Code Injection

Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.

Code injection in Jij-Inc Jij-MCP-Server 0.1.0 enables remote attackers with low-privilege authenticated access to execute arbitrary Python code by manipulating the `code` argument passed to the `PythonREPL.run` function within the `jm_check` component. A public proof-of-concept exploit has been disclosed, and the vendor has not responded to the responsible disclosure filed via GitHub issue tracker. No CISA KEV listing is present, but the availability of public exploit code elevates operational risk well above what the low CVSS 4.0 score of 2.0 would suggest in isolation.

Code injection in iatsiuk pptr-mcp through version 0.2.7 enables authenticated remote attackers to execute arbitrary code via the `executeCode` function in `src/vm-executor.ts`, a component of the MCP `execute` tool. The underlying sandbox fails to isolate user-supplied input from the execution context, a class of vulnerability closely associated with Node.js `vm` module escapes. A publicly available proof-of-concept exists on GitHub, and the project maintainer has not responded to responsible disclosure, leaving all known deployments unpatched.

Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.

Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.

LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.

LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.

LDAP injection in Hyperledger fabric-ca allows unauthenticated network attackers to manipulate LDAP search filters at the CA enrollment endpoint before password validation occurs. Versions 1.5.20 and earlier are affected when the LDAP backend is configured; installations using the default local identity store are not exposed. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but a vendor-released patch is available in version 1.5.21.

Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.

Newline injection in rsync's name-converter uid/gid mapping interface (all versions before 3.5.0) allows local attackers to forge protocol messages by embedding newline characters in OS-level user or group names. Because the rsync daemon communicates with the name-converter over a pipe-based, line-oriented protocol, injected newlines create false protocol boundaries, causing the daemon to parse attacker-controlled strings as legitimate protocol directives and corrupting uid/gid mapping logic. No public exploit code and no CISA KEV listing are identified at time of analysis; rsync 3.5.0 was designated a major security release to address this issue.

Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.

Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.

Arbitrary file truncation in GitPython before 3.1.56 enables an attacker who can control keyword arguments forwarded to Commit.count() to blank any file accessible at the process's privilege level by injecting output=<path>, which causes git rev-list to open and truncate the target to zero bytes before revision parsing. The unguarded sink at commit.py:290-291 is a distinct, overlooked parallel to the sibling iter_items method, which carries the check_unsafe_options guard; this gap persisted after GHSA-956x-8gvw-wg5v addressed iter_commits and blame. No CISA KEV listing is present, but a proof-of-concept was verified on tag 3.1.53 and is published in the GHSA advisory.

Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.

Sequential DNS transaction IDs in Ubuntu's DNS resolver implementation allow network-adjacent or on-path attackers to inject forged DNS responses by predicting transaction IDs. The vulnerability undermines the randomness that DNS relies on to authenticate responses, enabling cache poisoning attacks that redirect legitimate domain resolutions to attacker-controlled addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and has proven exploitable historically.

Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.

TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.

Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.

Terminal escape sequence injection in Bash-it's barbuk theme (versions through 3.2.0) permits a local attacker to execute arbitrary OSC and CSI terminal control sequences in the context of a victim user's terminal emulator simply by placing a crafted pyproject.toml in any directory the victim navigates into. The root cause is that the barbuk theme's __python_venv_prompt function reads the requires-python field via awk without stripping control characters, then concatenates the raw value into PS1 through __prompt-command, causing injected sequences to render on every prompt refresh. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack is low-complexity given the vendor-confirmed fix commit.

Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and SSVC assessment characterizes exploitation status as none with a non-automatable attack path.

MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.

Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Terminal escape sequence injection in npm-check-updates through 23.0.2 enables a supply-chain attacker who controls a malicious npm package's metadata to embed arbitrary VT100/OSC control sequences in the `homepage` or `repository` URL fields of `package.json`. When developers run `ncu --format homepage` or `--format repo`, these unfiltered sequences are written directly to the terminal, allowing output overwriting via bare carriage returns, terminal title hijacking via OSC sequences, and other display manipulation on developer workstations or CI runners. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix PR's test suite demonstrates the exact attack pattern using OSC title-setting sequences and CR overwrites.

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free. Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init(): 1. Load kvm.ko and kvm-intel.ko, creating both caches. 2. Unload only kvm_intel, leaving kvm.ko loaded. 3. Reload kvm_intel and force initialization through the -ENOMEM path. KASAN reports: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm] Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe. With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.

