Code Injection

Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.

Command injection in the OpenSSH ssh client before version 10.6 occurs when a username supplied on the command line contains a '$' or '\' character, which is not correctly escaped or quoted and can be interpreted as shell syntax. The flaw is assessed as CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and requires the victim to invoke ssh with an attacker-controlled username - for example from a crafted ssh:// URI, a shared connection string, or a script or alias - so it is not remotely triggerable against a default server. No public exploit was identified at time of analysis, EPSS is 0.13% (2nd percentile), and the issue does not appear on CISA KEV; this is a genuine but not emergency-grade issue, and patched clients (10.6 and later) are unaffected.

Authenticated remote code execution affects IBM Langflow OSS 1.0.0 through 1.12.2, where improper control of code generation lets any account with at least low privileges (CVSS PR:L, AV:N, UI:N) cause attacker-supplied code to run server-side on the Langflow host, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation is not possible against a default install without valid credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis. The practical exposure therefore concentrates on internet-reachable or multi-tenant instances that permit self-registration or host untrusted users; isolated, single-tenant, network-restricted deployments with trusted operators carry substantially lower risk.

Authenticated code injection in IBM Langflow OSS 1.0.0 through 1.12.2 lets any remote user holding a valid low-privileged account execute arbitrary code on the hosting server, with high impact to confidentiality, integrity, and availability (CVSS 8.8, PR:L, no user interaction required). The attack surface is the code path where special elements used in code are not properly neutralized (CWE-94), so deployments that allow untrusted or self-registered accounts to author and run flows are the most exposed, while instances with closed registration and no internet exposure are materially less at risk. No public exploit code has been identified at time of analysis, EPSS is only 0.58% (46th percentile), and CISA SSVC rates exploitation as 'none', making this a serious-but-not-emergency issue; a vendor patch is available per IBM's advisory.

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 allows a low-privileged user to run arbitrary code because the platform improperly controls generation of executable code (CWE-94). Exploitation requires only a valid account on the instance (CVSS PR:L, AV:N, AC:L, UI:N), so an attacker who holds or obtains any credential able to create, import, or execute a flow/component that reaches the vulnerable code-generation path can achieve full confidentiality, integrity, and availability impact on the host. No public exploit code was identified at time of analysis, CISA's SSVC assessment records exploitation as "none", and EPSS is 0.58% (46th percentile), placing this as a genuinely serious but not emergency-tier issue whose real-world risk scales with how exposed the Langflow instance is and how freely low-privilege accounts are provisioned.

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows an authenticated attacker with flow-authoring privileges to inject and execute arbitrary code through Langflow's code-generation mechanism (CWE-94). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity (8.8), requiring network reachability, low privileges, and no user interaction; however, in typical deployments where flow creation or modification is broadly granted, the practical barrier may be lower than the PR:L metric implies. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is 0.61% (48th percentile); IBM has released a vendor patch.

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any attacker who can reach the service execute arbitrary operating system commands on the underlying host. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no credentials, no user interaction, and no non-default configuration, so a default Langflow deployment exposed beyond localhost is directly exploitable. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); IBM has published a vendor advisory with a fix, and practical risk is concentrated in self-hosted developer instances that are bound to reachable interfaces rather than being restricted to localhost or placed behind authentication and firewalling.

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any holder of valid credentials - even a low-privileged one - submit or edit a flow that reaches the server-side code-generation and execution path, resulting in arbitrary OS command execution on the Langflow backend. IBM scores it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and classifies the root cause as CWE-94 code injection; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so active exploitation is not confirmed. The decisive risk factor is deployment posture: internet-exposed or multi-tenant instances running with authentication disabled, default or shared credentials, or open self-registration collapse the PR:L barrier and behave like unauthenticated RCE targets.

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows an authenticated attacker to run arbitrary operating-system commands by supplying crafted input to a component that fails to neutralize special elements before passing them to an OS command or code-evaluation path (CWE-94). Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires a valid low-privilege authenticated session on the Langflow instance, needs no victim interaction, and yields full confidentiality, integrity, and availability impact on the affected host. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the practical risk is concentrated on network-exposed Langflow servers that use weak, shared, or default credentials, since a compromised or low-privilege account is the only prerequisite.

Authenticated remote code execution affects IBM Langflow OSS versions 1.0.0 through 1.12.2, where an incomplete blocklist in the built-in code security scanner can be bypassed to execute arbitrary code on the server. Exploitation requires a valid low-privilege account (CVSS PR:L) and the ability to submit code evaluated by the scanner; unauthenticated attackers are not sufficient. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the high CVSS base score of 8.8 and the multi-tenant exposure of typical Langflow deployments make the risk significant where untrusted users can register or be provisioned.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets an authenticated attacker escape the application's code execution sandbox and run arbitrary commands on the host. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network reachability and a low-privileged authenticated session as the only precondition, with no user interaction required. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the low complexity and high impact make this a genuine prioritization concern for internet-exposed or multi-tenant deployments.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 allows attackers to execute arbitrary code via improper control of code generation (CWE-94). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact, though the independent assessment notes the pre-auth condition is not independently confirmed by the description. A vendor patch is available, and no public exploit code has been identified at time of analysis; risk is highest for internet-exposed instances within the affected version range.

Arbitrary code execution in Backstage TechDocs documentation builds allows an authenticated user with write access to a repository registered in the Backstage catalog to run commands on the build host by embedding malicious keys in the repository's mkdocs.yml. Both TechDocs build modes configured locally or in a container (techdocs.generator.runIn set to 'local' or 'docker') are vulnerable because the affected @backstage/plugin-techdocs-node package (prior to 1.14.6, and 1.15.0 through 1.15.3) failed to sanitize nested markdown_extensions and theme configuration values before invoking MkDocs. Exploitation is access-gated rather than anonymous: CVSS 3.1 scores this 8.8 with a PR:L vector, EPSS is low at 0.26% (16th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis.

Arbitrary code execution in AWS Bedrock AgentCore Starter Toolkit before 0.3.14 allows an authenticated same-account actor to inject malicious Python code into generated agent source by importing a crafted Bedrock Agent configuration, which executes when the victim runs or deploys the agent. Exploitation requires the victim to import and then run or deploy the agent, and the actor must have valid same-account credentials. No public exploit identified at time of analysis; remediation requires upgrading to 0.3.14 and re-importing any previously affected agents because the generated source persists.

