Code Injection

Log forgery in Apache ZooKeeper 3.8.0–3.8.6 and 3.9.0–3.9.5 allows a remote client to inject arbitrary fake entries into the server's operational log by sending an add_auth("ensemble", ...) request whose ensemble name contains embedded newline characters. EnsembleAuthenticationProvider.handleAuthentication() writes the raw, unsanitized name through LOG.warn(), and because SLF4J's {} placeholder does not escape newlines, the attacker controls timestamp, level, class name and message text of the resulting lines. Apache rates the issue moderate and directs users to 3.8.7 or 3.9.6.

Audit log injection in Apache ZooKeeper 3.9.0–3.9.5 and 3.8.0–3.8.6 allows attackers to forge entries in zookeeper_audit.log when audit logging is enabled. An unauthenticated attacker can embed tab characters in a digest authentication username to inject arbitrary tab-separated key=value fields, and a client permitted to call setACL can embed tabs in a digest ACL id to make a successful setAcl event appear to record forged operations such as operation=delete and znode=/forged. The vulnerability corrupts forensic evidence and can defeat SIEM alerting, but does not permit direct modification of ZooKeeper data; no public exploit code or CISA KEV listing was identified at time of analysis, and vendor-released fixes exist in 3.9.6 and 3.8.7.

Parameter injection in the IBM Security Verify Access (Verify Identity Access) reverse proxy - the WebSEAL component - lets unauthenticated, network-reachable attackers have crafted parameters carried into requests the proxy constructs toward back-end or third-party services, potentially manipulating how those downstream services interpret the call. Only deployments below the listed interim-fix levels (Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, plus their container variants) are affected, and realized impact depends heavily on the behaviour of the downstream service, which is why this is scored AC:H with a limited confidentiality but high integrity effect rather than an urgent, broadly weaponizable flaw. There is no public exploit identified at time of analysis and EPSS is only 0.15% (5th percentile), so this is a moderate-priority issue to schedule rather than an emergency; the vendor has published patch guidance.

Control-character injection in gitoxide's gix-transport crate before version 0.59.2 lets crafted git-daemon URLs smuggle NUL, CR and LF bytes into connect requests, enabling spoofing of virtual hosts and injection of forged newlines into daemon requests and logs. The flaw affects any Rust application or tool that uses gix-transport to open a git:// connection to a URL whose host or path components are attacker-influenced, and requires the victim to initiate that connection (UI:P). Impact is limited to low confidentiality and integrity effects (5.3 Medium), no public exploit code or CISA KEV entry is present in the supplied intelligence, and a vendor advisory with a fixed release is available.

IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. IBM has published a fix (support page node 7286610); there is no CISA KEV listing and no public exploit identified at time of analysis, though CISA's SSVC assessment marks the issue as automatable.

Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.

Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass the command allowlist/denylist filter by embedding newline or carriage-return characters in a command string, causing injected shell segments to execute without inspection. Affected versions are nanobot 0.2.0 and 0.2.1; the root cause is that `_split_shell_segments()` recognized `;` and `|` as command-chain delimiters but not `\n` or `\r`, so a payload on its own line was never checked against allow/deny patterns. No public exploit or CISA KEV listing is identified; patch commit af582246 is available.

Comment-injection in the OpenZeppelin Contracts Wizard code generators lets a newline character embedded in the `info.securityContact` or `info.license` option break out of the single-line `//` comment and be emitted as live source declarations in generated Solidity, Cairo, Stellar/Soroban, and Stylus contracts. Only integrations that populate those two fields from untrusted input and then hand the generated source to a downstream consumer are affected — the self-service web app, AI assistant, CLI, and self-hosted API all use user-supplied values and never cross that trust boundary, and shared links cannot set the fields. The flaw is integrity-only (CVSS 3.3, CWE-94): no code executes on any Wizard service, no public exploit is identified in the supplied data, and patched packages are available as @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1.

Apache Syncope contains a Groovy sandbox bypass (CWE-94 code injection) that lets an administrator holding entitlements over the Implementations console register a malicious Groovy Command class whose untrusted code executes in a static CommandArgs initializer, escaping the intended script sandbox. Affected releases span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; exploitation requires a privileged, already-authenticated administrator account (CVSS 3.1 vector PR:H, score 6.5) rather than an anonymous attacker. There is no public exploit identified and the vulnerability is not in CISA KEV, but because Syncope is an identity governance and provisioning platform, successful abuse yields high confidentiality and integrity impact over managed identity data - CISA's SSVC assessment rates technical impact as 'total' while noting exploitation has not been observed and the attack is not automatable.