Cache poisoning in CoreBunch/Instatic through version 0.0.14 allows unauthenticated remote attackers to corrupt the shared process-wide render cache by supplying a crafted originating-page URL via the `u` query parameter of the server island endpoint `GET /_instatic/hole/<nodeId>`. Because the cache is keyed solely on `nodeId` without incorporating the `u` value, a single poisoning request causes every subsequent visitor requesting that node to receive attacker-controlled fragment content. No public exploit code has been identified and no CISA KEV listing exists; the product's early-stage, niche deployment footprint limits real-world blast radius, but the unauthenticated network vector and low attack complexity make exploitation straightforward against exposed instances.

Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.

Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.

Message injection into Controller-Pilot Data Link Communications (CPDLC) enables remote attackers operating over radio frequency to insert false emergency or operational status messages into aviation communication channels, causing flight crews, air traffic controllers, and ground operations personnel to misallocate resources or take unsafe response actions. Disclosed by CISA ICS-CERT under advisory ICSA-26-219-01, this vulnerability affects CPDLC-equipped aircraft avionics and ATC ground systems globally, with high integrity impact to both the vulnerable communication system and downstream aviation safety systems. No public exploit has been identified at time of analysis, though the high attack complexity constrains the threat actor population to technically sophisticated adversaries with aviation-domain knowledge and RF transmission capability.

Session injection in the Datadog Android app (versions prior to 5.9.2) allows any zero-permission co-installed application to hijack the victim's Datadog identity by delivering crafted OAuth tokens directly to an unguarded exported activity, which auto-logs the victim in under an attacker-controlled identity without backend token validation. The vulnerability stems from AppActivity being declared android:exported='true' with no permission guard, accepting and persisting arbitrary UserSession data deserialized from intent Bundle extras. SSVC assessment lists exploitation as none and no public exploit has been identified, but the zero-permission precondition dramatically lowers the attacker capability bar.

CRLF injection in libvirt's virtual network driver enables privileged users holding network-definition rights to inject arbitrary dnsmasq configuration directives - including dhcp-script - into the generated dnsmasq config file, ultimately achieving arbitrary command execution as root on the hypervisor host. The root cause is the network XML parser's failure to strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes before writing them verbatim into the dnsmasq configuration. No public exploit has been identified at time of analysis, though an upstream fix commit exists in the libvirt GitLab repository; the official CVSS score of 2.3 appears to critically understate the impact relative to the described root code execution primitive.

HTTP header injection in TeamDavid's Webbox component allows unauthenticated remote attackers to inject arbitrary HTTP response headers by embedding line feed (LF) characters in request body data sent to the link storing endpoint (//ServerClient_celink.htm). The injected data is appended unsanitized to the Location header of the 302 redirect response, enabling an attacker to control response headers against any user who interacts with a crafted link. This flaw is one of 22 CVEs disclosed by InfoGuard Labs in the David platform (marketed as a secure M365 alternative); no public exploit code or active exploitation has been identified at time of analysis.

Log injection and unauthenticated denial-of-service in OpenReception appointment-booking-software prior to version 1.0.2 expose security operations teams to forged log events indistinguishable from legitimate application output. Any unauthenticated network attacker can POST arbitrary content to the `/api/log` endpoint, inject newline-delimited fake log lines into stdout and downstream SIEM pipelines, mask malicious activity behind crafted noise, or saturate the logging pipeline at 100+ requests per second. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the trivial exploitation bar (no authentication, no special conditions, default configuration) warrants prompt patching.

Code injection in FoundationAgents MetaGPT versions 0.8.0 through 0.8.2 allows a local attacker with low-privilege credentials to inject and execute arbitrary code within the application's process context. The vulnerability (CWE-74) affects an unspecified function and produces low-severity confidentiality, integrity, and availability impacts with no lateral scope change to other systems. A public exploit is available via GitHub gists linked in the CVE references; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 base score of 1.9 reflects the constrained local-only attack surface.

Code injection in MetaGPT's DataInterpreter role (versions 0.8.0-0.8.2) enables a local low-privileged user to inject and execute arbitrary code through the `DataInterpreter` function in `metagpt/roles/di/data_interpreter.py`. A public proof-of-concept exploit is available via GitHub Gist, though the CVSS 4.0 score of 1.9 reflects the constrained blast radius: local-only access, low-privilege requirement, and limited impact (low C/I/A, no scope change to subsequent systems). The vendor did not respond to pre-disclosure notification, leaving patch status unresolved.

CSS injection in the Mermaid JavaScript diagramming library (npm) allows sibling CSS combinators (`~` and `+`) to escape the diagram's SVG container and apply attacker-controlled styles to adjacent DOM elements on the host page. Affected are applications using Mermaid below v11.16.1 or below v10.9.8 that render user-supplied diagram source and where the SVG element has sibling nodes in the DOM - a non-default condition. An attacker supplying malicious diagram content can perform UI redressing, hide legitimate page content, or create phishing-style visual overlays; the vendor explicitly confirms JavaScript execution is not possible via this vector. No public exploit tool is identified at time of analysis, though a working proof-of-concept payload is embedded in the GitHub security advisory.

