Code Injection

Code injection in TinyLLaVA Factory (TinyLLaVA_Factory) allows a remote attacker to execute arbitrary code with the privileges of the process that loads a model configuration, by supplying a crafted llm_model_name_or_path value that is handled by TinyLlavaConfig._load_text_config in tinyllava/model/configuration_tinyllava.py. Exploitation is not fully autonomous: user interaction is required (CVSS 4.0 UI:P / assessed CVSS 3.1 UI:R) because an operator must point the loader at the hostile path or model reference - an untouched default deployment is not affected - while authentication is not required per the vector (PR:N). Publicly available exploit code exists (the CVE reference set includes a public upstream issue/exploit at GitHub issue #212 and is flagged as 'exploit'), but there is no confirmation of active exploitation via CISA KEV, and because the project uses a rolling release with no response to the report, no vendor-patched version can be identified; the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) rates confidentiality, integrity and availability impact as High, well above the 2.1 score published by the reporting source.

Code injection in the AutoBackend model-loading path of iMoonLab yolov13 (all versions up to commit 73289949533efac82bb5f72ec19b746618656bd2) allows a local, low-privileged attacker to execute arbitrary code by supplying or tampering with a model artifact whose imgsz, names, or kpt_shape metadata is passed to eval() in ultralytics/nn/autobackend.py. Exploitation is not remote: the attacker must already be able to plant or modify a model file that the victim's pipeline later loads (for example an untrusted downloaded checkpoint, a shared model registry, or a writable model directory), and the CVSS 4.0 vector confirms local access with low privileges (AV:L/PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the upstream project was notified via GitHub issue #81 but has not responded, so no vendor-released patch exists as of this analysis.

Code injection in RAE, through its Config-Driven Model Instantiation component, allows a local attacker with low-level privileges to cause arbitrary Python object resolution and potentially code execution when a user loads or runs a crafted model configuration. Exploitation is constrained to local access with required user interaction and only low confidentiality, integrity, and availability impact, so despite the RCE and code-injection tags this is assessed as a low-priority, low-real-risk issue. No public exploit code has been identified at time of analysis, and no vendor-released patch has been identified.

Code injection in Linketic CityGaussian through version 2.0 allows a local, low-privileged attacker who can influence the cfg_args value processed by parse_cfg_args in internal/utils/common.py to execute code in a victim's context once that operator loads the tampered configuration. There is no remote attack surface and no public exploit code identified at time of analysis, and the maintainers have not responded to the reported issue (#206), so no vendor patch is available; our assessment rates this as a low-priority, low-real-risk flaw because exploitation requires local access plus passive user interaction and is confined to low confidentiality, integrity, and availability impact.

Code injection in ModelTC LightX2V through version 0.5.0 allows a local attacker to execute arbitrary code when a victim loads an attacker-controlled tokenizer/model via the cosmos3 runner's AutoTokenizer.from_pretrained call, by supplying a crafted auto_map value in the model configuration. Exploitation requires the user to load untrusted model content and runs only with the local user's existing privileges; there is no remote network attack surface. Publicly available exploit code exists, the project has not responded or released a patch, and the assessed real-world risk remains low because the attack is local and depends on the victim choosing to load a malicious model.

LDAP injection (CWE-90) in Frappe Framework allows unauthenticated remote attackers to manipulate directory queries by injecting crafted LDAP filter syntax through unsanitized endpoint parameters, with an impact limited to information disclosure (VC:L, VI:N, VA:N). The flaw affects Frappe releases before 14.99.2 and 15.x releases before 15.86.0, and is rated 6.3 under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N); exploitability is conditional because the instance must have LDAP integration actively configured, which is the attack requirement reflected by AT:P. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Code injection in IBM Maximo Application Suite's Location Service for Esri component (versions 9.0, 9.1, and 9.2) allows an authenticated attacker with high privileges (CVSS PR:H) and network access to supply an unsanitised container image configuration in the Kubernetes operator template, which the operator may then deploy. The issue is rated CVSS 6.5 Medium (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and can lead to high confidentiality and integrity impact, but requires privileged access to the MAS environment and affects an optional component. No public exploit identified at time of analysis, and no KEV or EPSS data indicates active exploitation.

Code injection through crafted MVG (Magick Vector Graphics) drawing files can reach ImageMagick's PostScript rendering path, where an attacker-controlled font name is embedded into a generated PostScript stream and handed to a Ghostscript delegate. The flaw affects ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32 and is reachable by unauthenticated remote attackers (PR:N, UI:N) who can cause a malicious MVG file to be decoded, but only when ImageMagick is built with a PostScript renderer and the text-rendering call actually takes the RenderPostscript path rather than FreeType (attack requirements: present). Resulting impact is limited to integrity and availability of the conversion process (no confidentiality loss); there is no public exploit identified at time of analysis, and the vendor rates the issue medium at CVSS 4.0 base 6.3, so it is a moderate, conditional priority rather than an emergency.

Terminal-output injection in the Elixir Hex package manager (all versions from 0.0.1 up to, but not including, 2.5.2) allows a malicious package publisher or a hostile repository server to smuggle ANSI escape sequences and Unicode bidirectional overrides into what Mix prints, forging displayed URLs, package descriptions and suggested commands, hiding real output, or writing attacker-chosen text to the victim's clipboard via OSC 52. Exploitation is unauthenticated (CVSS:4.0 PR:N) but requires the victim to run one of the affected interactive Mix tasks - such as mix hex.info, mix hex.package search, mix hex.search, mix hex.user or mix hex.policy - against data the attacker controls, and it depends on the victim's terminal emulator interpreting the injected sequences; impact is confined to output forgery and clipboard manipulation, with no code execution, file access or privilege gain, and the assessed severity is low (CVSS 4.0 base 2.3). No public exploit code was identified at time of analysis and there is no indication of active exploitation; the vendor has released a fix in Hex 2.5.2.

CSV formula injection in Thelia (before 3.1.2 and 3.2.0 through 3.2.0, fixed in 3.2.1) lets unauthenticated visitors plant spreadsheet formulas in registration, checkout, and newsletter fields that are later exported verbatim by CSVSerializer and executed when an administrator opens the file in Excel, LibreOffice Calc, or Google Sheets. The attacker never touches the Thelia server: impact is limited to the exporting administrator's workstation, and exploitation depends on an admin both performing the export and opening the resulting file (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 2.3). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the low EPSS-style risk profile is consistent with the assessed vector - this is a genuinely low-priority issue that vendor patches already resolve.

Authenticated template injection in Thelia versions up to and including 2.6.1 lets a logged-in user with access to Smarty template-name handling point the engine at an arbitrary absolute filesystem path, which can result in server-side template injection and, in some deployments, remote code execution. The flaw is post-authentication (CVSS vector PR:L) and the RCE outcome is conditional: it depends on Smarty loading/compiling the referenced file without an effective security policy and on a suitable file existing at the referenced path, so impact is not guaranteed on every installation. No public exploit code and no active exploitation were identified at time of analysis (EPSS 0.40%, ~32nd percentile), and no vendor-released fixed version was confirmed from the provided references (CERT/CC advisory VU#162329; CVE-2026-103537).