Remote code execution in Yot CMS 3.3.0 and 3.3.1 is achievable by an authenticated administrator through the Admin Console's unsanitized use of PHP's eval() function in modsys/console/admin.php, where the text POST parameter is passed directly to eval() without validation. A publicly available proof-of-concept on GitHub demonstrates the attack. Despite the technically accurate RCE classification, exploitation is gated behind high-privilege (administrator) authentication, substantially reducing practical risk compared to the tag alone suggests.

Remote code execution in cym1102 nginxWebUI up to 4.4.2 is achievable by any authenticated user via the `autoUpdate` endpoint, which accepts an arbitrary `url` parameter and downloads and executes the resulting JAR file on the host OS without domain validation. A public proof-of-concept is disclosed in GitHub issue #213, and a fix exists only as an unmerged PR (#215) - no released patched version has been confirmed. The CVSS 4.0 low-impact metrics (VC:L/VI:L/VA:L) conflict materially with the actual RCE capability.

Code injection in sanjevirau gsubs (Electron application) up to version 1.0.3 allows remote attackers to execute arbitrary code by manipulating the filename argument passed to the showQuerySuccessPage function in renderer/index.js. The vulnerability exists in the Electron renderer process and requires passive user interaction to trigger. A public proof-of-concept exploit has been published on GitHub; no patch has been released and the vendor was unresponsive during coordinated disclosure.

Remote code execution in Xuxueli xxl-job up to version 3.4.2 allows authenticated low-privileged users to execute arbitrary code on the executor host via the GLUE mode Groovy script handler in GlueFactory.java. The root cause is that GroovyClassLoader.parseClass processes attacker-supplied Groovy source directly, compiling and running it without a restrictive sandbox. A public proof-of-concept exploit targeting v3.4.2 has been released on GitHub, and the vendor did not respond to the coordinated disclosure.

In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs_recover_relocation() jumps to out_unset before merge_reloc_roots() and clean_dirty_subvols(). put_reloc_control() drops the list-owned relocation root references, but it does not clear fs_root->reloc_root or drop the references owned by those pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs roots associated during recovery. On failure, clear their reloc_root pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc_root set with fs_error=0. With this fix, the same failure path drops that count to 0 before mount fails.

Server-side template injection (SSTI) in Arma Digital Media Inc.'s Website Template product enables remote unauthenticated attackers to inject template engine expressions that are evaluated server-side, achieving code injection. All versions through build 11092026 are affected, and the vendor did not respond to TR-CERT's responsible disclosure, leaving no vendor-released patch available. No public exploit or CISA KEV listing has been identified at time of analysis.

Argument injection in Pardus Pen before version 4.2.1 allows a local, low-privileged user to inject unsanitized argument delimiters into an underlying command invocation, yielding limited integrity impact. The flaw (CWE-88) is strictly local in scope-CVSS AV:L/PR:L-and carries no confidentiality or availability consequence per the published vector. No public exploit code and no active exploitation have been identified; vendor-released patch 4.2.1 is available via the TR-CERT advisory.

Email header injection in MetForm WordPress plugin before 4.1.9 allows unauthenticated attackers to inject arbitrary SMTP headers - such as Bcc - into notification emails dispatched by the site, by embedding newline characters in form field submissions that are configured to populate those headers. This enables silent exfiltration of form submission content to attacker-controlled addresses and potential abuse of the site as a spam relay. No public exploit code or CISA KEV listing exists; the CVSS 4.8 with AC:H correctly reflects the configuration prerequisite that limits the exploitable surface.

CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.

Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.

Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.

Code injection in AppFlowy 0.11.8 allows arbitrary code execution through insufficient URI and local path validation in the application's file-launch and URL-handling subsystems. The vulnerability exists in the Flutter-based desktop/mobile productivity app's afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components, where inadequate sanitization of URI schemes or local file paths enables an attacker to trigger execution of arbitrary code. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CWE-94 classification confirms the root cause as a code injection pattern rather than a memory-safety issue.