CSS at-rule injection in html_sanitize_ex (Elixir, versions 0.3.1-1.5.3) allows unauthenticated remote users to embed `@import` directives that survive sanitization and are rendered in other users' browsers. The `HtmlSanitizeEx.Scrubber.CSS.scrub/1` function applied its allowlist exclusively to `property: value` declaration patterns; `@import` at-rules, which are syntactically distinct, were never inspected and passed through verbatim. Three distinct bypass paths existed: bare `@import url(...)`, no-whitespace `@import"url"`, and CSS hex-escaped `@\69 mport`. No public exploit code is identified at time of analysis; a vendor patch is available as version 1.5.4.

Email header injection in Element Pack Addons for Elementor (versions up to and including 8.3.15) allows unauthenticated network attackers to append arbitrary headers to contact form emails by submitting newline characters via the `element_pack_contact_form` AJAX action. Insufficient sanitization of CRLF sequences in user-supplied input enables header manipulation - enabling BCC/CC abuse, From spoofing, or use of the site as a spam relay. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV; however, exploitation requires no authentication and trivial technical skill, making opportunistic mass abuse realistic against any unpatched installation.

FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to inject arbitrary authenticated FTP commands when a victim syncs to a more-privileged FTP destination using a non-default encoding that exposes raw CR/LF. The dependency `github.com/jlaffaye/ftp` passes command arguments directly onto the line-oriented FTP control channel via `textproto.Conn.Cmd` without stripping newlines, and the GHSA advisory confirms a real FTP server executed the injected `DELE` command during researcher testing. No public exploit code and no CISA KEV listing are identified at time of analysis; the vendor-released fix is v1.75.0.

Code injection in Electron's DevTools API permits arbitrary script execution in the DevTools context via an unsanitized `mode` parameter supplied to `webContents.openDevTools()`. Unsandboxed Electron applications where untrusted input reaches the `mode` argument - or where untrusted content embedded in a `<webview>` element can invoke `openDevTools()` - are exposed to full Node.js-level code execution on the host operating system. No public exploit has been identified at time of analysis, but Electron's own GitHub Security Advisory (GHSA-4f78-qhmw-8j8m) confirms the flaw and vendor-released patches are available across all active release tracks.

Code injection in VibeSurf's Python Validation Handler enables remote unauthenticated attackers to inject and execute arbitrary Python code by manipulating the /code endpoint. All versions up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0 are confirmed affected per EUVD-2026-52704. No patch is available - the vendor did not respond to disclosure - and a public proof-of-concept exists (CVSS 4.0 E:P, corroborated by an asciinema recording in the references), making exploitation accessible to low-skilled attackers.

Code injection (CWE-94) in Microsoft Edge (Chromium-based) enables network-based spoofing attacks against users who interact with attacker-controlled content. An unauthorized remote attacker can exploit improper code generation controls to inject and execute code within the browser's execution context, crossing security scope boundaries (S:C) to spoof content or interfaces presented to the victim. No public exploit has been identified at time of analysis (E:U temporal metric), and Microsoft has released an official fix via the MSRC update guide.

CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. A public proof-of-concept repository exists; no CISA KEV listing is present, and no public exploit exploitation in the wild has been confirmed at time of analysis.

LDAP filter injection in Bouncy Castle bc-java before 1.85 allows network-reachable attackers to manipulate LDAP directory search queries by supplying certificates with crafted Subject or Issuer CN values containing LDAP metacharacters. This is a bypass of the CVE-2023-33201 fix: the escaping was applied to the main-Java LDAPStoreHelper and both X509LDAPCertStoreSpi variants, but the jdk1.4 Ant build overlay carries its own private parseDN method that was never patched, leaving bcprov-jdk14 consumers exposed. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

CSV formula injection in BaserCMS enables a remote unauthenticated attacker to embed malicious spreadsheet formulas into user-controlled fields within the CMS. When a privileged user exports affected data as a CSV and opens it in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of that application on the victim's workstation. The CVSS Scope:Changed (S:C) rating reflects that impact escapes the web application boundary entirely, affecting the victim's local system. No active exploitation (KEV) has been confirmed and no public exploit code has been identified at time of analysis.

