Code Injection

Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.

Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.

Arbitrary file overwrite in GitPython before 3.1.58 allows attackers who can influence treeish arguments passed to IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree to clobber any file writable by the host process with a valid git-index blob. The three affected methods in git/index/base.py forward caller-controlled strings directly to git read-tree with no option sanitization and no -- argument terminator, enabling injection of --index-output=<path>; git's last-occurrence-wins behavior lets the injected flag override the library's internal temp path. A proof-of-concept is publicly documented in GHSA-4gmw-gg2m-w46p; no CISA KEV listing was present at time of analysis.

Pre-authentication PHP code injection in Balbooa Forms, a commercial Joomla form-builder extension, in all versions before 2.4.3.2 lets a remote unauthenticated attacker run arbitrary server-side code. The flaw stems from the optional custom-PHP post-submission handler being executed through eval() after the [URL parameter = X] shortcode is replaced with the raw, unescaped value of an attacker-controlled query parameter. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the combination of unauthenticated network reach and full remote code execution makes this a maximum-severity issue wherever a matching handler is configured.

FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.

Unauthenticated PHP object/global variable injection in the Broken Link Checker WordPress plugin before 2.4.12 allows attackers to overwrite arbitrary PHP global variables via unfiltered query variables on sites using plain permalinks, escalating to remote code execution when a classic (non-block) theme is active. The flaw is reachable by any unauthenticated visitor (CVSS 3.1 base 9.0, PR:N) but requires the AC:H preconditions of plain permalinks plus a classic theme, so it is not universally exploitable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.22%, 13th percentile), indicating no observed mass exploitation yet.

Sandbox escape leading to host remote code execution in Kobako, a Ruby gem that runs untrusted mruby guest scripts in a WASM sandbox. The transport dispatcher forwarded guest-supplied method names directly to `Object#public_send` on host-bound Service objects without restricting them to the object's own methods, letting a guest pivot through the public `send` into private `Kernel#eval` and execute arbitrary Ruby in the host process. All released versions 0.1.0-0.9.0 are affected; the vendor advisory (GHSA-7pwq-q9jf-539h) documents a working proof-of-concept and CVSS is rated 10.0, though there is no CISA KEV listing or EPSS data provided.

Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.

Remote code execution in MyBB 1.8.13 through 1.8.39 lets an attacker inject arbitrary PHP into the generated database configuration file when the web-based installer (install/index.php) remains accessible. The installer sanitizes database configuration values with addcslashes() but omits the backslash from its escaped-character set, so crafted input can break out of the single-quoted PHP string and execute attacker-controlled code. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit publicly reveals the exact one-character root cause, lowering the barrier to weaponization.

Code injection in Vim prior to 9.2.0845 enables arbitrary operating-system command execution by an attacker who can supply a malicious ctags-format tags file. The StructMembers() function in ccomplete.vim embeds typeref: and typename: field values from that tags file into a dynamically constructed vimgrep pattern using escaping that only covers '/' and '\', leaving regex metacharacters such as '[' active; an unclosed bracket breaks Vim's pattern parser, causing the remainder of the tag value to be interpreted as Ex commands where '|' acts as a command separator. Exploitation requires the victim to actively invoke C omni-completion (CTRL-X CTRL-O) while editing a C file referencing the malicious tags entry; no public exploit is identified at time of analysis, though the fix commit's test suite embeds a working proof-of-concept payload, substantially lowering the barrier to weaponization.

Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted `.codewhale/config.toml` containing `allow_shell = true` to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to `exec_shell` and `task_shell` built-in tools and executes arbitrary shell commands without the user's explicit consent. No public exploit has been identified at time of analysis and no CISA KEV listing is confirmed, though the attack mechanics are straightforward and a vendor patch is available.

Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.

Arbitrary shell command execution in Oh My Zsh's dotenv plugin allows any syntactically valid Zsh command embedded in a `.env` file to run with the victim user's privileges when they `cd` into a directory containing that file. The plugin unconditionally `source`d the `.env` file as a shell script rather than parsing it as a structured key-value store, meaning malicious git repositories, shared project directories, or downloaded archives could weaponize routine developer directory-navigation. Exploitation is silent when `ZSH_DOTENV_PROMPT=false` or when the user presses Enter at the default prompt without reviewing the file; no CISA KEV listing or public exploit code was identified at time of analysis.

Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.

Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.

Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.

Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to write arbitrary PHP into web-accessible files and execute it. The flaw lives in the Blueprint dynamic-data 'bare-function' validation, which relies on an incomplete denylist rather than a positive allowlist, letting the error_log function be invoked through a data directive to append attacker-controlled PHP payloads. Reported by VulnCheck; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Arbitrary code execution is reported in PbootCMS 3.2.15, a PHP-based open-source content management system, reachable through several front-end controllers (MemberController.php, UserController.php, CommentController.php, ContentController.php) and the shared helper.php. Classified as CWE-94 code injection with a CVSS 9.8 and tagged PHP/RCE, it would let an attacker run attacker-supplied PHP on the web server. No public exploit is identified at time of analysis and it is not listed in CISA KEV; note that one of the two primary references is a document titled 'URL Redirection Vulnerability,' which conflicts with the code-execution description and should be verified.

Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.

Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.

Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.

Unauthenticated data tampering in GitLab CE/EE (18.2-18.11.10, 19.0-19.0.7, 19.1-19.1.5, 19.2-19.2.3) lets a remote attacker modify or delete public projects and user data by abusing a GraphQL directive, per CVE-2026-19478 (CVSS 9.4). The flaw was self-reported by GitLab and publicly available exploit code exists via a HackerOne disclosure, though it is not listed in CISA KEV. Impact is weighted toward integrity and availability rather than data theft (CVSS C:L/I:H/A:H).

Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.

Remote code execution in Halo 2.25.4, an open-source Java-based CMS/blogging platform, arises from its plugin-installation machinery: the installFromUri method in PluginEndpoint.java combined with DefaultPluginApplicationContextFactory loads and executes attacker-supplied plugin code, giving full CWE-94 code injection with total confidentiality, integrity, and availability impact (CVSS 9.8). Publicly available exploit code exists in a referenced GitHub gist, but there is no public exploit identified as being actively used in the wild (not on CISA KEV). Note a signal conflict: the NVD vector states PR:N (unauthenticated) while plugin installation in Halo is normally an administrative function - this warrants verification.

Remote code execution in Squirro Cognitive Search before version 3.14.2 lets remote attackers run arbitrary code by sending a crafted payload to the application's password-reset function, a CWE-94 code-injection flaw. The password-reset endpoint is typically pre-authentication and internet-facing, and the CVSS vector (PR:N/UI:N) indicates no credentials or user interaction are needed. Publicly available exploit code exists (SSVC exploitation status 'poc', plus a public GitHub research repo), but this CVE is not in CISA KEV and EPSS is low at 0.24% (15th percentile), indicating credible but not yet widespread exploitation.

Sandbox escape in O2OA v.10.0.2's Invoke script execution mechanism allows a locally authenticated low-privileged attacker to bypass code isolation controls and execute arbitrary commands on the host system, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The CVSS vector AV:L/AC:L/PR:L/UI:N confirms exploitation requires only a valid low-privileged platform account with access to the Invoke JAX-RS endpoint - no complex conditions or user interaction are needed. A detailed vulnerability analysis document has been publicly disclosed via GitHub, lowering the technical barrier for exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in JeecgBoot v3.9.2 allows attackers to run arbitrary code by supplying a malicious value to the 'files' parameter within the AI Chat module. The flaw is a code-injection weakness (CWE-94) carrying a critical 9.8 CVSS rating with a fully remote, low-complexity vector. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.21%, 11th percentile), indicating no observed mass-exploitation activity yet.

IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).

Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.

Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.

Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.

Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.

Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.

Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. The upstream fix makes KVM reject non-memory backing and inject a Synchronous External Abort (SEA) into the guest instead. There is no public exploit identified at time of analysis and EPSS is low (0.21%).

Authenticated remote code execution in ImpressCMS allows administrators with access to the custom tag module to store and persistently execute arbitrary PHP code across all frontend page loads. The root mechanism is a decode-then-eval pattern: the application's renderWithPhp() method calls undoHtmlSpecialChars() on stored tag content before passing it to eval(), causing HTML Purifier sanitization to be bypassed entirely since purification operates on the encoded form. Publicly available exploit code exists on GitHub; this vulnerability has not been confirmed as actively exploited by CISA KEV at time of analysis.