Code injection in Zen Cart through 2.2.2 lets an attacker who already has privileged admin/database write access to the `configuration` table supply a malicious `use_function` value that `zen_call_function()` in `admin/includes/functions/general.php` then invokes as PHP, achieving limited code execution (low confidentiality, integrity and availability impact). The attack is network-reachable but rated highly complex and requires high privileges (CVSS:4.0 PR:H / assessed CVSS:3.1 PR:H, AC:H, base score 2.1), because the vendor states the only ways to control `use_function`/`configuration_value` are the admin SQL Patch tool (raw SQL execution) or a separate pre-existing SQL injection - normal unprivileged input does not reach it. Publicly available exploit code exists per the disclosed proof-of-concept, but there is no evidence of confirmed active exploitation and the vendor explicitly rejects the issue as independently exploitable.

Code injection in the PythonTools component of Agno (agno-agi/agno) through version 3.0.6 lets an attacker who can influence the 'code' argument of run_python_code execute arbitrary Python in the host process. The CVSS v4.0 vector supplied with the record is low (2.1, PR:L), and our independent assessment confirms that a low-privilege foothold is required - realistic paths are an authorized-but-malicious user of an agent that has PythonTools enabled, or indirect prompt injection steering the model into calling the tool with attacker-chosen code; PythonTools is an optional agent tool rather than a default network-exposed endpoint. Publicly available exploit code exists (a third-party advisory and PoC repository are linked), and the vendor was notified via a GitHub issue but has not responded, so no vendor patch is confirmed; despite the RCE framing, the signals point to a low real-world priority.

Samsung Internet versions prior to 30.0.5.24 are susceptible to script injection due to improper input validation, allowing unauthenticated remote attackers to compromise confidentiality of user data (CVSS 4.0 base 6.0). Exploitation requires passive user interaction (e.g., visiting a malicious page), and the assessed impact is limited to confidentiality (VC:H, VI:N, VA:N). The flaw was confirmed by Samsung's product security team; no public exploit has been identified at time of analysis.

Predictable TCP initial sequence numbers in Zephyr RTOS allow off-path attackers to defeat RFC 6528 spoofing protection and perform blind TCP connection spoofing, data injection, or connection resets, but only on devices where the cryptographic random source fails exactly when the ISN secret key is first generated at boot. The flaw is a discarded return value from sys_csrand_get() that latches the 'key already generated' guard even on failure, leaving a 128-bit secret as all zeros for the entire boot; exploitation additionally requires the attacker to observe at least one ISN off-path and the spoofed peer to trust source addresses, and no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8), reflecting an unauthenticated remote issue whose high attack complexity and conditional preconditions keep it moderate rather than critical, and the signals converge on a conditional, moderate-severity issue rather than a top priority.

Unauthenticated content injection in the Kutethemes 'Boutique' WordPress theme at version 2.3.3 and earlier lets remote attackers reach a shortcode-handling path and inject arbitrary content into affected sites. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any internet-facing WordPress installation with this commercial theme active is exposed by default; the attack surface is bounded to sites running this specific theme. Impact is assessed as limited content injection and partial data exposure (C:L/I:L/A:N) rather than server compromise, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in unpatched, theme-deployed sites.

Sandbox escape in open-multi-agent's @open-multi-agent/core 1.5.0 through 1.21.2 lets an attacker write attacker-influenced files anywhere the agent process has write permission by planting a dangling symlink inside the agent workspace and using prompt injection to steer the file_write built-in tool toward that symlink path. Impact is integrity-only in the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), and exploitation is gated on two preconditions combining: attacker-controlled symlink placement in the workspace plus prompt-injection influence over the agent, so this is a genuine but moderate-priority issue rather than a remote, default-configuration exploit. No public exploit code or active exploitation was identified at time of analysis, and the flaw requires local reachability with no privileges required per the assessed vector.

CSV formula injection in OpenPanel through 2.3.0 lets unauthenticated remote attackers inject spreadsheet formulas into cohort-member exports by submitting tracking events to the /track endpoint with crafted profile IDs (for example =HYPERLINK(...)) that satisfy an existing cohort's membership criteria. The payload only materializes if an OpenPanel operator later exports that cohort to CSV and opens the file in a spreadsheet client that evaluates formulas and permits the resulting external fetch, so realized impact is limited to low-severity adjacent-cell data disclosure (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). No public exploit code was identified at time of analysis and CVE-2026-108579 is not in CISA KEV; all signals point to a low real-world priority.

Improper neutralization of CRLF sequences in the Federated Authentication (FA) configuration of Brocade Fabric OS before 10.0.1 lets an authenticated administrator - or anyone able to supply a crafted FA configuration file that an operator imports - inject arbitrary web server directives through the Identity Provider (IdP) issuer parameter, which can prevent the web management daemon from starting (denial of service) or alter web server security controls. Exploitation is heavily constrained: the target must run a vulnerable Fabric OS release with FA actually in use, the attacker needs administrative privilege (CVSS PR:H) and adjacent-network access to the management interface (AV:A), with no user interaction otherwise required, and no public exploit code has been identified at time of analysis. This is a medium-severity, operator-dependent flaw rather than a top-priority emergency, and it is not confirmed actively exploited (CISA KEV).

Cross-origin cookie injection in AsyncHttpClient (AHC) Java library before 3.0.13 and 2.16.1 allows an attacker-controlled host beneath a registry-level public suffix such as co.uk to set a cookie for that suffix itself, which the shared ThreadSafeCookieStore then replays to unrelated hosts under the same suffix. The failure lies in ThreadSafeCookieStore, which performs domain matching but never applies the RFC 6265 Section 5.3 step 5 rule that rejects a Domain attribute naming a public suffix; the practical result is that session-relevant cookie values can be injected or overwritten across origins sharing that registry. Impact is integrity-only (I:H, no confidentiality or availability loss) and exploitation is scenario-dependent, requiring one cookie store shared across requests to both an attacker host and a victim host under the same suffix, which is why the assessed vector carries High attack complexity and a present Attack Requirement. No public exploit code or active exploitation was identified at time of analysis; fixes are released as version 3.0.13 and 2.16.1.

Authenticated log injection in Splunk Enterprise allows a user whose role carries the read_o11y_content capability to forge entries in the app log through the REST API, but only on deployments where the Splunk App for Splunk O11y Cloud is present and enabled. The root cause is CWE-117 - the app writes user-supplied SignalFlow content into the app log without neutralizing it - producing a low-impact integrity-only result (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with no confidentiality or availability effect, and no public exploit identified at time of analysis. Only Splunk Enterprise releases below 10.4.3, 10.2.7 and 10.0.10 are affected; 9.4.x is explicitly not affected.

Code injection in ImageMagick's PostScript and PDF output coders allows attacker-controlled text such as an image label to be written into generated PostScript/PDF output without escaping, so an injected PostScript operator can execute when that output is later rendered by an interpreter such as Ghostscript. Affected are ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56; exploitation is not confirmed actively exploited (CISA KEV) and no public exploit code is identified at time of analysis. The assessed severity is medium (independent CVSS 5.3 / evaluated vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is remote and requires no authentication, but exploitation demands a high-complexity chain in which a conversion writes a label out through the ps, ps2, ps3, or pdf coder and the resulting file is subsequently rendered.

Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-field values that are inserted into the HTML body of administrator and submitter notification emails without sanitization or escaping, allowing arbitrary markup to be rendered in the recipient's mail client. Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and is confined to email-rendered content - spoofing or phishing-style content rather than server-side execution - because the injected markup takes effect only when a recipient opens the notification. Publicly available exploit code exists (WPScan published the finding and a proof-of-concept reference), and no public exploit identified at time of analysis would be misleading here; there is no CISA KEV listing, so this is treated as a moderate-priority, non-actively-exploited issue.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

LDAP query injection in Arista CloudVision CUE (versions 2021.2.0 through 2026.2.0) lets an unauthenticated network attacker manipulate directory-service queries when the appliance is configured to authenticate against an external LDAP directory. Exploitation is gated by high attack complexity (CVSS AC:H), meaning the attacker must land on specific conditions largely outside their control - such as a particular directory schema or query-construction path - and the resulting impact is confined to the confidentiality of the downstream directory service (scope-changed C:H), with no direct confidentiality, integrity, or availability effect on CloudVision CUE itself. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS data was not provided, and the issue should be treated as a moderate-priority hardening item rather than an emergency.

Code injection in the Extensions subsystem of Google Chrome prior to 155.0.8059.39 lets a remote attacker spoof browser UI elements once a victim has been socially engineered into installing a crafted extension. Exploitation is gated behind mandatory user interaction (UI:R) and the deliberate addition of attacker-controlled extension code, so exposure is limited to users who sideload or approve an untrusted extension rather than to any default, clean Chrome install; there is no public exploit identified at time of analysis. Google has shipped a fix in the Chrome 155.0.8059.39 stable channel release, and the issue is rated Medium at 5.4 with only low confidentiality and low availability impact.

RediSearch query injection in @langchain/redis (the Redis vector store provider for LangChain.js) prior to version 1.1.1 lets a low-privileged attacker who can influence the values passed into structured RediSearch TAG or TEXT filters inject unescaped RediSearch syntax and thereby broaden or otherwise alter the generated search query. Where an application uses such a filter as a tenant or document-access boundary, the manipulated query can return indexed documents outside the attacker's intended scope, resulting in limited confidentiality impact (read/exposure only, no write, code execution, or availability effect). Exploitation is highly conditional: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.0 base 2.3), no public exploit code has been identified, and no confirmed active exploitation (CISA KEV) or EPSS signal was provided, so overall risk is low; the fix is available in @langchain/redis 1.1.1.

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent.

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnic_tx_map() skips the doorbell write, and the completion request, for every packet handed to it with xmit_more set, counting on the packet which ends the burst to publish them all. When that packet is dropped instead - skb_put_padto(), skb_cow_head() or a DMA mapping failure - nothing rings. The descriptors of the preceding packets stay invisible to the HW until the next transmit on that queue, which for a burst-then-idle workload may never come. Remember the meta descriptor of the last packet left without a doorbell and flush it from the error paths. The completion request has to be set on that descriptor rather than simply writing the tail, otherwise the HW would transmit the packets but never report a head, and the ring would fill up and stall for good. This is very similar to Joe's recent series of fixes for bnxt. Not seen in real life, reproduced under QEMU with failure injection.

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP, keeps the loop spinning forever on one CPU. Break out when the next NDP offset is not larger than the current one. Verified in a QEMU guest with a fault injector feeding the driver's receive callback an NTB whose single NDP points at itself: the unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100% and the thread never returns. With this check the loop terminates within one iteration. Changes in v2: move the non-increasing check to the wNextNdpIndex retrieval site, as suggested by Loic Poulain, instead of tracking the previous offset in a separate variable.

Moby BuildKit (all versions in the affected range per the unbounded CPE cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*) can be made to run its cleanup routine against a modified CA bundle when proxy networking with CA injection is enabled, a time-of-check-to-time-of-use (CWE-367) race that causes cleanup to block, operate outside the build rootfs, or fail without failing the build. The attacker must be able to submit or execute a build on the builder (local, low-privilege access; PR:L) and must first change the build's injected CA bundle before cleanup runs; the non-default proxy-with-CA-injection mode sharply narrows exposed deployments, and the dominant consequence is availability and integrity of the cleanup operation (VA:H, VI:L) rather than confidentiality loss. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; vendor-released patch v0.33.1 is available.

Argument injection in the OpenPrinting CUPS mailto notifier can let a low-privileged user or authorized subscription creator influence the configured sendmail command when CUPS email notifications are enabled. Exploitation requires a crafted notify-recipient-uri beginning with '-' and an MTA that interprets it as an option; the assessed risk is low because email notification is non-default, CUPS is typically local-only (AV:L), complexity is high, and impact is limited to low confidentiality and integrity in the assessed vector. No public exploit identified at time of analysis. Affected deployments include upstream OpenPrinting CUPS and CUPS in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images.

Code injection in TallCMS up to and including 4.8.0 lets an authenticated admin-panel user who is not a super admin upload and install a plugin ZIP containing arbitrary PHP that is then autoloaded and executed by the application. Exploitation requires valid credentials at a privilege level below super_admin plus the plugin-upload capability to be enabled (the uploadsAllowed() config flag), so it is not reachable anonymously, but publicly available exploit code exists per the referenced GitHub issue and no CISA KEV entry indicates confirmed active exploitation. Note that the vendor/CVSS 4.0 score (5.3, low confidentiality/integrity/availability impact) substantially understates the issue relative to the independent assessment (CVSS 3.1 8.8, C:H/I:H/A:H), which treats the arbitrary-PHP execution as full compromise of the installation; the signals across sources are mixed and partly contradictory.

Remote code execution in Django Haystack's Elasticsearch backend affects versions up to and including 3.3.0, where an attacker-controlled string reaching the result-deserialization path is passed to `eval()` inside `_to_python()` and executed in the Django application process. Exploitation is conditional rather than blanket: it requires the Elasticsearch backend, at least one `SearchField` declared with an `index_fieldname` alias that differs from its logical field name, and the ability to get a malicious payload indexed into that aliased field and returned by a subsequent search - a second-order/stored injection rather than a direct request-driven one. Publicly available exploit code exists (a GHSA advisory with source-level walkthrough was published alongside the fix), and the input CVSS vector marks PR:H, so under that vector exploitation is treated as authenticated; there is no CISA KEV entry indicating confirmed active exploitation. The vulnerability is patched in 3.4.0, and the reporting signals conflict sharply and must be weighed carefully: VulDB's CVSS 4.0 base of 2.0 contrasts with the upstream advisory's CVSS 3.1 base of 8.5, reflecting the gap between the mild vector assumptions and the full RCE impact when the alias configuration is present.