Prototype pollution gadget in the axios npm HTTP client silently injects Authorization headers or tampers query-string serialization when Object.prototype has already been polluted by a separate component sharing the same JavaScript process. Affected versions 0.8.0-0.32.x and 1.0.0-1.17.x fail to apply own-property guards when cloning nested config objects such as auth and paramsSerializer, allowing inherited string values from a polluted prototype to surface as request credentials or serializer overrides. No public exploit has been identified at time of analysis, and exploitation is entirely conditional on chaining with a pre-existing prototype pollution vulnerability elsewhere in the application or its dependency tree.

Prototype-pollution read-side gadgets in axios versions >=1.15.2 and <1.18.0 allow an attacker who already controls a separate prototype-pollution primitive in the host application to inject attacker-chosen Basic auth credentials into outbound HTTP requests. When axios processes a request with an own auth object that omits the username or password properties, it falls through to read Object.prototype.username and Object.prototype.password, constructing a forged Authorization: Basic header. Exploiting this requires chaining with a pre-existing prototype pollution vulnerability - axios itself does not pollute prototypes - and no public exploit or CISA KEV listing exists at time of analysis. The vendor-released patch is axios 1.18.0.

CSS injection in the Spectra Legacy WordPress plugin before version 2.20.0 allows authenticated Contributors to embed arbitrary CSS via unvalidated block style attributes that are output verbatim to page front-ends. Anonymous visitors loading affected pages are exposed to attacker-controlled styles enabling page defacement, UI redressing, external resource loading, and side-channel data exfiltration through CSS attribute selectors. JavaScript execution is explicitly blocked by WordPress KSES filtering, constraining the worst-case impact; a publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.12% (2nd percentile), indicating low observed exploitation probability and no CISA KEV listing.

CRLF injection in ufirstgroup's ymlr Elixir YAML library (versions 0.0.1 through < 5.1.6) allows an attacker who controls comment strings passed to any Ymlr document function to inject arbitrary content into the generated YAML output by embedding newline characters. Because ymlr emits each comment as '# {string}\n' without inspecting the string for embedded line breaks, anything after the first newline exits comment context and is written as raw YAML body content, enabling forged mapping keys, value overrides, and document-boundary markers. Every document-encoding entry point - document!/2, document/2, documents!/2, and documents/2 - shares the same vulnerable code path. No confirmed active exploitation or public exploit code exists at time of analysis; the CVSS 4.0 score of 2.1 reflects the constrained preconditions required.

Incomplete HTTP parameter pollution validation in Keycloak's keycloak-services component exposes OIDC authentication flows to session fixation and account confusion attacks. The security check inspects only the query string of redirect URLs while ignoring the URL fragment, enabling an attacker to inject duplicate security parameters when a client is configured with a wildcard redirect URI. No public exploit has been identified at time of analysis; the CVSS score of 3.4 (AC:H, UI:R) correctly reflects that exploitation requires both a permissive wildcard redirect URI configuration and a non-spec-compliant client application that trusts attacker-injected parameters over Keycloak-issued values.

Code injection in Amazon's @aws-amplify/codegen-ui-react before 2.20.6 lets a remote authenticated Amplify Studio user embed attacker-controlled code into generated React components by supplying crafted component or theme schema values (CWE-94). The malicious code executes wherever the generated artifacts run - end-user browsers, developer machines, CI/CD pipelines, and server-side rendering contexts - giving broad code-execution reach. This is a bypass of the input validation added for CVE-2025-4318, which proved insufficient in coverage and effectiveness; no public exploit has been identified at time of analysis, though a vendor patch (v2.20.6) is available.

LDAP filter injection in Apache Zeppelin's LdapRealm component allows remote attackers to manipulate LDAP search filter expressions by exploiting a wrong escaping scheme applied to user-supplied input during authentication. Versions 0.11.1, 0.11.2, and 0.12.0 incorrectly apply RFC 4514 distinguished-name escaping - which neutralizes DN metacharacters - instead of RFC 4515 filter-value escaping, leaving LDAP filter metacharacters such as parentheses, asterisks, and backslashes unsanitized in constructed search filters. This is an incomplete fix of CVE-2024-31867; no public exploit has been identified at time of analysis.

LDAP injection in Apache Zeppelin's ActiveDirectoryGroupRealm allows authenticated attackers to manipulate LDAP filter construction through the user-search endpoint, potentially exposing Active Directory user and group information across all versions 0.6.0 through 0.12.0. The role-lookup path following successful LDAP authentication is also vulnerable, broadening the exposure surface within directory-integrated deployments and introducing a secondary risk of authorization bypass by influencing group-membership query results. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; Apache Zeppelin 0.12.1 resolves this issue.

Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries via crafted malicious network traffic, requiring only passive user interaction such as visiting a compromised page. The vulnerability stems from insufficient input validation (CWE-20) in the iOS-specific Chrome codebase, which uses Apple's WebKit engine rather than Blink. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS probability sits at 0.19%, placing it in the 9th percentile of exploitation likelihood.

Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applications pass duck-typed blob-like bodies whose type property is populated from untrusted input. Affected are the 6.x branch before 6.28.0, all 7.x releases from 7.0.0 through 7.28.x, and all 8.x releases from 8.0.0 through 8.8.x, when callers use the request, stream, pipeline, or dispatch APIs with hand-rolled blob-shaped objects rather than native Blob instances or the fetch API. An attacker who controls the type value can append arbitrary HTTP headers to the outgoing request, potentially smuggling a second request past an upstream proxy or server. No public exploit identified at time of analysis and KEV status is not confirmed in the provided data.

Terminal control sequence injection in diff-so-fancy exposes developers to output manipulation, filename spoofing, terminal screen clearing, and clipboard hijacking when viewing diffs containing attacker-controlled content. The application filters only ANSI SGR sequences while passing OSC, CSI, carriage returns, and other VT100 control characters through unsanitized to the terminal, affecting all versions prior to commit 9c81294. No public exploit is identified at time of analysis, but the low attack complexity (CVSS 4.0 AV:L/AC:L) means the primary barrier is only the requirement for a developer to actively view the malicious diff.

Header injection vulnerability in tiny-http through version 0.12.0 allows attackers to inject CRLF bytes into HTTP header values, enabling response splitting, cache poisoning, and session fixation. No active exploitation reported, but proof-of-concept code is publicly available in a GitHub repository. The library's insufficient validation of header values enables this injection primitive against line-feed-tolerant backends.

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject previously masked interrupts. KVM handles these VM exits in handle_tpr_below_threshold(). Commit eb90f3417a0c ("KVM: vmx: speed up TPR below threshold vmexits") optimized this function by calling apic_update_ppr() instead of raising KVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is a pending, deliverable interrupt. However, if there are no new interrupts pending, apic_update_ppr() does not issue the request. Thus, kvm_lapic_update_cr8_intercept() and vmx_update_cr8_intercept() are not called before VM entry, which results in a high, stale TPR_THRESHOLD. This is problematic due to the following sentence in 28.2.1.1 "VM-Execution Control Fields" in the SDM: The following check is performed if the “use TPR shadow” VM-execution control is 1 and the “virtualize APIC accesses” and “virtual-interrupt delivery” VM-execution controls are both 0: the value of bits 3:0 of the TPR threshold VM-execution control field should not be greater than the value of bits 7:4 of VTPR. This error condition is typically not observed when KVM runs on a bare metal system because modern processors support APICv, which enables virtual-interrupt delivery, and which KVM uses when possible. This causes the processor to no longer generate TPR-below-threshold exits and to no longer check TPR_THRESHOLD on entry. However, when running on older platforms, or under nested virtualization on a hypervisor that does not support virtual-interrupt delivery and enforces this check (like Hyper-V) this can cause a VM entry failure with hardware error 0x7, as seen in [1]. Call kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not find a deliverable interrupt (and thus does not raise KVM_REQ_EVENT). Remove calls to kvm_lapic_update_cr8_intercept() on paths that end up in apic_update_ppr(), as they now become redundant. This ensures that any path that updates the guest's PPR also figures out if KVM needs to wait for a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM).

Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.

Remote code execution in Cal.com's cal.diy product before 5.9.9 allows an unauthenticated attacker to run arbitrary code on the server by sending a crafted React Server Components (RSC) request. The flaw stems from a bundled vulnerable Next.js version (upstream CVE-2025-55182) that unsafely deserializes attacker-controlled input in the React flight protocol. Rated CVSS 4.0 10.0 (critical) with no authentication or user interaction required; no public exploit identified at time of analysis, though the underlying Next.js class of bug is well documented via the GHSA advisory.

XML injection in Qt's QDom serialization component (versions 4.0.0 through 6.11) allows untrusted text passed to comment, CDATA, and processing-instruction nodes to break out of those structures and inject arbitrary XML markup into serialized output, because the default InvalidDataPolicy (AcceptInvalidChars) does not escape node terminators such as '-->', ']]>', or '?>'. The CVSS 4.0 score of 2.9 reflects an attack timing prerequisite (AT:P) - only applications that actively pass attacker-controlled content through QDom serialization are exploitable; the Qt library itself is not a standalone attack surface. No public exploit is identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 threat metric E:P suggests proof-of-concept code may exist.