Unauthenticated remote code execution in MindsDB Minds Platform (version 26.1.0 and earlier) lets any network-reachable attacker run arbitrary OS commands on the host by chaining two unprotected API endpoints. The attacker first sets a controlled LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submits a crafted prompt to POST /api/v1/responses/ that steers the Anton agent into calling its scratchpad tool, which passes attacker-influenced Python directly into exec() with no sandbox. Reported by VulnCheck with a maximum CVSS 4.0 score of 10.0 and CWE-94; no public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication make it high priority.

Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Code injection in Devolutions PowerShell Universal 2026.2.3 and earlier allows any authenticated user granted settings management permissions to execute arbitrary PowerShell within the platform runtime. The vulnerability arises because setting values submitted through the settings interface are not properly escaped before being written to the configuration file, which is subsequently parsed and interpreted as executable code. No public exploit code has been identified at time of analysis, and SSVC reports no known active exploitation, but the technical impact is rated total given full arbitrary code execution capability.

Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary PHP files on the server by exploiting a validation bypass in the Flex Objects plugin. The attacker crafts a ZIP archive containing PHP code, circumvents routine-name validation by substituting array notation for the expected string notation, and triggers the unZip routine to write the payload directly into the web root where it becomes immediately executable via HTTP. No public exploit has been identified at time of analysis, but the precise bypass technique disclosed in the advisory substantially lowers the barrier to exploitation for any attacker holding valid credentials.

Server-side code injection in Elastic Fleet Server (8.5.0-8.19.19, 9.0.0-9.4.4, and 9.5.0) lets an actor who can define an output configuration in Kibana smuggle script syntax through an output identifier that is never restricted to safe characters. Because Fleet Server later concatenates that identifier into a script it builds during routine agent policy processing, embedded script fragments execute on the server rather than being treated as inert data, yielding attacker-controlled code execution (CWE-94). No public exploit identified at time of analysis and EPSS is low (0.36%), but SSVC rates technical impact as total.

Remote code execution in Velocity.js (npm 'velocityjs') versions <= 2.1.6 lets an attacker who controls template content reach the JavaScript Function constructor and run arbitrary code in the server process. The earlier CVE-2026-44966/GHSA-j658-c2gf-x6pq fix only filtered constructor/__proto__/prototype in the #set assignment target, leaving property-read expressions in references.ts unguarded, so this is a straightforward bypass. Publicly available exploit code exists (a working PoC is published in the GHSA advisory and was vendor-verified on v2.1.6); no confirmed active exploitation (not in CISA KEV).

Remote code execution is achievable in Data::MuForm::Localizer for Perl (versions through 0.05) when an application passes user-supplied locale identifiers - such as an Accept-Language header or locale query parameter - directly to the load_lexicon function, and an attacker can also place a crafted .po file at a readable path on the server. The module constructs the catalog path by unsanitized interpolation of the language attribute, enabling directory traversal, then eval-executes the Plural-Forms header of the loaded catalog as live Perl code, giving the attacker arbitrary OS command execution as the application process user. No public exploit code is referenced in available sources and this CVE is not listed in CISA KEV; a vendor patch is available from CPANSec.

Template injection in Oh My Posh prior to 29.35.1 allows arbitrary operating system command execution as the victim user when the shell prompt renders inside a directory whose name contains a Go template expression. The `setStyle()` function in `src/segments/path.go` passes raw filesystem path components - including untrusted directory names - directly into `template.Render`, whose function map exposes a `cmd` helper that invokes `env.RunCommand`. A publicly available proof-of-concept demonstrates command execution and file writes across Linux, macOS, and Windows. No active exploitation is confirmed in CISA KEV, but the attack surface includes any developer who `cd`s into a maliciously named directory on a shared or attacker-influenced filesystem.

Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.

Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.

Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. No public exploit code has been identified at time of analysis, but the CVSS 8.1 score reflects the potential for full confidentiality, integrity, and availability impact when the dual-control preconditions are met.

Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. Reported by VulnCheck and fixed by the vendor; no public exploit or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 base score of 9.0 reflects full compromise of confidentiality, integrity, and availability.

Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. Reported by VulnCheck with a CVSS 4.0 score of 9.0; no public exploit is identified at time of analysis, though the technique is documented in detail in the vendor advisory.