Authenticated remote code execution in HPE Networking ClearPass Policy Manager allows an attacker who already holds high-privilege administrative access to the management interface to run arbitrary commands on the underlying operating system, potentially leading to full host compromise. The flaw is remotely reachable (AV:N), requires no user interaction (UI:N) and has low attack complexity (AC:L), but its severity is bounded by the CVSS PR:H prerequisite - only administrator-level accounts can trigger it, so exploitation realistically depends on credential compromise, insider access, or chaining from a separate authentication or privilege-escalation weakness. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); with a base score of 7.2, this is assessed as a moderate-priority issue rather than a top-tier emergency, though the confidentiality, integrity and availability impact on a successful hit is high.

Code execution in Handlebars.js versions 4.0.0 through 4.7.9 occurs when an application hands an attacker-controllable, pre-parsed AST object - rather than a template string - to Handlebars.compile() or Handlebars.precompile(); the compiler writes JavaScript expressions carried in unchecked AST fields straight into the generated code, which then executes in the server process wherever the compiled output runs. The flaw is an incomplete fix: the AST validation added in 4.7.9 for CVE-2026-33937 covered only PathExpression, NumberLiteral and BooleanLiteral values, leaving fields such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value and a non-string PathExpression.original unvalidated. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) and treats this as trivially remote and unauthenticated, but that materially overstates real-world exposure: the vulnerable path is a non-default application design pattern that the vendor explicitly warns against, so applications that compile only template strings - the standard, documented usage - are completely unaffected, and no public exploit code has been identified at time of analysis. Vendor-released patch: 4.7.10.

Code injection in the Hydra configuration framework (all releases prior to 1.3.6 and 1.4.0.dev9) lets an attacker who controls the application's Hydra logging configuration name an arbitrary importable class or factory that Hydra will then import and invoke with the application's own privileges. Hydra routes logging settings to Python's logging.config.dictConfig() without applying its own target policy, so the handler 'class' values and the formatter, filter, handler, queue and listener factories are resolved and called directly - this bypasses the _target_whitelist_ protection that otherwise guards instantiate(), meaning even hardened deployments are exposed. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): a local, unprivileged attacker must plant malicious logging configuration (a config file, an override, or a shared/untrusted config source) and the victim must then run the Hydra application, yielding high confidentiality, integrity and availability impact; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but exploitation only requires that the victim execute the tampered configuration.

Code injection in the Reader Mode feature of Google Chrome on iOS (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker bypass the web origin policy by convincing a victim to open a crafted HTML page in the browser. The flaw is confined to the iOS build and depends on social engineering to drive the victim to the malicious page, so effective user interaction is required; impact is limited to a partial confidentiality, integrity and availability loss through origin-policy circumvention rather than full system compromise. No public exploit code has been identified at time of analysis, EPSS is a low 0.27% (17th percentile), and the issue is not listed in CISA KEV, so despite the 7.3 High CVSS the real-world priority is low-to-moderate. Google has shipped a vendor patch, fixed in Chrome 155.0.8059.39.

Remote code execution in Payload CMS before 3.90.0 (and canary builds before 4.0.0-canary.34) lets a remote, unauthenticated attacker execute arbitrary code by sending a crafted request to the public first-register operation. The flaw only applies to instances that have local authentication enabled and have not yet had their first admin user created, i.e. a freshly deployed, re-provisioned, or ephemeral instance still inside its initial setup window; once an admin exists the attack surface disappears. No public exploit identified at time of analysis, and no evidence of active exploitation (not in CISA KEV), though the CVSS 8.1 score with full confidentiality, integrity and availability impact makes this a high-priority fix for anyone running uninitialized deployments.

Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the @payloadcms/plugin-form-builder plugin before 3.90.0 (and 4.0.0-canary versions before 4.0.0-canary.34) is achievable by an authenticated non-admin user, based on the vendor patch, which replaces a permissive 'any logged-in user' read rule with a check that the requester belongs to the configured admin user collection. The published CVE record characterizes the flaw as remote code execution (CWE-94, CVSS 10.0), but the actual shipped fix is an access-control tightening on the Forms and FormSubmissions collections plus tests asserting that users from unrelated collections are denied, so the verifiable impact is a confidentiality breach of form data rather than code execution; these conflicting signals should be reconciled with the vendor advisory before prioritization. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation, but the authorization requirements (the CVSS vector claims unauthenticated, while the patch implies a logged-in non-admin account is needed) should be confirmed against the vendor before assuming unauthenticated exposure.

Openapi-python-client before 0.29.1 fails to neutralize attacker-influenced content from an OpenAPI document when rendering string, docstring, and f-string contexts, so a malicious or untrusted specification can cause arbitrary Python to be emitted into the generated client - code that then executes when that client is imported, compromising the integrity of the importing environment and potentially its confidentiality and availability. Exposure is conditional: it requires someone to generate a client from a spec they do not fully control (a third-party, public, or otherwise untrusted API definition) and then import the generated code, which is the trigger point, so organizations generating only from trusted internal specs are effectively unaffected. The flaw is rated 8.4 under CVSS 4.0 in the source data (independent assessment maps it to CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), which is consistent with a serious but conditionally triggered supply-chain and code-generation issue rather than a remotely reachable mass-exploitation vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in version 0.29.1.

Code injection in Microsoft Kiota 0.5.0 through pre-1.35.0 allows attacker-controlled text embedded in an OpenAPI description to break out of the generated Java or PHP documentation comment and execute in the consuming application or build environment once that generated source is compiled and loaded (Java) or loaded (PHP). The flaw is reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction: a developer or CI pipeline must generate client code from an untrusted or tampered spec and then build or load the output, making this a build-time/supply-chain path rather than an attack on already-deployed runtime services. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; CVSS 3.1 base score is 8.8, and the issue is fixed in 1.35.0.

PHP code injection in the Smarty templating engine allows remote code execution in applications running Smarty 4.x before 4.5.8 or 5.x before 5.8.5 that render templates through the extends:/multi-component inheritance path with caching enabled. When such a template is compiled, the top-level unifunc never restores its nocache_hash, so the value is null; combined with an empty regex alternative in the cache-split logic, attacker-controlled assigned data containing a forged /*%%SmartyNocache:%%*/ marker is copied verbatim (bypassing PHP-tag neutralization) into the regenerated PHP cache file and executed on the next include. Exploitation is unauthenticated per the vendor CVSS vector (PR:N) but is gated by strict preconditions - inheritance-path templates, active caching, unescaped attacker-controlled output, and a fresh PHP process that reloads the compiled file after the cache entry is evicted (TTL expiry or cache clear) while compiled files persist - making it conditional rather than reliably on-demand; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.

A use-after-free and RCU-safety defect in the Linux kernel's IPsec/xfrm transport-mode packet reinjection path can crash or corrupt the kernel, and is reachable by a local low-privilege attacker (CVSS PR:L) who can also trigger network device unregistration. The flaw was introduced when xfrm_trans_reinject() was converted from a tasklet to a workqueue (commit 4f4920669d21), so finish callbacks such as ip6_rcv_finish() now run in process context without an RCU read-side critical section, and queued skbs may hold non-refcounted dst entries whose skb->dev is not kept alive while deferred. Our independent assessment scores this CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (availability-only, high attack complexity), and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and no CISA KEV listing exists.