DNS cache poisoning in Unbound 1.6.0 through 1.25.1 allows a remote, unauthenticated attacker to inject a falsely DNSSEC-secure wildcard record into the resolver cache by exploiting a race condition on the serve-expired code path. The flaw arises because wildcard RRSET entries can be briefly marked secure after RRSIG validation but before NSEC validation completes, and a concurrent serve-expired thread can capture and propagate that intermediate secure status before it is corrected to bogus. No public exploit has been identified at time of analysis and CISA KEV does not list this vulnerability, but the integrity impact on DNSSEC-relying downstream clients makes it notable for operators running serve-expired in recursive resolver deployments.

Arbitrary shortcode injection in the Contact Form 7 - Dynamic Text Extension WordPress plugin (all versions ≤ 5.0.6) allows unauthenticated remote attackers to execute any registered WordPress shortcode on the target site by submitting crafted form input that bypasses input validation before reaching the native do_shortcode() function. The blast radius depends on what shortcodes are registered by other installed plugins, making high-privilege shortcodes the real threat multiplier. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, a partial patch shipped in 5.0.4 was insufficient, leaving sites on all sub-5.0.7 versions exposed.

XML injection in @astrojs/rss (all versions from 1.0.0 through 4.0.18) allows an attacker who can supply content to the `source.title` or `enclosure.type` RSS feed item fields to break out of XML string templates and inject arbitrary XML elements into the generated feed. The root issue is that both fields are interpolated directly into raw XML strings before `fast-xml-parser` processes them, with no escaping applied, so XML metacharacters are treated as markup rather than text. A public proof-of-concept is confirmed in the GitHub Security Advisory; no CISA KEV listing is indicated, and EPSS data was not provided in the available intelligence.

HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into password-reset emails delivered to registered site users, enabling targeted phishing from a trusted site domain. The flaw affects all Kirki versions below 6.0.12 and requires no authentication to trigger, though successful exploitation depends on the target user interacting with the malicious email. A publicly available POC exists per WPScan; the vulnerability is not currently listed in CISA KEV, and the 0.10% EPSS score (1st percentile) indicates minimal observed automated exploitation.

Remote code execution affects safishamsi GRAPHIFY versions 0.3.2 through 0.4.29 via a DNS rebinding attack targeting its URL-fetching subsystem. The functions validate_url, safe_fetch, _build_opener, _fetch_html, and _download_binary are exploitable when a maliciously controlled hostname performs DNS rebinding to bypass the URL validation layer, allowing an attacker to pivot into internal network resources and ultimately achieve code execution. A public proof-of-concept repository exists; no KEV listing is present at time of analysis, though the PoC lowers the bar for exploitation.

Code injection in zevorn rt-claw up to version 0.2.0 allows remote attackers to execute arbitrary code via the Telegram-to-AI Tool Execution Flow. The vulnerable function `tool_run_script_execute` in `claw/services/tools/script.c` fails to sanitize attacker-controlled input before passing it to script execution logic. A public proof-of-concept exploit has been released via GitHub issue #138, and the vendor has not yet responded to disclosure - no patch is available at time of analysis.

NoSQL injection in AhnLab EPP (Endpoint Protection Platform) Management v1.0.14.32-6249 allows an authenticated attacker to manipulate backend NoSQL queries through the eventlog/agentEvent/list endpoint, as the CVSS:3.1 vector (PR:L) indicates a low-privilege authenticated session is required. Successful exploitation yields high confidentiality and integrity impact (C:H/I:H), enabling extraction or tampering of security event-log data across the managed endpoint fleet. A public GitHub repository named for this CVE suggests exploit/PoC material may exist; it is not listed in CISA KEV and no EPSS score was provided.

Stateless reset injection in Quicly, the IETF QUIC implementation embedded in the H2O HTTP server, allows an on-path network attacker to abruptly terminate any active QUIC connection by sending an all-zero packet. The root cause is that Quicly zero-initializes its four stateless reset token slots but never validates which slots hold legitimate peer-advertised tokens, causing the all-zero default to be accepted as a valid reset signal whenever the peer has advertised fewer than four tokens. No public exploit code or active exploitation has been identified at time of analysis; however, the attack is mechanically straightforward for any adversary already positioned on the network path.

TLS certificate verification bypass in Kuma's kuma-dp data plane allows an on-path attacker to intercept the dataplane authentication token and inject a forged bootstrap configuration, effectively taking over the proxy. Affected deployments are Universal mode installations where operators start kuma-dp against an HTTPS control plane without supplying a CA certificate via --ca-cert-file or the KUMA_CONTROL_PLANE_CA_CERT environment variable. Standard Kubernetes installations using kumactl or the official Helm chart are not affected because the mutating admission webhook automatically injects the CA certificate. No public exploit or CISA KEV listing is present at time of analysis; patch releases are available across all supported branches.