CSV formula injection in Snipe-IT through 8.6.3 allows authenticated low-privilege users to plant spreadsheet formulas in the unaccepted assets acceptance report export, which execute in the spreadsheet client of any privileged user who downloads and opens the file. The ReportsController::postAssetAcceptanceReport method builds its CSV output by hand without applying the League\Csv\EscapeFormula sanitizer already wired into the six sibling exports in the same controller, permitting injection of =, +, -, @, tab, or CR-prefixed values into free-text fields such as asset name, company name, category, model, or assignee. When a reports.view-privileged user opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, injected functions such as HYPERLINK or WEBSERVICE can exfiltrate spreadsheet context to an attacker-controlled server; on legacy Windows Excel configurations with DDE enabled, arbitrary command execution on the victim's workstation is also achievable. Fixed in version 8.7.0; no public exploit identified at time of analysis.

Script injection via improper sanitization of special characters in Dell Secure Connect Gateway 5.0 allows unauthenticated remote attackers to inject script content, resulting in limited confidentiality exposure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has issued a vendor-confirmed patch under advisory DSA-2026-382.

LDAP injection in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) allows attackers to inject malicious LDAP query elements, leading to script injection against the underlying directory service. The CPE data confirms two distinct deployment forms are affected: the virtual Appliance (fixed at 5.36.00.16) and the Application (fixed at 5.36.00.00), both covered under Dell advisory DSA-2026-382. Critically, the description characterizes the attacker as unauthenticated, but the provided CVSS vector specifies PR:H - a direct contradiction that must be clarified with Dell before this vulnerability is triaged or deprioritized.

Let me synthesize. Product: Halo (halo-dev/halo) — a Java-based blog/CMS platform. Product name: "Halo". Vulnerability: CWE-94 code injection — plugin management allows installing/updating malicious plugins leading to arbitrary command execution with Halo process privileges. CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N = 4.6. Interesting — low privilege, requires user interaction, confidentiality/integrity low, no availability impact. Scope unchanged. EPSS 0.16% percentile 5% — very low. No KEV. No POC explicitly stated (references include a GitHub issue report from a researcher - MyCVE-Report). Tags: RCE, Code Injection. Affected: Halo <= 2.25.4. Prevalence: Halo is a popular open-source blog/CMS in China — medium (common but not everywhere). I'd say "medium" — it's a widely used open-source CMS/ blogging platform, but niche-ish. Let's say medium with basis "popular open-source Java CMS/blog platform, limited enterprise footprint". Assessed CVSS: The description says plugin management allows users to install/update malicious plugins — requires authenticated user with plugin management permission (admin typically), plus user interaction (UI:R from vector). Actually the input vector already says PR:L, UI:R. Hmm, but plugin management typically requires admin. The provided CVSS says PR:L. I might assess PR:L as given but arguably PR:H. I should be honest. Let me use CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N — but the impact of arbitrary command execution should be high. However CVSS given is low impacts. The description says "execute any command with Halo process permissions" — that would be C:H/I:H/A:H arguably. But scope unchanged and Halo process permissions limited. Hmm. I'll assess as AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H? Let me think: to install a plugin you need plugin management privilege — typically administrator. The given vector says PR:L though. Actually maybe Halo allows certain users to manage plugins. I'll go with PR:L per the vendor/NVD-ish

PHP code injection in Okta Access Gateway (all versions prior to 2026.9.1) allows an authenticated administrator to execute arbitrary code as the web server process by embedding malicious PHP payloads in dashboard application label values. The gateway writes these labels unsanitized into generated PHP configuration files, which are automatically included on every subsequent authentication request, triggering execution without further interaction. No public exploit has been identified at time of analysis; vendor-released patch is available at version 2026.9.1.

LDAP injection in Okta Access Gateway versions before 2026.9.1 allows a network-authenticated attacker to manipulate LDAP search filter logic by supplying crafted SAML assertion attribute values. Because the Access Gateway interpolates raw SAML attribute values directly into LDAP filter strings without sanitization, an attacker controlling those values can inject LDAP metacharacters to rewrite the intended query - potentially bypassing authorization decisions or extracting sensitive directory entries. No public exploit is identified at time of analysis, but the vendor has released a fix in 2026.9.1.