A teardown race in the Linux kernel's iSER target (ib_isert) frees the isert_conn and iscsit_conn structures while a deferred control PDU completion is still queued on isert_comp_wq, so isert_put_cmd() later dereferences freed memory - a slab use-after-free (KASAN splat) rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because it can in principle lead to kernel code execution, data disclosure, or a crash. Exposure is limited to hosts that run the LIO iSER target with the ib_isert module loaded and export an iSER/RDMA transport over an InfiniBand or RoCE fabric; the CVSS vector shows no authentication prerequisite (PR:N), but the attacker must win a narrow race between connection teardown and the workqueue handler, a window so tight that the reporter needed an injected msleep(200) to reproduce it reliably. No public exploit code and no CISA KEV entry are associated with this issue, EPSS is only 0.16% (5th percentile), and vendor-released stable patches are available.

A missing hardware memory-ordering barrier in the Linux kernel's MIPS EYEQ support lets a local, authenticated user crash the kernel on Mobileye EyeQ5 / MIPS I6500 systems. On I6500 cores the lld/scd (LL/SC) instructions provide no ordering guarantees, so arch_cmpxchg() - documented and relied upon as fully ordered - can be reordered and read freed or uninitialized memory, producing a kernel paging fault and oops (observed in anon_pipe_read while stressing an anonymous pipe, whose mutex uses cmpxchg). Exploitation requires CONFIG_EYEQ hardware, local access, and winning a timing/race window; there is no network vector and no impact on x86, ARM, or other MIPS configurations. The fix commit is public and includes a userspace reproducer (pipe_race.c), so publicly available exploit code exists, but no confirmed active exploitation (not in CISA KEV); EPSS is 0.15% (4th percentile), and the observed outcome is a kernel oops rather than a controlled compromise.

Remote code execution (RCE) in WPShopmart Tabs Responsive plugin for WordPress (versions <= 2.5) allows an authenticated attacker with Editor-level privileges to execute arbitrary code on the server. This high-severity vulnerability (CVSS 8.0, CWE-94) requires high-complexity conditions (AC:H) and no user interaction (UI:N). No public exploit code has been identified at time of analysis; risk is concentrated on multi-user sites where untrusted users have elevated editing roles.

Remote code execution in WooCommerce Designer Pro (versions up to 1.9.33) allows authenticated attackers with Subscriber-level access or higher to execute arbitrary code on the server. The flaw is a code injection (CWE-94) with a CVSS score of 9.9 (Critical), requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability (scope change). Exploitation is most realistic on WooCommerce storefronts that permit open customer self-registration; no public exploit identified at time of analysis. The independent assessment confirms this is a genuine high-priority issue rather than a theoretical risk.

Unauthenticated input injection in ViewSonic vCast, the wireless screen-casting service bundled with ViewBoard interactive displays, lets a remote attacker push crafted HTTP requests at exposed service endpoints and have that data accepted without validation, which public research chains onward to remote code execution. Affected builds span vCast v0.0.0 through v3.2.715 and are reachable over the network with no credentials and no user interaction (CVSS 9.8, AV:N/PR:N/UI:N), so every ViewBoard whose vCast endpoints are network-reachable is exposed; a public technical write-up describing the exploit chain exists (blog.l3afs.space), while no CISA KEV entry confirms active exploitation at time of analysis. All available signals point to genuinely high real-world risk, with the practical limiting factor being network reachability of the vCast service rather than any missing precondition.

Remote code execution in Immich before 3.2.4 lets any authenticated non-admin user with upload permission run arbitrary code inside the immich-server container. The exploit chains two crafted SVG assets: a stored reference asset and a second 'delayed-marker' SVG whose attacker-controlled <image href> value reaches ImageMagick's unrestricted MSL and VIDEO coders after the file bypasses libvips' native SVG loader, with execution occurring when the server generates a thumbnail. The attack is high-complexity and depends on the ImageMagick fallback path being reachable with those coders enabled; version 3.2.4 contains the fix, and no public exploit code was identified at time of analysis.

Remote code execution in Ghost CMS 6.56.0 through 6.66.x lets any authenticated staff user - including the lowest-privilege Contributor role - execute arbitrary commands on the Ghost server by creating a bookmark card that points to an attacker-controlled website serving a crafted SVG. The root cause is a code-injection flaw (CWE-94) in the SVG handling path of an image-processing library bundled with Ghost, and successful exploitation yields full confidentiality, integrity, and availability impact on the host. Exploitation requires a valid Ghost staff login (the vendor vector claims PR:N, but our assessed vector of PR:L/UI:N is the accurate prerequisite), and there is no public exploit identified at time of analysis. Ghost 6.67.0 is the fixed release.

Unauthenticated remote code execution affects dromara/northstar (a quantitative trading platform) through version 9.1.1 and earlier, because the application enables the embedded H2 Console while its authentication interceptor only guards the /northstar/** path, leaving /h2-console reachable with no credentials. Because the embedded H2 database also ships with the default 'sa' account and an empty password, any network-reachable attacker (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 9.8) can use the H2 console's CREATE ALIAS capability to execute arbitrary Java and thereby run arbitrary system commands on the host. Exploitation requires only that the Northstar instance be reachable over the network; there is no public exploit identified at time of analysis, though the cited GitHub reference is a technical write-up of the flaw, and this issue is not confirmed actively exploited (CISA KEV).

Remote code execution in WookTeam 1.6.6 and earlier lets an attacker inject arbitrary PHP into an eval() call reached through the task export API at /api/project/task/export, granting full server-side code execution. The CVSS 3.1 vector rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), i.e. unauthenticated and network-reachable with total impact, although the assessor cautions that project/task export routes commonly sit behind a login session, so a valid authenticated session or an otherwise exposed/mis-protected route may be the real prerequisite and the PR:N rating should be verified against WookTeam's auth middleware. Publicly available exploit code exists and SSVC rates the attack automatable with total technical impact, while EPSS remains low at 0.15% (4th percentile) - signals conflict on urgency, and overall risk is bounded mainly by WookTeam's limited deployment footprint rather than by exploit difficulty.

Code injection in InternLM MindSearch 0.1.0 allows unauthenticated remote attackers to execute arbitrary code through the Planner Agent component, specifically by manipulating the inputs argument processed by ExecutionAction.run in mindsearch/agent/graph.py. The issue is rated critical (CVSS 9.3 per the CVSS 4.0 vector; the independent assessment likewise has PR:N/UI:N with high confidentiality, integrity, and availability impact), and publicly available exploit code exists. The vendor was contacted but did not respond, no vendor-released patch has been identified, and risk is concentrated in internet-reachable or otherwise accessible self-hosted MindSearch 0.1.0 deployments.