SNMP trap injection against Zabbix's bundled Perl trap receiver script allows a party that can deliver traps accepted by that receiver to forge a record against a different host, corrupting the integrity of collected monitoring data with no confidentiality or availability impact. The root cause is a failure to neutralize the ZBXTRAP record delimiter in CWE-143 terms, and only deployments that ingest traps through the shipped Perl script (typically wired into snmptrapd) are exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates this as a moderate, low-priority integrity issue (CVSS 3.1 5.3) rather than an urgent threat.

Unsafe reflection (CWE-470) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin through version 2.0.22 lets a low-privileged authenticated account steer which class or code the plugin loads, exposing information that account should not be able to read. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) confirms the attacker must hold a valid WordPress login with at least low privileges, that no user interaction is required, and that impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, so this is a moderate-severity authenticated information-disclosure issue rather than an emergency, though it is worth remediating because the authentication bar is low on multi-author and membership sites.

Authenticated code injection in osCommerce 2.x through 2.3.4.1 allows an attacker who already holds administrator credentials to manipulate the 'module' argument processed by the include logic in admin/newsletters.php (Newsletter Management component), causing attacker-influenced code to be injected into the PHP execution path. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, only users with valid admin-level access to the backend can reach the vulnerable code, and the realistic impact is limited to low confidentiality, integrity and availability effects rather than full server takeover. Publicly available exploit code exists per the CVSS 4.0 E:P metric and the vendor disclosure, but there is no confirmed active exploitation (no CISA KEV listing), and the project has not responded to the issue report, so no fixed release is currently published.

Code injection in osCommerce2 (versions through 2.3.4.1) allows an attacker who already holds high backend privileges - a store administrator able to edit the payment configuration - to manipulate the MODULE_PAYMENT_INSTALLED parameter and have attacker-controlled content pulled into a PHP include() in includes/classes/payment.php. Because the CVSS 4.0 vector carries PR:H and UI:P, the vulnerable payment flow is not reachable by an anonymous shopper and requires at least passive user interaction, which keeps this a medium-severity, post-authentication issue (base score 4.8) rather than a pre-auth remote takeover. Publicly available exploit code exists, and there is no confirmed upstream fix because the project has not responded to the reporter's early notification; no EPSS or CISA KEV signal is available for this CVE.

OpenAM versions before 16.1.3 allow unauthenticated attackers to inject arbitrary content into notification emails sent by the forgotPassword and register self-service endpoints (/json/{realm}/users). By supplying subject and message fields, an attacker can craft phishing messages that appear to originate from the organization's configured From address, or misuse the register action to relay email to arbitrary recipients. No public exploit code has been identified at the time of analysis, and the vendor has released version 16.1.3 to address the improper input validation (CWE-20).

Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.

Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.

Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.

Local argument injection in gotop 3.0.0 allows an attacker who already holds an account and shell on the same host to terminate every process owned by a targeted user, because the tool forwards an attacker-controlled process name directly to pkill and the name is parsed as a command-line option. Exploitation depends on the victim actively selecting the maliciously named process in gotop's process-kill feature (UI:R, local only), so the impact is confined to availability on shared multi-user systems. The project is no longer actively supported and CERT-PL reports the issue has not been fixed; no public exploit identified at time of analysis, and the independent assessment rates it low severity (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, CWE-88).

Untrusted code execution in the NetBox devicetype-library CI pipeline lets any contributor who can open a pull request run arbitrary commands on the repository's GitHub Actions runner before a maintainer ever reviews the change. Because validation.yml triggers on the pull_request event and consumes three PR-editable files (requirements.txt for pip install, the pre-commit hook configs, and .gitmodules for submodule checkout), an unauthenticated remote attacker with no repository write access can inject code that executes automatically with no user interaction; impact is capped at low confidentiality and integrity loss because fork PRs run with a read-only token and no secrets. Only versions prior to commit f41fc1e are affected, and no public exploit code identified at time of analysis.

Arbitrary file creation, overwrite, and truncation outside the intended workspace is possible on hosts running AWS security-agent-mcp-server before version 0.2.0, because the diff scan operation injects an attacker-controlled 'reference' value as extra command arguments. The flaw is local (AV:L) and requires the operator or AI agent to run the diff scan against attacker-influenced input (UI:R), but no authentication is needed once that operation is invoked (PR:N) and the impact crosses a security boundary (S:C), yielding high integrity and availability impact with no confidentiality loss (CVSS 8.2, High). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is version 0.2.0.

Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the application, potentially causing injection attacks or errors in downstream processing systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible, low-complexity, unauthenticated access, but exploitation requires user interaction, so an attacker cannot complete the attack alone. Impact is limited to low integrity with no confidentiality or availability effect, making this a moderate-to-low real-world priority; no public exploit identified at time of analysis.

Argument injection in the AWS EFS CSI Driver v3.1.0 through v3.4.2 allows an authenticated Kubernetes user or service account that already holds PersistentVolume creation permissions to smuggle extra mount options into an EFS mount by embedding comma-separated tokens in a PersistentVolume's mounttargetipmap volumeAttribute. Because the driver fails to neutralize the argument delimiter, injected tokens are parsed as additional mount flags, giving high confidentiality and integrity impact along the container storage path, while availability is not affected under the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (6.5). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped v3.5.0 to remove the condition.

Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.

Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-class) functions in Toptech TMS7 and Toptech TopHat terminal-management deployments, achieving limited code injection with Low confidentiality and integrity impact and no availability effect. The issue is scored 2.1 under CVSS 4.0 and was independently assessed as AV:A/AC:H/PR:L/UI:N with Low C/I, so it sits firmly in the low-priority tier despite its CWE-95 code-injection classification: it is not reachable from the internet by default, requires valid low-privilege credentials, and demands high attack complexity to land the crafted input on the evaluator. No public exploit code has been identified at time of analysis, the issue does not appear on CISA KEV, and no EPSS score was supplied in the source data, so exploitation is not confirmed to be active.

Query injection in the Airflow Google provider allows an attacker who can write to a source GCS bucket to steer which Google Drive file or folder is resolved during wildcard gcs_to_gdrive transfers, potentially redirecting uploads into an attacker-named folder or causing a download to return an attacker-placed file. This affects deployments running apache-airflow-providers-google before 22.6.0 that pass externally-sourced names to the Drive hook; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, which indicates low privileges are required-specifically the ability to create or name objects in the source bucket-while no Airflow authentication or user interaction is needed. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, no EPSS score was provided, and Apache rates the issue as low severity.

LDAP injection in Eleveo Call Recording Software 9.7.0 lets an authenticated, low-privileged user manipulate the Username argument of the User Management endpoint /callrec/userAddAction.do so that unsanitized input is incorporated into an LDAP directory query, resulting in low-impact disclosure of directory information. The attack is reachable remotely and requires no user interaction, but it is gated behind a valid low-privilege account and a deployment whose user management is backed by an LDAP directory. Publicly available exploit code exists, including a proof-of-concept linked from the VulDB disclosure, and the vendor was contacted but did not respond; EPSS and CISA KEV do not indicate confirmed active exploitation. With a CVSS 5.3 base score and confidentiality-only impact (C:L, no integrity or availability effect), this is a high-CVSS-appearance-but-modest-real-risk issue.