Nginx directive injection in Okta Access Gateway before version 2026.9.1 enables an authenticated administrator to inject arbitrary nginx directives into the gateway's server block by exploiting the application-level custom configuration field, which bypasses the Lua-based restriction mechanism applied to other directive entry points. The field is interpolated directly into the nginx server block without validation, allowing manipulation of routing, access controls, and header processing with high integrity impact. Vendor-released patch version 2026.9.1 is available; no public exploit has been identified at time of analysis.

Remote code execution in InstantCMS prior to 2.18.2 allows authenticated administrators to execute arbitrary PHP code by abusing the component installer's file upload functionality. The attacker uploads a crafted ZIP archive containing a PHP webshell alongside a custom .htaccess file that overrides the upload directory's default PHP execution prohibition, causing the uploaded PHP files to become executable via direct HTTP request. The vulnerability requires admin-level authentication (PR:H per CVSS), significantly limiting exposure, but full server-side code execution is achievable post-exploitation. No public exploit code has been identified at time of analysis.

Server-side template injection (SSTI) in Nozomi Networks Guardian and CMC Dashboard functionality (versions prior to 26.3.0) allows an authenticated low-privilege user to embed malicious template payloads in dashboard definitions. When a victim - potentially one with elevated privileges - views or imports the crafted dashboard, the payload executes in their browser context, enabling modification of application data or disruption of the monitoring platform. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available.

Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticated remote attackers to invoke any registered WordPress shortcode via an insufficiently validated action handler that passes attacker-controlled input directly to do_shortcode(). Because shortcode impact depends on what handlers are registered in the environment, real-world consequences range from limited content disclosure or modification to chained exploitation through dangerous third-party shortcodes. No public exploit has been identified at time of analysis, and a patch was released as version 2.10.3.2.

WWW-Authenticate header parameter injection in ash_authentication_oauth2_server (versions 0.1.3 through 0.3.0) allows unauthenticated network attackers to smuggle arbitrary OAuth2 auth-params into Bearer challenge headers by supplying a tenant value containing a double-quote character. In multi-tenant Elixir/Phoenix applications that derive the Ash tenant from request-controlled data such as subdomains, Host headers, or path segments, an attacker can inject a second resource_metadata URL pointing to an attacker-controlled authorization server. Spec-compliant OAuth2 clients that follow the resource_metadata discovery URL will then contact the attacker's server instead of the legitimate one, enabling token theft or credential harvesting. No public exploit has been identified at time of analysis; a vendor-released patch is available at version 0.3.1.

Arbitrary shortcode execution in the Icegram Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows unauthenticated network attackers to invoke registered WordPress shortcodes without authentication. The flaw originates in the plugin's email workflow and subscription handling code, which passes user-controlled input to `do_shortcode()` without adequate validation - enabling attackers to trigger any shortcode registered on the target site. Depending on the shortcodes available, impact ranges from information disclosure and content manipulation to potential code execution; no public exploit or CISA KEV listing has been identified at time of analysis.

CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions kvm_inject_el2_exception() writes ESR_EL2 for synchronous exceptions but not for SError. enter_exception64() does not write ESR_ELx for any exception type, so the constructed syndrome is dropped. A guest L2 hypervisor taking a nested SError observes stale ESR_EL2. This affects both kvm_inject_nested_serror() and the EASE path in kvm_inject_nested_sea(). Write ESR_EL2 for except_type_serror, matching except_type_sync.

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or snd_usb_mixer_resume() fails. The error path skips the out: block, which restores D0 and decrements chip->num_suspended_intf. The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in snd_power_ref_and_wait(). USB core logs an interface resume callback error. It does not retry that callback, so a later callback cannot complete the skipped cleanup. usb_audio_suspend() increments num_suspended_intf before returning success. A system-resume callback must consume the system-suspend count even if a component resume fails. Otherwise, the stranded count skews later suspend and resume cycles. Do not apply this cleanup to runtime-resume errors. Runtime PM can retry -EAGAIN or -EBUSY without another suspend callback. The count must continue to describe that suspended interface. Other runtime-resume errors latch runtime_error in the PM core and do not cause an immediate callback retry. Both parts of the system-resume error path are longstanding. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") introduced err_out past the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations. No third-party code is needed to reach the error path. snd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices that have a mixer status URB. Its mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It can return -EPIPE or -EIO when the device stalls the request. Route a component error through out: only when system_suspend is nonzero. Continue to return runtime-resume errors through err_out. Later component resume stages remain skipped. The original error still reaches USB core. A later transfer can fail if the device did not recover. I reproduced the system-resume failure on an Audient iD14 MkI with an out-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched core left control readers in uninterruptible sleep in snd_power_ref_and_wait() until a reboot. With this patch, the same failure restored control access. A second system suspend and resume also succeeded after I disabled fault injection.

Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 7.0.2.

Template injection in Kibana's Cribl integration allows a low-privileged authenticated user holding Fleet management rights to write Elasticsearch ingest pipelines exceeding their authorized Elasticsearch permissions. The flaw stems from insufficient validation of a configuration field that is rendered server-side as a script template, giving the attacker a code injection foothold (CWE-94) into the pipeline generation path. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L/I:L) reflects the constrained privilege requirement and limited integrity impact.

Code injection in SeaCMS's Locoy Collector module (versions up to 13.6) allows remote unauthenticated attackers to execute arbitrary PHP code by manipulating the `pwd` argument to the `parseIf` function in `seacms_locoy_news.php`. A publicly available proof-of-concept exploit exists, documented in a GitHub security advisory, elevating practical risk above the conservative 6.9 base score. The provided CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) conflict with the 'RCE' tag - PHP code injection in a CMS context typically yields full server-side code execution, suggesting the vendor scoring may significantly understate actual impact.

Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug. Trace for example: nft_flow_offload_chain() // FLOW_BLOCK_BIND nft_flow_block_chain() nft_chain_offload_cmd() nft_block_offload_cmd() ->ndo_setup_tc() nsim_setup_tc() flow_block_cb_setup_simple() flow_block_cb_alloc() // fails to -ENOMEM The warning was reproduced on the 5.10 stable kernel under memory pressure via fault injection, but the underlying bug exists in mainline as well, as demonstrated by the ENOMEM trace above. The following splat was triggered during nf_tables transaction processing: WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Modules linked in: CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Call Trace: nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604 nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline] nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340 netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] __sock_sendmsg+0x155/0x190 net/socket.c:663 ____sys_sendmsg+0x705/0x870 net/socket.c:2379 ___sys_sendmsg+0x100/0x170 net/socket.c:2433 __sys_sendmsg+0xe9/0x1c0 net/socket.c:2462 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that warnings are only emitted for unexpected errors. This aligns with the common kernel practice of not warning on -ENOMEM. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Jenkins REST API in versions 2.579 and earlier (LTS 2.568.2 and earlier) fails to escape map keys during JSON and Python serialization, enabling authenticated users who can control map property names to inject arbitrary fields into API responses consumed by downstream tooling or users. The flaw (CWE-116, improper output encoding) is rated CVSS 4.3 Medium with integrity-only impact and requires low-privilege authenticated access. No public exploit code or CISA KEV listing has been identified; vendor patches 2.580 and LTS 2.568.3 were released on 2026-09-02.

HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.

CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.

LDAP injection in the Drupal LDAP / Active Directory Integration module (versions below 2.2.1) allows unauthenticated remote attackers to manipulate LDAP query structure by submitting unsanitized input containing LDAP special characters. The primary confirmed impact is partial confidentiality loss — directory enumeration or partial authentication bypass — with no integrity or availability impact per the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible attack vector makes it straightforward to attempt against exposed instances.

Email content injection in the CatalogX WordPress plugin before 6.1.3 allows unauthenticated attackers to permanently plant unsanitized content into product enquiry notification emails delivered to site administrators. The injected payload is stored server-side upon submission of a product enquiry and is included verbatim in the administrator notification email each time any subsequent visitor triggers a new enquiry. A publicly available proof-of-concept exists; no public exploit confirmed as actively exploited per CISA KEV.

CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.

Code injection in yaojingang GEOFlow versions up to 2.1.0 allows a remote superadmin to execute arbitrary PHP on the server by submitting a malicious Blade template payload to the preview function of the Superadmin Theme Editor (SiteThemeEditorController.php). A publicly available proof-of-concept exploit has been disclosed via GitHub issue #60, and the attack requires no user interaction beyond the attacker's own authenticated session. Vendor-released patch version 2.1.1 resolves the issue; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. No active exploitation or public proof-of-concept has been identified; the CVSS 4.0 score of 2.1 reflects significant compound preconditions required for exploitation.