Response-queue poisoning in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through before 1.9.3) allows a malicious or attacker-influenced HTTP/1 origin server to desynchronize a strict RFC-compliant intermediary from the Mint client on shared keep-alive pooled connections. The root cause is `Mint.HTTP1.decode_body/5` using Elixir's `Integer.parse/2` for chunked transfer-encoding chunk-size parsing, which accepts RFC-forbidden leading `+` or `-` sign prefixes, causing both parties to disagree on where one HTTP response ends and the next begins. No public exploit has been identified at time of analysis, but a vendor-released patch is available in Mint 1.9.3.

Authenticated injection of TIME_TRACKING and REMINDER note types in MantisBT's SOAP and REST APIs allows UPDATER-level users to corrupt billing data and falsify project records. The `note_type` integer parameter supplied by the caller is passed directly to `bugnote_add()` in the SOAP endpoint - and through `mc_issue_update()` in the REST API - without verifying the caller holds sufficient privilege to create that note type. Attackers with UPDATER access can inject arbitrary billable hours into MantisBT's billing reports, generating fraudulent invoices, and can register fake REMINDER notes via SOAP. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.28.4.

HTTP Response Splitting in Fortinet FortiOS and FortiProxy captive portal authentication flows enables a man-in-the-middle attacker to inject arbitrary HTTP headers into intercepted authentication requests. Affected platforms span FortiOS 7.2-7.6.4 and FortiProxy 7.2-7.6.4. The CVSS temporal vector includes E:P, confirming proof-of-concept exploit code exists; however, no active exploitation has been confirmed via CISA KEV. The RL:O temporal indicator confirms an official remediation is available per vendor advisory FG-IR-26-153.

HTTP Response Splitting in Fortinet FortiOS and FortiProxy enables an attacker who holds a valid web filter override token to inject arbitrary HTTP headers into server responses by tricking a user into clicking a crafted link. Affected versions span FortiOS 7.2 through 7.6.4 and FortiProxy 7.2 through 7.6.4. No active exploitation has been confirmed by CISA KEV, though the CVSS temporal vector includes E:P, indicating partial proof-of-concept evidence exists. Real-world impact is constrained by the requirement to possess a valid web filter override token and to achieve user interaction.

Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.

Stored XSS in Decidim's HTML content blocks allows any administrator with landing-page editing rights to persist arbitrary JavaScript that executes in every visitor's browser. The vulnerability affects the decidim-core RubyGem across three release branches (below 0.30.9, 0.31.5, and 0.32.0) and was confirmed through a professional security audit by Radically Open Security. No public exploit code or CISA KEV listing exists; vendor-released patches are available and the fix has been merged upstream.

CSV formula injection in the PrestaShop module 'The Firmware' version 8.2.1 enables an authenticated attacker to inject malicious spreadsheet expressions via the unsanitized 'Alias' parameter in the address update function. When a victim subsequently exports account data using the 'Get my data in CSV' feature and opens the file in a spreadsheet application, the injected formula executes in that application's context, potentially exfiltrating the victim's personal data or executing commands on their workstation. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.5 reflects the high-privilege and user-interaction prerequisites that constrain exploitability.

Code injection in DedeCMS 5.7.118 exposes high-privileged remote attackers to arbitrary PHP code execution via the Column Name parameter in the Column Management component of `/plus/search.php`. The exploit document on GitHub describes a cache file writing mechanism through which attacker-supplied input is persisted to disk and subsequently executed by the PHP runtime. A public proof-of-concept exists; no active exploitation is confirmed in the CISA KEV catalog.

Remote code injection in pig-mesh Pig's pig-codegen module through version 3.9.2 allows low-privileged authenticated attackers to execute arbitrary code server-side via the GeneratorServiceImpl component, reachable over the network. A publicly available proof-of-concept exploit exists at GitHub (sombra0316/CVE-2026), elevating the urgency for defenders. No vendor patch has been released, and the vendor did not respond to responsible disclosure, leaving affected deployments without an official remediation path.

Code injection in SonicCloudOrg sonic-agent through version 2.7.2 allows remote unauthenticated attackers to inject and execute arbitrary code via the ExchangeController endpoint, which bypasses or is excluded from the JWT Authentication Filter. The vulnerability carries a public proof-of-concept exploit named 'Unauth_ExchangeSend', confirming the endpoint is reachable without authentication. Critically, the affected product is end-of-life with no vendor support, and the maintainer did not respond to disclosure - no patch is forthcoming.

Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (CWE-915) exposes sites to high-severity confidentiality and integrity compromise when triggered by an authenticated user with high privileges. Affected branches include the entire 10.x line before 10.5.12 and 10.6.11, the fully unsupported 11.0.x and 11.1.x trees, and the 11.2.x and 11.3.x lines before 11.2.14 and 11.3.12 respectively. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at just 0.16% (6th percentile), making this a patch-priority rather than emergency-response scenario.

Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamically-determined PHP object attributes, potentially compromising confidentiality and data integrity of the application. Affected versions span multiple active and end-of-life branches: 10.5.x through 10.5.12, 10.6.0 through 10.6.11, 11.2.0 through 11.2.14, 11.3.0 through 11.3.12, and the entirely unsupported 11.0.x and 11.1.x branches. No public exploit code is identified at time of analysis, and EPSS at 0.16% (6th percentile) signals very low observed exploitation activity despite the C:H/I:H impact potential.

Object injection in the Drupal ECA (Event - Condition - Action) contributed module exposes sites running affected versions to limited confidentiality and integrity compromise by authenticated low-privileged users. The vulnerability stems from improperly controlled modification of dynamically-determined object attributes (CWE-915, a mass-assignment class of flaw), allowing a crafted request to inject object properties and influence internal application logic within ECA's event-driven workflow engine. No confirmed active exploitation exists, and EPSS at 0.20% (10th percentile) reflects low observed threat pressure across the landscape, though a vendor patch has been issued per the Drupal security advisory.

Cookie attribute injection in elixir-plug's Plug library allows a remote attacker who can supply values reflected into `Set-Cookie` headers to inject the `;` delimiter and override attributes such as `Domain`, `Path`, `Secure`, and `HttpOnly`. Applications calling `Plug.Conn.put_resp_cookie/4` with user-controlled data - for example, reflecting a username or preference value - are exposed to session fixation and cookie tossing across five supported release lines (0.1.0 through 1.20.2). No public exploit code or CISA KEV listing is present at time of analysis, but the attack is mechanically straightforward wherever the vulnerable code pattern exists.

Prototype pollution in apidevtools json-schema-ref-parser up to v15.3.5 allows low-privileged remote attackers to modify Object prototype attributes via crafted input to the Refs.set/Pointer.set functions in lib/pointer.ts. The vulnerability is tagged RCE and Code Injection, reflecting the theoretical worst-case of prototype pollution in Node.js environments where polluted properties propagate to dangerous sinks; however, the CVSS 4.0 score of 2.1 with limited (L/L/L) impact ratings suggests the direct, exploitable impact is constrained. A proof-of-concept exists (CVSS 4.0 E:P) but no confirmed active exploitation has been recorded in CISA KEV.

Elasticsearch Painless script injection via OpenCTI's GraphQL API allows any authenticated user holding the KNOWLEDGE capability to submit computationally expensive, unvalidated scripts that saturate Elasticsearch cluster CPU, degrading or denying service for the entire platform. All OpenCTI deployments prior to version 7.260401.0 are affected, with the vulnerability residing in the exposed 'script' FilterOperator of the GraphQL API. No public exploit code or CISA KEV listing is confirmed at time of analysis; a vendor-released patch is available in version 7.260401.0.

Custom Code Guardrails in LiteLLM's AI Gateway proxy prior to 1.82.0-stable permitted privileged users with guardrail management rights to submit arbitrary Python code via the production create and update API paths, which executed unsandboxed within the proxy process. Unlike the test endpoint - which enforced sandbox controls - the production paths lacked equivalent validation, enabling the injected code to access and expose secrets, API keys, and environment variables available to the running process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; risk is highest in multi-tenant or multi-operator LiteLLM deployments where guardrail management rights are distributed.

Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, cookie injection, and session fixation when an application makes requests to multiple IP-address-based or bare-numeric-domain hosts within a shared CookieJar session. The SetCookie::matchesDomain() method incorrectly applied suffix-matching logic - valid for FQDN hierarchies - to numeric domain identifiers such as 192.168.0.1, [::1], and bare labels like 1, meaning a cookie set by one numeric host could be forwarded to a structurally related but distinct host. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 7.12.3.

Header injection in Django's DomainNameValidator allows network attackers to inject arbitrary HTTP response headers when applications pass validator-accepted domain values directly into HTTP responses, affecting Django 6.0 before 6.0.7 and 5.2 before 5.2.16. The validator silently accepts embedded newline characters in domain name strings, enabling HTTP response splitting that can facilitate session hijacking, open redirects, or cross-site scripting against end users. No public exploit code or CISA KEV listing exists at time of analysis; practical risk is narrowed significantly by Django's HttpResponse class independently rejecting newlines, meaning only non-standard code paths are exploitable.