Arbitrary shortcode execution in the Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress (all versions up to and including 2.11.0.5) lets unauthenticated attackers run attacker-chosen shortcodes on a target site, which in a typical WordPress install with shortcode-extending plugins can escalate to code injection and full site compromise (CWE-94). Exploitation is not automatic: it is gated on the site publishing a Beaver Builder page whose Sidebar module contains a widget rendering attacker-controllable text - the advisory names the core Recent Comments widget - and on either comments being auto-approved (moderation disabled) or the attacker's comment having been approved by a moderator, which makes this a content- and configuration-dependent attack rather than a universally reachable one; the flaws assessed vector therefore carries AC:H rather than the initial AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory (Wordfence threat ID 794e6d9b-ac07-4261-a60d-81c474973005, mirrored as ENISA EUVD-2026-91966) is the authoritative source for patch rollout.

Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.

Opening an attacker-controlled Kerchunk reference document with fsspec's ReferenceFileSystem can execute arbitrary Python code, because versions from 0.9.0 up to (but not including) 2026.6.0 render reference fields through unrestricted jinja2 templates instead of treating them as inert data. The vulnerability is exploitable by unauthenticated attackers but requires user interaction: the victim application - or a downstream consumer such as xarray - must actually open the malicious document, which can be supplied inline or fetched from an attacker-controlled URL, and the gen-array code path triggers with no special configuration at all. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-94), it is addressed by the vendor's 2026.6.0 release, which makes jinja interpretation opt-in; no public exploit identified at time of analysis.

Code injection in Tinypool versions prior to 2.1.2 allows an attacker who first pollutes Object.prototype to load attacker-controlled JavaScript modules via the worker pool, potentially reading or modifying task data with host process privileges. The flaw is exploitable only when an application calls pool.run(task, options) with its own options object; calls that omit the options argument use a trusted default and are unaffected. No public exploit code or active exploitation has been identified, and the attack requires a pre-existing prototype-pollution vulnerability in the host application, making real-world exploitation condition-gated.

Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.

Code injection in FinRobot v1.0.0 via CodingUtils.modify_code allows an attacker who can control input reaching that function to have their content executed as code by the host Python process, with the independent assessment scoring the worst case as high confidentiality, integrity and availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). FinRobot is an AI agent framework rather than a network service, so real-world exposure depends on whether the embedding application feeds untrusted prompts, agent tasks or data fields into modify_code without sanitization; there is no evidence of a default network listener, and NVD's 7.3 score (AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:L) most likely reflects a worst-case integration rather than an out-of-the-box remote service. No public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.21% (10th percentile), so practical priority is modest despite the High base score.

Code injection in AgentScope v1.0.20 allows unauthenticated remote attackers to execute arbitrary commands if a host application exposes the execute_shell_command tool to attacker-influenced input. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so exploitation depends on that exposure/deployment condition; the NVD-style vector of AV:N/AC:L is more optimistic and conflicts with the assessed high attack complexity. No public exploit identified at time of analysis, and EPSS is low at 0.27% (17th percentile).

Code injection in FinRobot 1.0.0's CodingUtils.create_file_with_code() allows unauthenticated remote attackers to execute arbitrary code when the agent pipeline is exposed to untrusted input, per the CVSS 3.1 vector (9.8 Critical, CWE-94). Exploitation requires that attacker-controlled text-such as a malicious prompt, document, or tool input-reaches the vulnerable function without neutralization; typical local or orchestrated deployments that only process trusted input materially reduce real risk. No public exploit identified at time of analysis, and EPSS is 0.21% (10th percentile), indicating low predicted exploitation activity.

Code injection in Vanna 2.0.2's VannaBase.get_plotly_figure presents conflicting signals that must be weighed carefully: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), yet EPSS is only 0.36% (27th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis. In CVSS terms this is an unauthenticated remote issue, but the governing exploitation condition is that a deploying application exposes vanna's figure/plot-generation entry to attacker-influenced input; where the plotting path is exposed via bundled Flask/Streamlit/API front ends, an attacker who can shape the question or prompt can achieve attacker-controlled code or command execution, while embedded deployments that gate, authenticate, or do not expose that path are substantially less exposed than the 9.8 score implies.

Arbitrary Python code execution in sinaptik-ai pandas-ai 3.0.0 allows remote, unauthenticated attackers to run attacker-controlled code through the CodeExecutor.execute path, giving full compromise of the host or container running the agent. The flaw is rated CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection, meaning no privileges, credentials or user interaction are required per the assessed vector. EPSS is low at 0.16% (4th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis, although a GitHub issue and a public gist referencing the bug are linked from the CVE record and should be reviewed as possible reproduction detail.

StartTLS handling in 389-ds-base does not discard plaintext bytes buffered before the TLS upgrade, allowing an on-path attacker to inject a crafted LDAP message whose messageID collides with a client's pending bind and causes the client to treat a failed authentication as successful. Red Hat Directory Server 11, 12, and 13 and Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments using 389-ds-base with StartTLS are affected. Exploitation requires an on-path network position and timing control during StartTLS negotiation, so the real-world bar is higher than the reported 9.0 base score; no public exploit identified at time of analysis.

JavaScript injection into the WebView of the Joyland AI app (all versions, tracked as CPE cpe:2.3:a:joyland:joyland.ai:*) lets an attacker who shares a network position with the victim and can intercept or tamper with content loaded into the app run arbitrary script inside the app's privileged context; no authentication is required and no user interaction is needed. In the default, unpermissioned install state the attacker can read the device clipboard, make arbitrary HTTP requests through the Weex 'stream' module, and reach app-internal storage, while on devices that previously granted camera, microphone, location, or storage permissions the same flaw escalates to full filesystem, camera, microphone, and GPS access. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; the CVSS 4.0 base score is 9.0 (Critical) and EPSS data was not provided for this record.

Improper neutralization of query syntax in djehuty, the 4TU.ResearchData research data repository, lets an authenticated depositor supply a crafted session name that is concatenated into a state-modifying SPARQL DELETE/INSERT query, giving them arbitrary write and delete access to triples anywhere in the RDF metadata store. Because that store is shared across every account and dataset in a normal deployment, the result is a repository-wide metadata integrity and availability compromise rather than a self-contained tenant issue (assessed CVSS 3.1 8.1, vendor CVSS 4.0 8.4). The prerequisite is a low barrier: authentication requirements confirmed from the CVSS vector as authenticated (PR:L), but djehuty permits self-registration through ORCID/SAML, so in typical deployments almost anyone can obtain the account needed; no public exploit identified at time of analysis and vendor-released patch: 26.3.2.

Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only low-level permissions to bypass the safemode sandbox in the provisioning/report templating engine and execute arbitrary commands on the management host, carrying a vendor score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is authenticated (CVSS vector PR:L) and requires the ability to author or render templates; the scope-changed impact is severe because a successful escape yields control of the Satellite/Foreman management server, not just the template context, but the prerequisite of valid credentials plus template privileges means the 9.9 rating overstates how easily the issue is reached in hardened deployments. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.

Terminal escape-sequence injection in colmux, the multi-host aggregation front-end shipped with collectl before 4.3.20.2, lets an attacker who already holds an unprivileged local account on a monitored host embed crafted ANSI/VT100 control sequences - delivered via a fake process name (argv[0]) in the host's collected process data - into the terminal of an operator running colmux and viewing that host. Because colmux renders remote data without neutralizing escape, meta, or control characters (CWE-150), the injected sequences can rewrite displayed output or invoke terminal-emulator features, giving high integrity and confidentiality impact on the operator's session (CVSS 3.1 7.7, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N). Exploitation is constrained by stacked prerequisites: attacker foothold on a monitored node, an operator actively viewing that host in colmux, and a terminal emulator that still honors the more dangerous escape sequences, which many modern emulators disable by default; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV.

Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.

Authenticated code injection in langflow-ai Langflow up to and including v1.9.3 lets any user holding a valid account execute arbitrary Python on the server by POSTing raw source to the /api/v1/validate/code endpoint, which feeds the input straight into a server-side compile/exec validation path without sandboxing or an entitlement check (CWE-94). The supplied CVSS score is 9.8 under a PR:N vector, but the authoritative assessment applies PR:L because exploitation requires a valid Langflow session, making authentication the primary limiting factor; impact on confidentiality, integrity, and availability is rated High across the board. EPSS is only 0.17% (6th percentile), Langflow is not in CISA KEV, and no public exploit code has been identified at time of analysis, so mass opportunistic exploitation is not currently indicated - the realistic risk concentrates on internet-exposed, multi-tenant, or weakly authenticated Langflow deployments.

Remote unauthenticated code execution in DeepTutor 1.4.0 lets any network caller who can reach the live tutorbot WebSocket interface drive the agent tool layer into running reviewer-chosen shell commands inside the service environment, yielding full confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). The underlying defect is a CWE-94 code-injection weakness in ExecTool.execute, and successful exploitation depends entirely on the deployment: the tutorbot WebSocket endpoint must be network-reachable rather than localhost-only or firewalled, and the tool-execution path must be enabled so caller-supplied input reaches ExecTool.execute. This is not in CISA KEV and no public exploit code was identified at time of analysis, while EPSS is very low at 0.16% (4th percentile), meaning mass opportunistic scanning is unlikely even though the consequence for an exposed, default-configured instance is maximum-severity remote code execution.

Remote code execution in Kiteworks Email Protection Gateway allows an authenticated administrator to upload a crafted backup file that the product fails to sufficiently validate, then influence how the application loads it so that attacker-supplied code executes under the gateway's underlying service account. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection; exploitation is gated by high-privilege authentication, making it a realistic post-compromise, insider, or credential-chaining vector rather than an unauthenticated internet-wide threat. No public exploit code and no confirmed active exploitation (CISA KEV) were identified for this CVE at time of analysis, and no EPSS score was supplied in the available intelligence.

Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; realistic risk therefore hinges on admin-credential compromise, insider misuse, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.

Code injection in the MediaWiki CentralAuth extension (versions 1.43, 1.45 and 1.46) lets an already highly privileged operator who controls a CentralAuth configuration or system setting push attacker-influenced values into executable code paths, with the impact crossing into other federated wikis because the vulnerable component changes scope. Exploitation is not reachable by anonymous users: the assessed vector requires high privileges (PR:H), high attack complexity (AC:H), a present attack requirement (AT:P) and a passive user-interaction step (UI:P), so a victim session or request must traverse the vulnerable code path. There is no CISA KEV listing confirming active exploitation, and the vendor's CVSS 4.0 vector carries only an E:P (proof-of-concept) exploit-maturity metric; the overall picture is a real but conditions-gated, lower-urgency issue affecting multi-wiki/wiki-farm SSO deployments rather than standalone MediaWiki installs.

Unauthenticated remote code execution in the SiteSkite WordPress plugin through version 2.1.8 lets any remote attacker run arbitrary code on an affected site with no credentials, no user interaction, and no special configuration required (CVSS 10.0, vector PR:N/UI:N/AC:L, scope changed). The underlying weakness is a CWE-94 code injection flaw, and because the plugin is a niche one, the realistically exposed population is small and exploitation is more likely to be opportunistic scanning than broad mass exploitation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the intrinsic severity is high - a single successful request can hand an attacker full control of the WordPress installation and its host context.

Unauthenticated remote code execution in the AcyMailing SMTP Newsletter WordPress plugin (versions 11.0.5 and earlier) allows a remote attacker to execute arbitrary code on the underlying server, leading to full site compromise. The CVSS 3.1 base score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating no authentication or user interaction is required, though the high attack complexity (AC:H) signals that reliable exploitation likely depends on a specific precondition, application state, or configuration that the attacker must arrange or wait for. No public exploit code is currently identified, and the vulnerability is not listed in CISA KEV.

Unauthenticated remote code execution is possible in DB-GPT 0.7.5 and 0.8.0 through the combination of two first-party REST endpoints: a crafted skill uploaded via /api/v1/skills/upload can subsequently be invoked and executed by the /api/v1/chat/react-agent flow, which loads and runs the stored skill without adequate validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated network-reachable attacker with no victim interaction can achieve full confidentiality, integrity, and availability impact, and the SSVC assessment rates technical impact as total with automatability confirmed; publicly available exploit code exists (SSVC Exploitation: poc) but there is no CISA KEV listing, so confirmed active exploitation in the wild is not established. Despite the severe base score, EPSS is only 0.20% (9th percentile), reflecting the practical requirement that both the skills-upload and react-agent features be reachable and exposed - instances bound to localhost, placed behind authentication, or on isolated networks are far less exposed.