Remote code injection in SeaCMS 13.6 and earlier allows unauthenticated network attackers to execute arbitrary code by passing malicious input through the `searchtype` parameter, which flows into the `parseIf` function of the template engine in `search.php` without adequate sanitization. A public proof-of-concept exploit has been disclosed on GitHub under the title 'cascade-template-rce,' materially lowering the attack threshold for any internet-exposed instance. No vendor-released patch has been identified at time of analysis; publicly available exploit code exists.

Arbitrary host filesystem write is achievable via two distinct attack paths in an OCI image-handling component: symlinks planted inside OCI image layers that resolve outside the container root during image extraction, and newline characters injected into oci.dns.* annotation values that corrupt host-side configuration files written from those annotations. Both paths allow an attacker who controls an OCI image to write attacker-controlled data to arbitrary paths on the host system, breaking container isolation. No public exploit has been identified at time of analysis, and no CVSS data is available from the source record.

Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker-specified hosts by embedding bare carriage return characters in URLs supplied to gitoxide operations. Because gitoxide fails to sanitize these control characters before constructing credential helper protocol messages, injected fields override the legitimate host value, causing helpers to return stored credentials for a host the attacker controls rather than the intended repository host. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 2.3 reflects the high complexity, attack prerequisites, and user interaction requirements that substantially constrain real-world exploitability.

Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.

In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() It's pointless to call WARN_ON() in case of an allocation failure in dev_change_net_namespace() and device_rename(), since it only leads to useless splats caused by deliberate fault injections, so avoid it. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

HTTP response splitting in cpp-httplib 0.49.0 allows an attacker who can influence chunked response trailer values to inject arbitrary headers into the HTTP response stream, potentially forging responses seen by downstream clients. The trailer-writing path in write_content_chunked() is the sole code path in the library that omits the CRLF validation applied by set_header() and every other header-writing function, meaning attacker-controlled CR/LF sequences pass directly to the socket. No public exploit code and no CISA KEV listing have been identified; the fix is confirmed in version 0.50.0 via upstream security advisory GHSA-2r2h-jc8w-w66c.

Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.

Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.

Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.

NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.

RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.

Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines by supplying email values containing CR/LF characters at the login endpoint. The vulnerability traces to a misuse of WTForms validation - the code constructed a validator object via Email(email) without invoking it, leaving attacker-controlled input unsanitized before it was interpolated into both the standard warning logger and the custom audit logger via Python f-strings. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially executable with a single HTTP request against any network-exposed deployment, and its impact falls directly on security logging integrity rather than application confidentiality or availability.

CSV injection in Dool through version 1.3.8 allows a local attacker who can control process names on a monitored host to plant malicious spreadsheet formulas into CSV exports. When an administrator or analyst opens the exported file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the injected formula executes in that application's context. Reported by CERT-PL and tracked as EUVD-2026-67128, the issue has an upstream fix via GitHub PR #117, though no officially tagged release containing the patch has been independently confirmed. No public exploit code or CISA KEV listing is identified at time of analysis.

Arbitrary code execution across entire WordPress multisite networks is possible in the Defender Security plugin (versions 5.0.0 through 6.1.x) due to a missing access control check on a network-wide setting. Any site-level administrator on a multisite installation - a role with significantly lower trust than a network/super administrator - can modify this setting to inject and execute code affecting all sites on the network. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), but SSVC rates technical impact as 'total', consistent with the network-wide RCE consequence if exploited by a malicious or compromised site admin.

Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.

Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.

Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.

MIME header injection in Apache Camel's camel-mail MimeMultipart data format allows unauthenticated network senders to plant Camel-internal namespace headers onto the Camel Exchange when headersInline is set to true, potentially redirecting what downstream route components - such as camel-sql - execute. Versions 2.17.0 through 4.14.8, 4.15.0 through 4.18.3, and 4.19.0 through 4.21.x are affected across all release lines until the current fixes. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% and SSVC rates exploitation status as none, making this a patch-priority rather than emergency-response item for most organizations.

Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.

Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.

Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.

Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.

Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Line-protocol injection and log spoofing in Spring Micrometer's StatsD and LoggingMeterRegistry components allow network-reachable attackers to forge arbitrary metrics and log entries by embedding newline characters into user-supplied strings that flow unvalidated into meter names, tag keys, or tag values. Affected deployments span the 1.9.x through 1.17.x release lines of io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core when the Datadog or Etsy StatsD flavor is active, or when LoggingMeterRegistry is in use. No public exploit has been identified at time of analysis, though the integrity-focused impact carries real risk for organizations whose incident-response workflows depend on Micrometer-sourced telemetry.

XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.

XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.

Terminal escape sequence injection in broot, the interactive Rust-based file tree navigator by Canop, allows any local user with filesystem write access to plant control characters in a filename and have them written verbatim to the terminal of any other user who browses that directory with broot. The vulnerable code path - to_string_lossy() in src/tree/tree_line.rs and src/tree_build/builder.rs - applies no control-character filtering despite an existing doc comment implying sanitization occurs. A proof of concept embedding an OSC 52 clipboard-write sequence confirmed that raw escape bytes reach the terminal unstripped; the terminal emulator then determines the actual impact, ranging from cosmetic disruption to clipboard hijacking. No public exploit identified at time of analysis beyond the reported proof of concept; the vulnerability is not listed in CISA KEV.

Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.

Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.

Remote code injection in chenhg5 cc-connect up to version 1.4.1 allows unauthenticated network attackers to execute arbitrary code by manipulating the `exec` argument passed to the `Authenticate` function in `core/webhook.go`. Tagged by reporters as RCE-capable, the vulnerability stems from unsanitized user input reaching a code execution path within the Go webhook handler. A public exploit has been disclosed; no patch has been released, as the upstream GitHub issue was closed automatically due to maintainer inactivity - leaving affected deployments without an official remediation path.

LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language queries under the permissions of a targeted Splunk administrator. The attacker must phish an admin-role user into opening a specially crafted link (CVSS UI:R/AC:H), making opportunistic mass exploitation unlikely, but a successful attack can expose all data indexed and accessible to that admin or corrupt lookup tables. Vendor-released patches are available for all affected branches; no public exploit code and no CISA KEV listing have been identified at time of analysis.

GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.

IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. No public exploit identified at time of analysis; IBM has released a patch via its support portal.

YAML injection in volsync-addon-controller enables a highly privileged, network-capable attacker to break out of YAML value context when annotation values are rendered into OLM Subscription resources, allowing unauthorized modification of OpenShift operator lifecycle configuration. The root cause (CWE-94) is unsanitized interpolation of Kubernetes annotation strings into generated YAML, and the impact includes high integrity and availability consequences for cluster software management. Exploitation is gated behind high-privilege cluster access and the non-default 'volsync-addon-deploy-type: olm' annotation; no public exploit or CISA KEV listing has been identified at time of analysis.

Prompt injection in Context7 through version 2.1.2 allows an attacker with low-level write access to the Custom AI Instructions configuration to plant malicious directives that hijack connected AI coding agents when those agents make routine library documentation requests via the MCP server. The poisoned instructions cause the agent to exfiltrate credentials from environment files (such as .env files containing API keys and tokens) to an attacker-controlled endpoint, and to perform destructive file deletion on the victim developer's machine. No active exploitation has been confirmed in CISA KEV, but no public patch version has been independently verified at time of analysis.

Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.

Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.

Server-side template injection in JumpServer prior to 4.10.17 enables an authenticated administrator with Applet Host management and deployment permissions to plant Jinja2 expressions in the IP/Host or Core Service Address fields, which Ansible then evaluates as live template expressions during Applet Host deployment, yielding arbitrary OS command execution on the JumpServer control node. The patch was released in v4.10.17, confirmed via the GitHub release tag, and no public exploit code or CISA KEV entry has been identified at time of analysis. Because the control node manages downstream bastion targets, a successful exploit has blast radius well beyond the JumpServer process itself.

Terminal escape sequence injection in powerlevel10k (all versions through 1.20.17) allows any attacker who controls a package.json file on a victim's filesystem to emit arbitrary terminal control sequences on every shell prompt render when the victim navigates into the affected directory. The `prompt_package` segment in `internal/p10k.zsh` passed the `P9K_PACKAGE_VERSION` variable to the terminal without applying Zsh's `(V)` sanitization flag, meaning raw ANSI or OSC escape bytes in the version field reach the terminal emulator unfiltered. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 4.8 reflects limited integrity impact and required user interaction.

Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.