for most organizations.

Hardware fault injection via voltage and clock glitching in the Microchip SAMA5D4 ARM Cortex-A5 microprocessor enables a physically proximate attacker to subvert security-critical operations such as secure boot, cryptographic key protection, and privilege enforcement. All versions of the SAMA5D4 are affected per the vendor's CPE entry, and Microchip self-reported this vulnerability. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the all-high impact scores in the CVSS 4.0 vector (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflect that successful exploitation grants total control over the affected system and any downstream components it secures.

CRLF injection in TIM Flow before 26.0.6 allows remote unauthenticated attackers to split HTTP responses by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, both of which are reflected into Set-Cookie response headers. Crafted requests targeting authenticated users can inject arbitrary response body content, enabling JavaScript execution in the victim's browser to steal session tokens or modify account credentials. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, though the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact once user interaction is obtained.

Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.

Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.

CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality impact and a scope change to the subsequent spreadsheet application system.

Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.

Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.

Eval injection in chirpmyradio CHIRP's Kenwood ITM driver allows arbitrary Python code execution when a user opens a specially crafted CSV file. The vulnerable `_clean_tmode` function in `drivers/kenwood_itm.py` passes untrusted TXSIG and RXSIG CSV column values directly to Python's built-in `eval()` without sanitization, confirmed by the upstream commit diff. A proof-of-concept repository exists publicly, though no active exploitation is confirmed in CISA KEV. All CHIRP builds prior to commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e are affected.

Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote unauthenticated attackers inject and execute arbitrary code by abusing the image element type, per its CVSS 4.0 base score of 10.0 (CWE-94). The flaw grants full compromise of the underlying Joomla host, with confidentiality, integrity, and availability impact on both the vulnerable application and subsequent systems. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of a heredoc terminator inside the 'calc' element and inject arbitrary PHP, made reachable because the onUpdateComment endpoint performs no access checks. Any remote actor able to reach the endpoint can trigger evaluation of attacker-controlled code, yielding full compromise of the Joomla application context (CWE-94). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attackers to run arbitrary PHP through the extension's PHP form element, which evaluates user-supplied code. Rated CVSS 10.0 with a network, no-privileges, no-interaction vector and full confidentiality/integrity/availability impact including scope change, this yields complete compromise of the underlying Joomla host. No public exploit identified at time of analysis, but the triviality of PHP-eval injection makes weaponization straightforward once details circulate.

Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting downloaded corpora and model packages without verifying their integrity, allowing an attacker positioned to tamper with the download (man-in-the-middle or DNS poisoning) to substitute malicious archive contents that are unpacked onto the victim host. All NLTK versions prior to 3.9.3 are affected (CWE-494). Reported by VulnCheck; a vendor patch exists, but no public exploit has been identified and it is not listed in CISA KEV.

Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.

Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.

Privilege boundary bypass in the Forminator Forms WordPress plugin (versions 1.40.0 through 1.57.0.5) enables any site-level administrator on a WordPress multisite network to modify a network-wide setting that triggers arbitrary code execution across all sites on the network, effectively allowing lateral escalation from single-site admin to full network compromise. This collapses the critical trust boundary between WordPress multisite's site administrator and network (super) administrator roles. No public exploit or CISA KEV listing exists at time of analysis, but the EPSS score of 0.18% (8th percentile) indicates low automated exploitation activity - not low potential impact.

Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. A complete working proof-of-concept is published in the GitHub advisory; publicly available exploit code exists, though the issue is not listed in CISA KEV and no active exploitation is confirmed.

Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls a JSONata expression break out of the evaluation context and run OS commands with the host process's privileges. The flaw stems from a bypassable hasOwnProperty check in environment.lookup that permits prototype-chain traversal to reach process.getBuiltinModule('child_process'). A working proof-of-concept is published in the vendor GHSA advisory, and vendor patches (1.8.8 and 2.2.1) are available; no CISA KEV listing has been identified.

Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls a JSONata expression to break out of the query engine and run OS commands via Node's child_process. The flaw stems from the lookup function reaching inherited prototype members (setters/getters, constructor, valueOf) to obtain process.getBuiltinModule and call execSync, executing code with the host process's privileges. Publicly available exploit code exists in the GHSA advisory, and CVSS 4.0 rates it 9.3 (Critical); there is no evidence of active exploitation.

Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Compile-time PHP code injection in the Phalcon (cphalcon) PHP framework's Volt template compiler (versions 5.15.0 and earlier) lets an attacker who can influence Volt template source achieve remote code execution. The Volt `join` filter emits the separator and array arguments as raw, unescaped bytes into the generated PHP, so quote-breaking content escapes the `join('…')` call and is written into the cached compiled template that is then require()'d at render time. Publicly available exploit code exists (a working PoC that runs shell_exec is published in the GHSA advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.

Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.

Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.

Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.

Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an authenticated user with session edit access to hijack shared/template agents and achieve command execution on the runner host. The PUT /sessions/{session_id}/agent endpoint enforces LEVEL_EDIT on the session but fails to reject a bound shared or template agent (whose agent.session_id is None), letting the attacker replace the shared agent bundle and inject a malicious stdio MCP server that later executes an attacker-controlled command. There is no public exploit identified at time of analysis, but a vendor patch (0.3.0) and the fixing commit are public.

Remote code execution in SPIP CMS versions prior to 4.4.21 lets unauthenticated attackers run arbitrary PHP/OS commands by abusing the template engine's X-Spip-Filtre header handling. A newline injected into a GET parameter forces analyse_resultat_skel() to treat an attacker-supplied header() call as a template filter chain, and a working Metasploit module (intval|_request|system) already achieves full command shell access. The CVE description claims in-the-wild exploitation in August 2026; publicly available exploit code exists, making this a top-priority patch.

Line-protocol injection and log spoofing in Spring Micrometer's StatsD and LoggingMeterRegistry components allow network-reachable attackers to forge arbitrary metrics and log entries by embedding newline characters into user-supplied strings that flow unvalidated into meter names, tag keys, or tag values. Affected deployments span the 1.9.x through 1.17.x release lines of io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core when the Datadog or Etsy StatsD flavor is active, or when LoggingMeterRegistry is in use. No public exploit has been identified at time of analysis, though the integrity-focused impact carries real risk for organizations whose incident-response workflows depend on Micrometer-sourced telemetry.

XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.

XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.

Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command execution via the ModuleManager's ExcuteLinux.exeCmd() method, which applies no input filtering or whitelist validation. Any deployment running InLong agents within the affected version range is exposed to OS-level command execution on the agent host system. Apache has released version 2.4.0 as the authoritative fix; no public exploit has been identified at time of analysis.