Remote code execution and SSRF in FlowiseAI Flowise before 3.1.3 stems from a bypassable regex-based Python code validator in the CSV and Airtable Agent nodes, letting attackers smuggle malicious pandas calls through the unauthenticated prediction API via prompt injection. Because the validator blocklists rather than sandboxes, unblocked functions such as pd.read_json() can be abused to exfiltrate local datasets, reach internal services (SSRF), or execute arbitrary code. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the reporting vendor VulnCheck and a GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) document the issue.

Authenticated arbitrary Python code execution in FlowiseAI Flowise before 3.1.3 arises from the CSV Agent node's customReadCSV parameter, whose regex-based validator can be defeated with obfuscation to run attacker-supplied code inside an unsandboxed pyodide runtime with full host access. Any user able to build or edit a chatflow can escalate from application-level access to code execution on the server. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch exists in version 3.1.3.

Remote code execution in Flowise before 3.1.3 lets attackers run arbitrary Python on the host by abusing the Airtable Agent node. Crafted chatflow prompts carry obfuscated Python that slips past the pythonCodeValidator blocklist and executes inside an unsandboxed pyodide runtime with full access to the underlying OS. Reported by VulnCheck with a published GHSA advisory; no public exploit code is identified at time of analysis, and it is not listed in CISA KEV.

Ruby code injection in the amazing_print gem's AwesomeMethodArray#grep enables arbitrary Ruby code execution inside the host process when attacker-controlled strings containing interpolation syntax reach a dynamically constructed eval call. Specifically pinned to commit dc890dfafdf07088ea901df53c19c2710e5c5234, the flaw requires an application code path where externally influenced values can become method names processed by grep with a block. A publicly available proof-of-concept exists on GitHub Gist, and while the CVE is not in CISA KEV, the full-RCE impact in affected deployments warrants urgent remediation review.

CVE-2026-61552 is documented solely as a 'security update' by Ubuntu with no accompanying technical description, CVSS score, CWE classification, or affected package name. The nature of the vulnerability - its impact type, attack vector, or affected component - cannot be determined from the available data. No meaningful synthesis is possible without additional NVD, vendor, or researcher disclosures.

Argument injection in PDF::WebKit through version 1.2 (Perl module, CPE mithaldu:pdf::webkit) lets an attacker who controls the source HTML dictate the wkhtmltopdf command-line options used for rendering. Because meta tags of the form <meta name="pdf-webkit-KEY" content="VALUE"> are converted into renderer switches without an allow-list and are merged last, a malicious document can enable options like --enable-local-file-access or --cookie-jar to read local files into the output PDF or write to attacker-chosen paths. No public exploit identified at time of analysis; a vendor patch is available. NVD scores this CVSS 9.8, though real-world exposure depends on the application feeding untrusted HTML to the module.

Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.

Arbitrary code execution is achievable on Windows endpoints running IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13 when the software is installed in all-users mode, because the installer leaves one or more configuration files world-writable. Any local user with standard (non-administrator) privileges can modify these files to inject code that executes under the security context of other users who subsequently launch the application. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 7.8 High rating reflects the full confidentiality, integrity, and availability impact achievable once a local foothold exists.

Command injection in stata-mcp (pip:stata-mcp < 1.19.0) enables full OS-level remote code execution against any principal that can invoke the `ado_package_install` MCP tool. The `package` argument is concatenated unsanitized into a Stata command string delivered via pexpect.sendline(), allowing embedded newline characters to inject arbitrary Stata commands - including the `shell` escape - that execute under the account running the MCP server. Because the tool is registered in the default `all` profile and `all` is the active default, no misconfiguration by the victim is required; a detailed proof-of-concept confirmed via Docker reproduction is publicly available in the GitHub advisory, and a vendor-released patch exists in v1.19.0.

Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.

Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%).

Local privilege escalation in Autodesk's ODIS (Online Deployment & Installation Service) installer allows a low-privileged local attacker to inject unauthenticated IPC messages into named pipes by executing a specially crafted binary on the target machine. The root cause is incorrect permission assignment (CWE-732) on named pipe resources, permitting unauthorized low-privileged processes to connect, write, or manipulate pipe ownership in ways that fully compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor has confirmed the issue and released a patched installer via advisory ADSK-SA-2026-0013.

Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). No public exploit code has been identified at the time of analysis, and it is not listed in CISA KEV, but the combination of unauthenticated access and full code execution makes it a top-priority patch.

Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).