Authenticated users of Langflow instances prior to 1.12.0 can convert crafted component input options into arbitrary Python code execution because schema.py interpolates those options into a Literal type string that is handed directly to eval() without safe-evaluation controls (CWE-95). The sink fires when an affected component is turned into a LangChain tool via ComponentToolkit.get_tools(), which also occurs during custom-component saves through the API, so an attacker must already hold a valid account able to create or save components (PR:L in the assessed CVSS 3.1 vector; PR:H in the vendor's CVSS 4.0 vector) and must satisfy the high-complexity object-crafting and interpolation path (AC:H/AT:P). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; practical marginal risk is limited because the privileges required to reach the sink typically already allow legitimate Python execution through Langflow's custom-component feature.

Unauthenticated shortcode injection in WPForms Lite (versions 1.5.0.1 through 2.0.2) lets remote attackers execute arbitrary registered WordPress shortcodes by submitting form field values that the plugin echoes back into the rendered form without stripping shortcode delimiters. Publicly available exploit code exists via the WPScan advisory, and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium) confirms low-complexity, no-user-interaction exploitation. Impact is bounded by the shortcodes present on the target; successful exploitation can disclose attachment details of non-public posts and modify rendered form output, but does not by itself grant full remote code execution.

Terminal escape sequence injection in the onefetch CLI (through version 2.28.1) lets an attacker who controls a repository's project manifest metadata manipulate the victim's terminal when the victim runs onefetch against that repository. Because the tool writes manifest name and version field values directly to the terminal without neutralizing control characters, embedded ANSI/OSC sequences can rewrite window titles, hide or spoof displayed text, or trigger emulator-specific behavior; the concrete effect depends on the terminal emulator in use. There is no public exploit code identified at time of analysis and no confirmed active exploitation, CVSS is 4.8, and the assessed real-world risk is low-to-medium: the attacker must first get the victim to inspect a repository containing poisoned manifest fields, and exploitation yields display manipulation rather than code execution within onefetch itself.

Spreadsheet formula injection in OpenClaw's attendance CSV export allows an attacker who controls a participant display name to embed formula payloads (cells beginning with =, +, -, @, tab or carriage return) that execute in the spreadsheet of anyone who opens the exported file in a formula-enabled application such as Excel or LibreOffice Calc, affecting all versions before 2026.8.1. Exploitation is unauthenticated per the supplied vectors (PR:N in both CVSS:4.0 and the assessed CVSS:3.1), but it is heavily gated: the attendance export must be generated, the attacker must control a name included in it, and a victim must open the CSV and permit formula evaluation. Payloads run client-side on the viewer's machine rather than on the OpenClaw host, no public exploit code has been identified at time of analysis, and no impact occurs if exports are never opened in a formula-processing tool.

An authenticated user with a valid CSRF token can read Django password hashes, request metadata, and related-user attributes from Horilla HR/CRM mail-preview functionality in versions 1.0.0 through pre-1.6.0 and prior to 2.0.0. The get_mail_preview handlers at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview render a user-supplied mail body as a Django template while the full request object sits in the template context, so template attribute traversal such as request.user.password or request.META exposes the underlying data; the Django template sandbox limits this to information disclosure rather than code execution. Exploitation requires only a low-privileged authenticated session with a CSRF token (no public exploit identified at time of analysis), and the confidentiality impact is high because the leaked password hashes can be attacked offline or used to identify accounts for follow-on compromise; vendor fixes ship in 1.6.0 and 2.0.0.

LDAP filter bypass in GLPI versions prior to 10.0.26 and 11.0.8 allows an authenticated hotliner or technician with access to the user-import feature to inject crafted criteria and read LDAP objects that the configured default filter was intended to exclude. The issue is a limited information-disclosure flaw: it does not grant write access, code execution, or access to GLPI's own data, and exploitation requires an existing LDAP integration with a configured default filter. No public exploit code was identified at time of analysis, and NVD rates it CVSS 4.6.

Session-termination vulnerability in Zammad helpdesk/customer-support deployments running versions prior to 7.0.2: the HTML sanitizer fails to strip same-origin Zammad API paths from <img> src and srcset attributes, so crafted ticket HTML can reference endpoints such as /api/v1/signout, /api/v1/sessions/switch/N, /api/v1/sessions/switch_back, or /api/v1/getting_started/auto_wizard/<token>, causing the viewing agent's session to be terminated or switched when the ticket is rendered. The attack is unauthenticated per the CVSS 4.0 vector (PR:N) and can be delivered via inbound-email-created tickets, but it requires a second user to view the crafted ticket (UI:P) and is bounded to session availability with no data disclosure or code execution. CVSS 4.0 scores it 5.3 (MEDIUM) and an independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor released 7.0.2 with an allowlist restricting /api/ image sources to attachment endpoints.

Mass assignment in Bludit CMS 3.22.0 and earlier lets an authenticated user holding the low-privileged Author role tamper with page metadata that should be reserved for administrators. Because Pages::edit() in bl-kernel/pages.class.php writes every field listed in dbFields without per-field authorization, an Author can slip extra parameters such as 'type' and 'username' into an ordinary content-save request to convert a page into a static, site-wide navigation entry or reassign ownership of a page to an arbitrary account. The issue only matters on installations that hand Author-level accounts to untrusted users; it yields integrity-only impact with no confidentiality or availability effect and no code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis (CVE-2026-93364, reported by VulnCheck, CWE-915).

LDAP distinguished-name injection in the RabbitMQ rabbitmq_auth_backend_ldap plugin allows a remote, unauthenticated caller to manipulate the DN used for an LDAP bind by supplying a crafted username, because the ${username} placeholder is substituted into user_dn_pattern without RFC 4514 escaping. Impact is limited to integrity (CVSS:4.0 6.3 / CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) and exploitation is narrowly conditioned: the plugin must be enabled, user_dn_pattern must actually contain ${username}, the injected suffix must resolve to a useful directory entry, and the attacker must hold a password valid for that resulting DN. No public exploit code and no confirmed active exploitation were identified at time of analysis; upstream fix commits and patched releases exist, though the advisory's first-fixed version metadata is internally inconsistent for several maintenance lines.

Code injection in the Zhonglun CloudPos desktop client (versions up to and including 3.0.1.76) allows remote attackers to inject and execute code through the 'url' argument of the OpenLocalBrowser function in the CefSharp-based JSBridge component (ZlPos/ZlPos/Bizlogic/JSBridge.cs), with the vendor's own CVE record pointing to RCE as the practical outcome. Publicly available exploit code exists - a proof-of-concept document titled 'CloudPos.CefSharp.RCE' is linked from the disclosure - so the attack is both demonstrable and reproducible. The vendor was contacted but did not respond, so no vendor-released patch has been identified; exploitation requires the affected desktop client to process an attacker-influenced url (the independent assessment rates UI:R, implying some operator interaction or attacker-controlled content delivery is likely despite the CVSS 4.0 vector's UI:N claim). The CPE entry uses a wildcard version range, so all released builds up to 3.0.1.76 should be treated as affected.