Remote code execution in AgentScope 1.0.18 and 1.0.19 allows remote attackers to execute arbitrary Python in the service environment: when a RealtimeAgent session has execute_python_code registered as an available tool, the agent's _acting path forwards a model-produced tool call straight to Toolkit.call_tool_function with no approval prompt and no sandbox boundary, so a remote WebSocket user who can reach the endpoint and steer the agent can obtain code execution with the service's privileges. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) no authentication is required, and the SSVC assessment records that publicly available exploit code exists (exploitation: poc), so the vulnerability is automatable with total technical impact; EPSS is low at 0.20% (9th percentile), indicating limited observed exploitation activity so far. Exploitation is conditional on the deployment exposing the execute_python_code tool in a RealtimeAgent session and on the WebSocket interface being network-reachable - instances that do not register that tool are not vulnerable via this path.

Code execution in camel-ai's CodeExecutionToolkit (versions 0.2.91a1, 0.2.91a2, and 0.2.91a3) lets remote, unauthenticated attackers run arbitrary Python through the SubprocessInterpreter with no approval or confirmation boundary. The attacker must be able to influence the agent's model output - for example via prompt or task injection - so that the LLM emits executable Python, and the host application must have opted into the code-execution toolkit and routed untrusted input to it; exposure is therefore conditional rather than default, which is reflected in the independent assessment's High attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) versus the vendor's 9.8 AV:N/AC:L rating. Risk weighting is tempered by a low EPSS of 0.22% (11th percentile), no CISA KEV listing, and no vendor-released patch identified at time of analysis, though a public GitHub issue and a third-party gist describing the flaw are referenced.

Prompt-driven shell command execution in camel-ai CAMEL 0.2.91a1, 0.2.91a2 and 0.2.91a3 lets anyone who can influence an agent's prompt - directly as an interactive user or indirectly through content the agent ingests - run arbitrary operating-system commands, because TerminalToolkit.shell_exec performs no approval or confirmation step before executing. The independent assessment rates this high (AV:N/AC:H/PR:N/UI:N, C/I/A:H) because the agent must be deployed with the terminal toolkit enabled, whereas the unadjusted NVD vector of 9.8 assumes no such precondition; the attacker is unauthenticated per the vector (PR:N), though exploitation depends on prompt influence. Publicly available exploit code exists (a proof-of-concept gist is linked from the advisory), but there is no confirmed actively exploited status (CISA KEV), and EPSS is low at 0.25 percent (15th percentile), making this an elevated but not emergency-tier priority.

Unauthenticated code injection in Devika v1.0 allows an attacker who can reach the backend service to run arbitrary code with the privileges of the Devika process, because the Runner.run_code function in src/agents/runner/runner.py executes supplied input without adequate validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects a remotely reachable, no-authentication, no-interaction path, but practical risk is bounded by deployment: Devika is normally run as a local developer tool bound to localhost, and the network-facing exploitation implied by the vector applies only when an operator has deliberately bound the backend to a routable interface (for example 0.0.0.0) or runs it in a shared multi-user environment. EPSS is low at 0.21% (roughly the 10th percentile) and no public exploit was identified at time of analysis, with no CISA KEV entry; a public GitHub issue and an external gist are the only public artifacts referenced alongside the MITRE and ENISA EUVD (EUVD-2026-90411) records.

Arbitrary code execution in Devika v1.0 allows unauthenticated remote attackers to run attacker-controlled code with the privileges of the Devika process by getting malicious content into the agent's LLM output path, which Runner.execute passes directly to the interpreter. Exploitation presupposes a running instance whose web interface is reachable over the network, since the agent interface ships without authentication and the runner applies no sandbox; instances bound to localhost or used by a single operator on a workstation degrade to local/operator-level impact. Publicly available exploit code exists and CISA's SSVC framework rates the issue fully automatable with total technical impact, although EPSS is low at 0.23% (13th percentile) and there is no CISA KEV confirmation of active exploitation.

Code injection in DataElement BiSheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated network attackers to execute arbitrary code and fully compromise affected deployments through the backend validation endpoint src/backend/bisheng/api/v1/validate.py. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a remote, low-complexity, no-authentication attack that yields complete loss of confidentiality, integrity, and availability. Exploitation is not confirmed as active (not in CISA KEV), no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and no fixed version is confirmed in the available data; a GitHub gist referenced in the record may contain further technical detail.

Blind XPath injection in the MediaWiki EasyTimeline (Timeline) extension lets an attacker who can submit <timeline> markup alter the extension's server-side XML/XPath query structure, potentially exposing data the wiki would not otherwise return. The flaw affects EasyTimeline before 1.46.1, 1.45.5, and 1.43.10; published scoring is severe (9.8, AV:N/AC:L/PR:N/UI:N) while independent assessment rates it as requiring edit privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because exploitation depends on being able to edit a page containing a <timeline> block - trivial on wikis that allow anonymous/open editing, but account- or role-gated where editing is restricted. Vendor-released patches exist (1.46.1 / 1.45.5 / 1.43.10), EPSS is low at 0.17% (6th percentile), and no public exploit identified at time of analysis.

Unauthenticated remote code execution affects AltumCode 66Uptime deployments running a version before v54.0.0, and separately the bundled 66Uptime ping-servers plugin before v2.0.0, with the attack surface being the application's index.php entry point. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8 critical) describes a network-reachable flaw requiring no credentials, no user interaction, and no special privileges, and the CISA SSVC assessment rates the technical impact as total while classifying exploitation as proof-of-concept. Publicly available exploit code exists per the SSVC POC rating, though the flaw is not confirmed actively exploited (CISA KEV), and the practical exposure is tempered by the relatively small deployment base of this commercial uptime-monitoring script. A significant caveat applies: the only listed reference (a Glimmernet security advisory) frames the ping-servers plugin issue as server-side request forgery, which if accurate would narrow the impact to SSRF rather than full code execution for that component.

Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD (versions 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets unauthenticated remote attackers complete SSH authentication by submitting the literal username "*" with the password "*", because LDAP filter metacharacters from user-supplied credentials are not escaped before being embedded in the search filter. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw is trivially reachable but only on servers that both embed the MINA SSHD library and have deployed and configured sshd-ldap for password or publickey authentication; stock MINA SSHD deployments without that optional component are entirely unaffected, and no public exploit code was identified at time of analysis. Apache ships fixes in 2.20.0 and 3.0.0-M6, which apply proper RFC 4515 escaping.

Arbitrary PHP code execution on the scanning host is possible with PHPCSUtils versions 1.0.0-alpha1 through 1.2.2, because the abstract sniff helper AbstractArrayDeclarationSniff::getActualArrayKey() resolves array-key values through eval() instead of a safe parser. Exploitation requires a host to run PHP_CodeSniffer over attacker-supplied PHP source with a sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey() - most notably PHPCSExtra's Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes - which is exactly the situation in CI pipelines that lint untrusted pull requests or on developer machines reviewing third-party code; the crafted key 'system'('id') is evaluated during the scan. The CVSS 3.1 vector scores this 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating no privileges are required but that the vector is local and needs a person or pipeline to actively invoke the scan; no public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.2.3.

Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor submit a crafted public form that results in attacker-controlled PHP being evaluated server-side. The root cause is that the extension substitutes form-field shortcodes with the raw value submitted by the visitor before passing administrator-defined 'PHP after submission' code to eval(), allowing a value to break out of a double-quoted PHP string. Exploitation is conditional, not blanket: it requires an administrator to have enabled the optional PHP-after-submission action and to have interpolated an attacker-controllable field shortcode inside a double-quoted string, a non-default configuration reflected as AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CPE string was supplied; the vendor scores this 9.5 (critical) whereas our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Unauthenticated remote code execution in Open GenAI Stack (ogx-ai, 2026-06-11 build) lets any attacker who can submit a prompt to an affected endpoint execute arbitrary server-side code, because prompt content is rendered as an unsanitized Jinja2 template (CWE-94, classic server-side template injection). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), with no authentication, user-interaction, or non-default-configuration prerequisite, so exploitation reduces to reaching the vulnerable template-rendering path. No public exploit code has been identified at time of analysis, and the widely repeated claim that this stack underpins the Meta AI backend for WhatsApp is unconfirmed by any vendor advisory. Real-world risk is bounded by deployment scope: only systems actually running the vulnerable ogx-ai prompt-to-template path are exposed.

Authenticated users can inject malicious input through the TIBCO Administrator web console (versions 5.13.0 and prior), potentially leading to arbitrary code execution and full compromise of the affected system. The flaw requires a valid low-privilege account (PR:L) and network access to the console; no public exploit code or active exploitation has been identified at this time.

CRLF injection in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker to append arbitrary IMAP commands to the service's already-authenticated upstream mailbox connection when bearer-token authentication is not configured. Attacker-controlled folder, UID, or search values are passed into IMAP command construction without neutralization, yielding high integrity and availability impact on the mail store; the exposed path only exists on instances deployed without bearer-token auth, and no public exploit has been identified at time of analysis. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, no-interaction flaw, though real-world risk is constrained by the non-default configuration requirement and the project's very small deployment base.

Authenticated code injection in Dassault Systèmes GEOVIA Geospatial Data Manager allows a low-privilege user with a valid session to execute arbitrary code on the server, and the changed-scope metric means the compromised component can be leveraged to affect other parts of the hosting 3DEXPERIENCE environment. The flaw carries a 9.9 CVSS score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects GEOVIA Geospatial Data Manager deployed on 3DEXPERIENCE R2024x through R2026x up to the listed FP.CFA build levels; no user interaction is required beyond the attacker's own authenticated access. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical exposure is gated by the requirement for a valid low-privilege account and by the product's narrow mining and geospatial deployment footprint.

Unauthenticated remote code execution affects metatool-ai MetaMCP through version 2.4.22 via the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio, where request-controlled input reaches process spawning in the STDIO branch of createTransport (routers/mcp-proxy/server.ts). The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, unauthenticated attacker can achieve total confidentiality, integrity, and availability impact with no user interaction, and CISA's SSVC assessment rates the flaw automatable with total technical impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the practical risk depends primarily on whether the inspector proxy endpoint is exposed beyond localhost in a given deployment.

Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. Remote unauthenticated exploitation is inert without that chained second bug, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor-released patches ship in 0.34.0 and 1.20.0.

Loading a malicious model into Unsloth Zoo 2025.9.9 through 2026.8.13 (as shipped in Unsloth 2025.9.9 through 2026.8.19) lets that model's config.json run arbitrary Python in the loading user's process, because a nested model_type value containing a newline escapes into an exec()-generated import statement. Exploitation requires the victim to load an attacker-controlled model for training or inference - a user-interaction gate, but no authentication on the attacker side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; vendor score 8.6). No public exploit code has been identified at time of analysis, and the practical exposure is concentrated in pipelines that automatically ingest third-party or user-supplied models from public hubs rather than those loading only vetted first-party checkpoints.

Code injection in Innotim Logsign SIEM versions 6.4.101 through 6.4.117 exposes network-reachable deployments to full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 8.8 and the CVE's CWE-94 classification. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation requires a valid low-privilege authenticated account on the SIEM instance, needs no user interaction, and can be carried out with low complexity - an anonymous attacker cannot trigger it without first obtaining credentials, and the risk is confined to the stated version window. No public exploit code or confirmed active exploitation was identified at time of analysis, and the specific vulnerable feature or endpoint is not disclosed in the available advisory data.

LDAP filter injection in Apache Karaf before 4.4.12 allows a crafted login name to alter the structure of LDAP search filters built by LDAPCache and LDAPBackingEngine, potentially matching an unintended directory entry, over-granting roles, or changing which account a login resolves to. The unescaped value only reaches the filter through two call paths - the GSSAPILdapLoginModule (Kerberos/SPNEGO), which passes the NameCallback name through unescaped, and the LDAPBackingEngine.listRoles path, which passes principal.getName() unescaped - because the default LDAPLoginModule and LDAPPubkeyLoginModule both pre-escape the login name via Util.doRFC2254Encoding(). The issue is remote and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3), but real-world impact is bounded by the administrator-configured userFilter/roleFilter templates; there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.25% (14th percentile). A vendor patch is available in Apache Karaf 4.4.12.

Arbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticated, remote attacker run attacker-controlled code inside the hMailServer service process with the service account's privileges by sending a password containing a backslash immediately followed by an apostrophe in any SMTP AUTH, POP3, or IMAP logon that names an existing active account. The flaw is only reachable in a non-default configuration - event scripting enabled (off by default), the script language set to JScript (default is the unaffected VBScript), and a relevant handler (OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed) defined - and equivalent paths exist through a malicious remote POP3 server's message UID or a malicious remote SMTP server's rejection reply. The vendor's CVSS of 9.8/AV:N/AC:L understates the practical barrier because it does not model those required non-default settings; our assessed vector is AV:N/AC:H/PR:N/UI:N, no public exploit has been identified at time of analysis, and the vendor-released patch is version 6.3.4.

Stored code injection in the Ad Inserter WordPress plugin before 2.8.19 allows an authenticated user with a role as low as subscriber to save content that the plugin then executes as PHP or serves unescaped to site visitors, because one of the plugin's settings pages is not access-restricted and the data written there is not filtered. Exploitation is conditional rather than trivial: the threat actor needs a low-privileged account (easy on sites with open registration) and the site must be running a configuration in which the plugin's own settings make that page reachable by every logged-in user, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with total technical impact. Publicly available exploit code exists, but the EPSS score is only 0.15% (4th percentile), there is no CISA KEV listing, and independent review characterises this as a real-but-conditional priority rather than an emergency.

Python eval()-based remote code execution in Heym (heymrun/heym) before 0.0.53 lets an authenticated user who can edit a workflow branch or condition node - or a victim who imports a workflow template containing a malicious condition node - run arbitrary Python as the backend process user whenever the workflow executes. The same release bundles four further flaws: fail-open Slack and Telegram webhook verification that allows unauthenticated workflow triggering with the owner's credentials when a trigger node has no credentialId or an empty signing secret, an OAuth redirect_uri scheme-validation gap that permits javascript:/data: URIs and script execution in the Heym origin, and plaintext storage of WorkflowExecutionToken, PortalSession, HITLRequest.public_token and OAuthAuthorizationCode values. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the 0.0.x pre-release product has a very small deployment base.

Sandbox escape in the heym workflow platform before 0.0.91 allows an authenticated user who can author or edit workflow expressions to execute arbitrary Python and run operating-system commands as the backend process. The flaw lives in the expression engine's DotList map/filter item expressions and its fallback resolver, which fail to block dunder attribute traversal, letting an attacker chain attributes to reach functions such as os.system. Exploitation requires a valid account with workflow-authoring rights (PR:L) but no user interaction, making this a network-reachable, low-complexity compromise of confidentiality, integrity, and availability; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.

Authenticated code injection in AzuraCast 0.23.3 and earlier lets a user holding StationPermissions::Media or StationPermissions::Profile plant Liquidsoap interpolation sequences (#{...}) into playlist remote URLs or station metadata fields, which the ConfigWriter::cleanUpString() helper writes unsanitized into the generated .liq configuration. When the affected station's Liquidsoap backend is next restarted and re-parses that config, the embedded #{process.run(...)} expression is evaluated and executes arbitrary shell commands as the azuracast service user. Exploitation is not confirmed in the wild (no CISA KEV listing), but the vendor advisory publishes proof-of-concept payloads for both the Media-permission and Profile-permission paths; the trigger is delayed and interaction-dependent, requiring a station restart after the malicious value is saved.

Code injection in AzuraCast through 0.23.5 lets an authenticated user holding the RemoteRelays station permission inject nested Liquidsoap interpolation syntax (for example #{#{EXPR}}) into the remote relay password field, achieving arbitrary code execution inside the Liquidsoap process, disclosing internal API keys, or disrupting station operation. The root cause is an incomplete migration in ConfigWriter.php from the vulnerable cleanUpString() sanitizer to the safe toRawString() helper; a prior commit (ff49ef4) migrated host, username, mount, name, description, genre, and URL fields but left the password field behind. No public exploit identified at time of analysis, and exploitation is gated by the RemoteRelays privilege (PR:L) and by the station's Liquidsoap configuration being regenerated and loaded.

MONAI through 1.6.0 lets a user who can supply or tamper with a bundle's metadata achieve code execution by abusing an eval()-based sandbox in _get_fake_spatial_shape() (monai/bundle/scripts.py). The vulnerable function screens shape expressions with a helper that walks the AST and only rejects ast.Name nodes outside the 'p'/'n' allowlist, so payloads assembled purely from constants and attribute, subscript, or call nodes - such as "(1).__class__.__bases__[0].__subclasses__()" - pass validation and then reach eval(), enabling object-introspection chains that escape to arbitrary code execution. The path is reachable through the non-default bundle 'verify_net_in_out' CLI verification flow (_get_real_input_data / verify_net_in_out), so exploitation is limited to authenticated local users (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, CVA:H) who run that verification on an untrusted or modified bundle; default MONAI workflows that never verify untrusted bundles are not exposed, and no public exploit code was identified at time of analysis.

MONAI through 1.6.0 will execute arbitrary code in the victim's process when it loads an attacker-supplied bundle, because the bundle configuration engine resolves '_target_' values to any importable callable without an allow list and passes '$' expressions straight to Python's eval(). An attacker who publishes or shares a crafted bundle achieves code execution as soon as an operator calls monai.bundle.load() or monai.bundle.run() on it; no credentials are required against the victim (PR:N), but the attack does depend on user interaction (UI:R) since the operator must obtain and load an untrusted bundle, and the payload runs with the privileges of the loading process. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the primary exposure is to environments that pull third-party or community-contributed MONAI bundles rather than first-party trusted ones.

Host-controlled AML injection in Edgeless Systems' Contrast confidential-computing runtime before 1.18.0 lets an adversary who controls the QEMU host achieve arbitrary code execution inside AMD SEV-SNP guest VMs, including reads and writes to private memory pages that the confidential-computing model is supposed to shield. Only the Metal-QEMU-SNP and Metal-QEMU-SNP-GPU platforms are affected; Metal-QEMU-TDX is not, because OVMF measures ACPI table contents into RTMR 0 on Intel TDX. The flaw is rated CVSS 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) via the host-to-guest trust boundary, carries no CISA KEV status and no public exploit code identified at time of analysis, and is fixed in Contrast 1.18.0, which sandboxes the kernel AML interpreter; the underlying BadAML technique is publicly documented in academic and Black Hat EU 2024 research, and the weakness is generic to Confidential Computing deployments that expose the ACPI interface to the host.

Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a high-privilege administrator to execute arbitrary PHP code and system commands on the underlying server. The flaw requires a valid Joomla administrator account (PR:H) and is remotely exploitable without user interaction, but no public exploit code or active exploitation has been identified at time of analysis. Because the plugin is a narrowly deployed third-party extension and no vendor patch is available, the real-world priority is low despite the critical CVSS score (9.4), with mitigation limited to removing the plugin or tightly restricting administrative access.

Authenticated low-privilege Froxlor users with subdomain-create rights can inject arbitrary nginx or Apache configuration directives via CRLF sequences in the userinfo component of a subdomain redirect URL, leading to server-wide response hijacking and local file disclosure. The vulnerability affects versions 0 through 2.3.10 (incompletely fixed) and up to version 2.3.12, which contains the complete fix. The independent assessment rates this as a genuine high-priority vulnerability; no public exploit code or active exploitation has been identified at time of analysis.

Argument injection in the Froxlor hosting control panel (versions before 2.3.12) allows an authenticated administrator - or any actor able to write settings, such as through the settings-import API - to inject arbitrary acme.sh command-line options via the unescaped system.letsencryptchallengepath setting, resulting in arbitrary command execution as root the next time the Let's Encrypt cron job runs. The vendor CVSS 4.0 score of 9.4 (and the independently assessed CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of the host, but exploitation is gated behind a high-privilege settings-write primitive (PR:H) and requires that acme.sh-based Let's Encrypt certificate issuance be configured so the root cron actually executes the poisoned command line. No public exploit code was identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); the vendor-released fix is Froxlor 2.3.12.