Unauthenticated log injection in InvoicePlane (all versions prior to 1.7.2) allows remote attackers to forge entries in the application's error log by supplying a crafted cron_key value containing CRLF characters to the Cron::recur() endpoint. Because the invalid key is reflected straight into log_message('error', ...) without neutralization, an attacker can insert arbitrary fake log lines, corrupting the audit trail and potentially misleading log-based monitoring or forensic analysis. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited; impact is limited to log integrity (CVSS 5.3, C:N/I:L/A:N) with no data disclosure, code execution, or denial of service, though the EPSS signal is not available and the issue was addressed in the 1.7.2 release.

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfs_alloc_subrequest() fails syzbot reported a null-ptr-deref below [1] following a fault injection in netfs_alloc_subrequest(). [0] When netfs_alloc_subrequest() fails, subreq is NULL. Later, netfs_prepare_write() tries to initialize members of subreq(e.g., source), the issue in [1] is triggered. Let's handle the error of netfs_prepare_write() properly. [0] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Call Trace: netfs_alloc_subrequest+0x116/0x3f0 netfs_prepare_write+0x76/0x7b0 netfs_unbuffered_write+0x75c/0x2020 netfs_unbuffered_write_iter_locked+0x7d6/0xa80 netfs_unbuffered_write_iter+0x442/0x720 v9fs_file_write_iter+0xbf/0x100 vfs_write+0x6ac/0x1050 [1] KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:netfs_prepare_write+0xbc/0x7b0 fs/netfs/write_issue.c:173 Call Trace: netfs_unbuffered_write+0x75c/0x2020 fs/netfs/direct_write.c:111 netfs_unbuffered_write_iter_locked+0x7d6/0xa80 fs/netfs/direct_write.c:290 netfs_unbuffered_write_iter+0x442/0x720 fs/netfs/direct_write.c:382 v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409 new_sync_write fs/read_write.c:595 [inline]

GraphQL query injection in Rapid7 Bulk Export MCP 0.2.5 through 0.6.1 allows an authenticated high-privileged actor who can influence the export_id argument used by the check_rapid7_export_status and download_rapid7_export tools to terminate the intended export(id: "...") selection and append attacker-controlled root-level selections such as schema introspection. The impact is confined to confidentiality (CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), because every injected query executes inside the operator's own already-authenticated Rapid7 API key scope and cannot cross a tenant or account boundary - a directly-malicious operator gains nothing beyond what direct API access already provides, so realistic exposure requires a compromised or careless upstream MCP client or indirect prompt injection forwarding an unvalidated identifier. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the vendor-released fix is version 0.6.2, which parameterizes export_id as a GraphQL variable.

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration. Consider the following verification trace: - main: bpf_loop(nr_loops, callback ...) - callback: BPF_EXIT - main: bpf_loop(nr_loops, callback ...) - ... While the first visit of the call to bpf_loop() propagated R1 precision as expected, the second call to mark_chain_precision() in the check_helper_call() set R1, but it was immediately reset when backtrack_insn() processed preceding BPF_EXIT in the loop deleted in this patch. Because of that, the second visit of the call to bpf_loop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program. Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'.

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect config_ctx from being freed under the config callback vhost_vdpa_config_cb() loads v->config_ctx and signals it without taking a reference and without holding any lock: struct eventfd_ctx *config_ctx = v->config_ctx; if (config_ctx) eventfd_signal(config_ctx); VHOST_VDPA_SET_CONFIG_CALL replaces that field and drops what is normally the last reference to the old context: swap(ctx, v->config_ctx); if (ctx) eventfd_ctx_put(ctx); eventfd_ctx_put() drops the last kref and frees the context immediately, with no RCU grace period, so a callback that has already loaded the pointer goes on to dereference freed memory. The two sides share no lock: the ioctl runs under vhost_dev.mutex, while the parent invokes the callback from its own interrupt or workqueue context. This is not the reopen refcount underflow fixed by commit f6bbf0010ba0 ("vhost-vdpa: fix use-after-free of v->config_ctx"), which was about vhost_vdpa_config_put() leaving a stale pointer behind. Here the pointer is maintained correctly and it is the read side that is unprotected. With VDUSE as the parent this is reachable from userspace with access to /dev/vduse (root by default). VDUSE_DEV_INJECT_CONFIG_IRQ queues dev->inject, and vduse_dev_irq_inject() runs the callback under VDUSE's own dev->irq_lock, which vhost does not hold. vduse_dev_reset() does flush_work(&dev->inject), but VHOST_VDPA_SET_CONFIG_CALL never goes through reset, so an inject already in flight is not waited for. A process that injects config interrupts on the VDUSE fd while another thread swaps the call fd on the vhost-vdpa fd hits it in seconds: BUG: KASAN: slab-use-after-free in native_queued_spin_lock_slowpath Read of size 4 at addr ffff888107d21808 by task kworker/u17:1/2993 Workqueue: vduse-irq vduse_dev_irq_inject Call Trace: native_queued_spin_lock_slowpath+0x97/0x5b0 _raw_spin_lock_irqsave+0xd4/0xe0 eventfd_signal_mask+0x69/0x120 vhost_vdpa_config_cb+0x34/0x50 vduse_dev_irq_inject+0x46/0x60 process_one_work+0x468/0x950 Allocated by task 2992: do_eventfd+0x50/0x200 __x64_sys_eventfd2+0x2e/0x40 Freed by task 2992: eventfd_ctx_put+0xb9/0xc0 vhost_vdpa_unlocked_ioctl+0x116c/0x2190 Add a spinlock covering every access to config_ctx, so the callback either signals a context that is still alive or observes NULL, and the put happens only once no callback can reach the old value. Clearing the parent's callback before the put would not be enough: of the in-tree set_config_cb() implementations only VDUSE takes a lock, the rest store the pointer unlocked, so that would not order against an in-flight invocation.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length. A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read. Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.

Code injection in DbGate (a web-based database GUI) versions up to 7.2.5-beta.5 lets an authenticated user who can create or edit a JSON Runner or scheduled script inject text into the comment.text or script.schedule fields that escapes the generator's `//` comment wrapper and reconstitutes a `// @require <module>` or `// @schedule` directive, causing the server to load and execute attacker-supplied code. The flaw is remote, requires low privileges (PR:L) and no user interaction, and is limited to unpatched releases; it is fixed by upgrading to 7.2.5-beta.6 (upstream commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877, PR #1527). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the EPSS-style exposure is mitigated mainly by the requirement for an authenticated account with runner-editing rights. This issue is explicitly distinct from CVE-2026-47668.

An entropy/random-generator failure on an Mbed TLS TLS 1.3 server (versions 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0) can allow bytes to be removed from or injected into the beginning of the TLS stream, degrading integrity of the protected channel. The attack is not a normal network exploit: the prerequisite is that the attacker can first induce the server's entropy source to fail (for example via fault injection, RNG degradation, or resource exhaustion), which is why the issue is scored CVSS 2.9 (AV:L/AC:H) with integrity-only impact and no effect on confidentiality or availability. Only TLS 1.3 servers are affected - TLS 1.2 servers and client-side roles are out of scope - and no public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated ANSI/VT100 escape-sequence injection in the Mesop web framework's /__csp__ CSP-reporting endpoint (pip package mesop <= 1.3.3) allows remote attackers to embed terminal control sequences in JSON report fields such as blocked-uri and document-uri, which are passed straight to print() and written to stdout unsanitized. A public proof-of-concept payload is documented in the vendor advisory; when an operator later views the raw application stdout in an ANSI-capable terminal, the injected sequences can clear the screen, move the cursor, hide text, or render forged messages such as a fake 'SECURITY OK - No CSP violations found' banner, corrupting the integrity of operator-facing logs. The assessed risk is low-to-moderate and is purely a log-integrity issue: there is no confidentiality, availability, or server-side integrity impact, the attack requires a human to view rendered logs (UI:R), and logs consumed by JSON aggregators, SIEMs, or other non-rendering pipelines neutralize the sequences. Vendor-released patch: 1.3.4.

Stored HTML injection in the MasterStudy LMS WordPress plugin before 3.7.50 allows authenticated users with subscriber-level accounts or above to embed arbitrary markup - for example iframes - into user-submitted content that is later rendered to other users, enabling phishing and content spoofing. The prerequisite is trivially met on LMS sites that allow open self-registration, though it remains a real gate since the attacker must hold an account (PR:L, not unauthenticated), and the payload only fires when another user views the injected content (UI:R). Impact is bounded to markup-level abuse rather than script execution or account takeover, the CVSS 3.1 base score is 4.6, and no public exploit identified at time of analysis. This is a genuine but low-priority issue that is resolved by upgrading to 3.7.50.

Code injection in mtrano APENCMS (rolling release, all builds up to commit 6546096d354153309693efabb9a0d824628ed4f5) lets a remote attacker who already holds high-privilege template or site administration access reach a PHP eval() call in cms/weasel.php through the $_CMS['site'] argument and execute arbitrary code on the server. Publicly available exploit code exists, while the vendor was contacted and did not respond, so no fixed build and no published version boundaries are available. The CNA's CVSS 4.0 base score of 1.9 (Low, all impacts rated VC:L/VI:L/VA:L) understates the technical severity: with attacker-controlled input flowing into eval(), successful exploitation is effectively full server-side code execution, and the attacker must already control the template/site variable (PR:H), consistent with template or site administrator rights rather than an unauthenticated default-configuration attack.

SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.

Identity-header forwarding in the Warpgate SSH/HTTPS/MySQL bastion host prior to version 0.25.6 lets an authenticated user be authorized as a different user by proxied HTTP backends that trust the first occurrence of the reserved x-warpgate-username header. The flaw is conditional rather than a drive-by critical: it requires (1) a valid authenticated Warpgate session (PR:L) and (2) a downstream backend that both trusts Warpgate's reserved identity headers and resolves duplicate header values by taking the first, since Warpgate forwards the client-supplied value ahead of its own injected authenticated username; backends that read the last value, deduplicate, or ignore x-warpgate-* headers are unaffected. It is rated CVSS 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N), has no CISA KEV listing, and no public exploit identified at time of analysis.

Code injection in RooCMS (versions up to and including 1.2.2, 1.3.4 and 1.4RC2) allows an attacker who holds a privileged content-editing or administrator account to place PHP code into a page's 'content' field, which the frontend renderer passes to eval() in roocms/site_pagePHP.php, resulting in arbitrary PHP execution on the server. The flaw is CWE-94 and is remotely reachable, but exploitation is gated behind high privileges (CVSS:4.0 PR:H / CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so realistic exposure is limited to insiders or attackers who have already obtained editor credentials rather than an anonymous internet-facing surface. Publicly available exploit code exists (a public proof-of-concept write-up is referenced), the vendor was contacted but did not respond, and no vendor-released patch has been identified at time of analysis.

Code injection in DedeCMS through version 5.7.118 lets remote, unauthenticated attackers manipulate the 'aid' argument handled by plus/mytag_js.php to inject attacker-controlled code into the application's processing path, with the vendor-scored impact limited to low confidentiality, integrity and availability effects. A public exploit for this issue exists, so any internet-reachable installation that still exposes the plus/ auxiliary scripts should be considered at risk of opportunistic scanning and exploitation; CISA KEV does not list this CVE, indicating no confirmed active exploitation at time of analysis. Because the technical impact is constrained rather than a full compromise chain, this is a moderate-priority hardening item rather than an emergency patch-and-isolate scenario.

Log injection in IBM WebSphere Application Server 9.0 and 8.5 lets remote, unauthenticated attackers corrupt server log content by supplying a crafted LTPA token cookie that the application writes to its logs without neutralizing control characters. The impact is limited to integrity (CVSS 3.1 base score 3.7, I:L) with no confidentiality or availability loss and no code execution, and exploitation is rated high complexity because the injected content must survive into the log in a form a human or downstream log consumer then misinterprets. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor patch is available per the IBM advisory.

Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).

A configuration-gated information-disclosure flaw in Caddy 2.11.3 and earlier allows an unauthenticated remote attacker to leak environment variables, request variables, and - when the file placeholder provider is registered - arbitrary readable files. The weakness only materializes when an operator-written rewrite handler uses a URI ending in a literal '?' while embedding an attacker-controllable placeholder such as {http.request.header.*}; under those conditions the first-pass expansion output is re-parsed by buildQueryString, which performs a second placeholder pass and evaluates injected {env.*}, {http.request.*}, or {file.*} syntax. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released a fix in Caddy 2.11.4, and because exposure depends entirely on a non-default rewrite configuration, practical risk is narrow despite the network-facing, unauthenticated vector.

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpa_lock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes: BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0 Write of size 8 at addr ffff888181139718 by task modprobe ... The buggy address belongs to the physical page: pfn:0x181139 ... page_type: f2(table) cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and frees the old PTE-table pages, while __change_page_attr() fetches a PTE pointer from a lockless lookup_address_in_pgd_attr() and writes it with set_pte_atomic() only later. When module text is served from a shared large ROX mapping the two run on the same PMD: CPU A (module load) CPU B (module finalize) ------------------- ----------------------- execmem_make_temp_rw set_memory_nx __change_page_attr split 2M -> 4K table P kpte = &P[i] (lockless) execmem_restore_rox set_memory_rox (CPA_COLLAPSE) cpa_collapse_large_pages rebuild leaf PMD flush_tlb_all pagetable_free(P) set_pte_atomic(kpte, ...) -> writes into freed P P is a page-table page (page_type: table), reused at once, so the write corrupts whatever got the page next: a bad-pte or bad-page splat, or a fatal fault once P has been turned into read-only text. The flush_tlb_all() before the free does not close this: its IPI only serializes against page-table walkers that run with interrupts off (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts on, so nothing stops it from holding a stale pointer into P. Serialize the collapse - the PMD rebuild, TLB flush and PTE-table free - under cpa_lock, the same lock __change_page_attr() now takes unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on debug_pagealloc_enabled()"), so a concurrent walker can no longer hold a pointer into a table the collapse is about to free.

In the Linux kernel, the following vulnerability has been resolved: powerpc/syscall: Fix syscall skip handling for seccomp and ptrace After enabling GENERIC_ENTRY on PowerPC, syscall_enter_from_user_mode() returns -1 as a sentinel to signal that seccomp or ptrace has intercepted the syscall and already set a return value via syscall_set_return_value(). system_call_exception() was not handling this sentinel, and since -1UL is >= NR_syscalls, the code fell into the out-of-range path and returned -ENOSYS, overwriting the errno already placed in regs->gpr[3]. The naive fix of checking r0 == -1L before the NR_syscalls bounds check is ambiguous: a user legitimately calling syscall(-1) also produces r0 == -1L, and a tracer intercepting such a call would have its injected return value silently discarded. Fix this by introducing a thread flag that is set whenever syscall_set_return_value() explicitly updates the return value. In system_call_exception(), check and clear this flag before dispatching the syscall, and return the preset value directly when it is present. This ensures that an explicitly supplied return value always suppresses syscall execution, regardless of the syscall number. This handles all seccomp actions correctly: - SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE (no tracer), SECCOMP_RET_USER_NOTIF: all call syscall_set_return_value(), flag is set, injected value returned. - SECCOMP_RET_TRAP, SECCOMP_RET_KILL: call syscall_rollback() and deliver a signal; flag is not set, but the process is dying so the return value is irrelevant. The fix covers both ppc32 and ppc64 with no #ifdefs.

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing prog is allowed to attach to '__x64_'-alike prefix symbols. It is because the verifier does not verify whether the symbol is a kernel function or a bpf prog. That said, a sleepable tracing prog is allowed to attach to a bpf prog target whose name has '__x64_'-alike prefix. For example, a sleepable fentry prog attaches to a '__x64_sys_nop' XDP prog, and copies buffer from a user pointer with bpf_copy_from_user() helper. After attaching the XDP prog to lo interface, the kernel BUG could be triggered by 'ping -c 1 -W 1 127.0.0.1': [ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324 Fix it by disallowing sleepable prog always when its target btf is not a kernel's btf.

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse the CORE_INIT_RSP packet without validating that the skb contains enough data. A malformed response (e.g. injected via virtual_ncidev) can declare a large num_supported_rf_interfaces while providing insufficient data, causing reads of uninitialized slab memory. This is later used in nci_init_complete_req(), triggering a KMSAN uninit-value warning. Add skb length checks before accessing packet fields: - Validate the skb has at least 1 byte for the status field. - Validate the skb can hold the fixed-size header before parsing. - In v2, bounds-check each variable-length rf_interface entry and its extension parameters within the parsing loop. - In v1, verify the skb is large enough for both the variable-length rf_interfaces array and the trailing rsp_2 structure.

In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure __ublk_shmem_remove_ranges() removes matching maple tree ranges in batches, but first stores each range into a temporary xarray so that the pages can be unpinned after dropping the maple tree lock. That temporary xarray is filled under the maple tree lock with xa_store(..., GFP_ATOMIC). If the store fails before mas_erase(), the current range is left in the tree and the helper returns false. The outer ublk_shmem_remove_ranges() loop then immediately retries the same range. While the atomic allocation keeps failing, the teardown path has no forward progress. The issue can be reproduced with radix_tree_node failslab injection after a SHMEM_ZC buffer has already been registered: # Kernel config: # CONFIG_BLK_DEV_UBLK=y # CONFIG_DEBUG_FS=y # CONFIG_FAULT_INJECTION=y # CONFIG_FAULT_INJECTION_DEBUG_FS=y # CONFIG_FAILSLAB=y echo 10 > /proc/sys/vm/nr_hugepages mkdir -p /tmp/htlb mount -t hugetlbfs none /tmp/htlb fallocate -l 4M /tmp/htlb/ublk_buf dev_id=$(kublk add -t null --shmem_zc \ --htlb /tmp/htlb/ublk_buf | awk -F '[ :]' '/dev id/ {print $3}') echo 1 > /sys/kernel/slab/radix_tree_node/failslab echo Y > /sys/kernel/debug/failslab/cache-filter echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait echo 1 > /sys/kernel/debug/failslab/interval echo -1 > /sys/kernel/debug/failslab/times echo 100 > /sys/kernel/debug/failslab/probability kublk del -n "$dev_id" On the unfixed kernel the delete command was still running after 3 seconds. Disabling failslab made it return. The fault-injection stack showed: should_failslab kmem_cache_alloc_lru_noprof __xas_nomem __xa_store xa_store __ublk_shmem_remove_ranges ublk_cdev_rel ublk_ctrl_del_dev Remove the allocation from the teardown loop. Keep the existing batch limit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array. Once a matching range is found, the range is erased from the maple tree before dropping the lock, so each successful scan makes progress without depending on any GFP_ATOMIC allocation. With the same failslab settings, the fixed kernel completed "kublk del -n $dev_id" successfully in about 45 ms.

SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.

SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMID_EL1 when MTE is disabled __cpuinfo_store_cpu() gates the GMID_EL1 read on the raw ID_AA64PFR1_EL1, so it reads the register even when the kernel has disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle: Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : __cpuinfo_store_cpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task! Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPU_ON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHP_AP_KVM_ONLINE. Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line override applied, and on CONFIG_ARM64_MTE, which no register reflects. The boot CPU stores its registers before init_cpu_features() strips an unsafe override, so clamp against the hardware value here too.

CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client messages embed arbitrary strings in the theme.primaryColor field, which the renderer writes unvalidated into the host element's --a2ui-color-primary CSS custom property. Because the theme is declared with z.any() in renderers/web_core/src/v0_9/schema/server-to-client.ts, values such as url(https://attacker.example/beacon) bypass validation and reach the DOM style layer, enabling UI spoofing, outbound request beacons and potential data exfiltration from affected Angular applications. Exploitation requires the ability to inject or manipulate the message stream consumed by the renderer (PR:L) plus a passive user action (UI:P); the vendor has published fix commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b (PR #2367). There is no CISA KEV listing and no public exploit identified at time of analysis.

Cookie attribute injection in http4s's ResponseCookie.render allows any application that builds a response cookie from unvalidated input to emit attacker-controlled Domain, Path, or SameSite attributes — widening cookie scope or stripping protections — while embedded control characters can enable HTTP header splitting on permissive backends. All applications using http4s versions before 0.23.35 or 1.0.0-M47 that feed untrusted data into the name, content, domain, path, or extension fields of a ResponseCookie are in scope. No public exploit code and no active exploitation were identified at time of analysis, and the moderate CVSS base of 4.8 reflects the high-complexity precondition that the consuming application must itself pass unsanitized input into the cookie constructor.

Parameter smuggling into the PayPal notify redirect of the J2Store extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) lets an attacker-chosen query string ride along with the redirect that the notify endpoint issues to com_j2store's checkout controller, instead of the intended fixed parameter set. A victim must load the crafted link (UI:P in the CVSS 4.0 vector), after which the follow-up request to the checkout controller is processed with the injected view/task/paction parameters, giving a limited integrity impact (VI:L) with no confidentiality or availability loss. The vendor's own description concedes this does not grant an unauthenticated attacker anything they could not obtain by calling the same com_j2store URL directly; no public exploit code and no CISA KEV listing were identified in the supplied intelligence.