Arbitrary Python code execution in calibre's template engine affects all versions prior to 9.12.0, triggered when a user opens or imports a crafted EPUB, OPF, PDF, or OPF file containing malicious composite_template metadata. The root cause is a sandbox policy inheritance failure: nested formatter invocations via template(), eval(), re_group(), and list_re_group() instantiated fresh formatter objects without propagating allow_python_templates=False from the parent, allowing an embedded python: sub-template to bypass the restriction and reach compile_python_template. No public exploit has been identified at time of analysis, though the full patch diff is publicly visible on GitHub and makes the attack straightforward to reproduce.

OS command injection via the SNMP-handling code path in SonicWall Email Security 10.0.35.8405 and earlier grants a low-privileged, authenticated CLI user root-level code execution on the underlying appliance OS. The restricted CLI fails to sanitize user-supplied input before passing it to SNMP-related system commands, enabling full host compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total technical impact (full confidentiality, integrity, and availability loss) makes this a high priority for any deployment where CLI access is shared or weakly controlled.

Python code injection in FreeCAD's FEM Displacement Constraint dialog (all versions prior to 1.1.2) enables arbitrary code execution at the FreeCAD process's privilege level when a victim opens and accepts a weaponized project file. The root cause is an incomplete sanitization routine in TaskFemConstraintDisplacement.cpp that strips double-quotes from user-supplied formula fields but leaves backslash characters unhandled, allowing crafted input to escape the Python string boundary constructed by Gui::Command::doCommand(). SSVC rates technical impact as total and confirms a proof-of-concept exists; no CISA KEV listing is present, indicating no confirmed active exploitation campaigns at time of analysis.

Arbitrary JavaScript code execution in Faker.js prior to 10.5.0 is achievable when attacker-controlled strings reach the `faker.helpers.fake` template engine. The vulnerability resides in `fakeEval.resolveProperty` in `src/modules/helpers/eval.ts`, where direct property access on a function return value (`entrypoint?.[key]`) allows traversal to the `Function` constructor via `constructor.constructor`, a classic sandbox escape. Applications that pass any user-supplied input to `faker.helpers.fake` on the server side are directly exposed to remote code execution; in local/development contexts, exploitation requires low-privileged access to control template strings. No public exploit identified at time of analysis, and the fix is available in version 10.5.0.

Arbitrary code execution in the PapersGPT for Zotero plugin (versions ≤0.6.1) lets an attacker who controls or tampers with LLM responses run JavaScript in Zotero's chrome-privileged context. Text returned from the LLM endpoint is passed unsanitized into window.eval() in views.ts, so a poisoned PDF (prompt injection), a man-in-the-middle on the API channel, or a malicious custom endpoint can achieve full RCE. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV, but an upstream fix removing the eval sinks is available.

Unauthenticated remote code execution in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier lets remote attackers read sensitive data and write arbitrary files through a Zip-Slip path-traversal flaw during archive extraction, which can be leveraged to plant executable content and achieve code execution. The issue was disclosed by SonicWall PSIRT (SNWLID-2026-0011) and carries a CVSS 9.1 (Critical) rating. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'.

OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted CLI user to execute arbitrary commands as root via a crafted netmask parameter. The CVSS 7.8 score reflects complete confidentiality, integrity, and availability impact despite requiring local CLI access and low-level privileges. No public exploit code exists and CISA SSVC indicates no known exploitation at time of analysis, though successful exploitation yields full appliance compromise.

Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. No public exploit identified at time of analysis, though the CVSS 9.4 rating and 'total' technical impact make this a high-priority patch target.

CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature through user interaction, resulting in high-impact compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects a local attack vector requiring user interaction, with no privileges needed from the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE tag and full C/I/A impact make this a priority for environments running PowerShell on Windows.

Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary code on a victim's machine with no prior authentication, provided the victim performs a user interaction - such as opening a malicious workspace, file, or URI. Classified under CWE-94 (Code Injection), the vulnerability carries a CVSS base score of 8.8, reflecting high impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing was identified at the time of analysis, but the attack complexity is rated Low, making reliable exploitation straightforward once a victim is lured.

Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise across confidentiality, integrity, and availability on unpatched servers running SharePoint 2016 Enterprise, 2019, or Subscription Edition. The CVSS 8.8 rating (AV:N/AC:L/PR:L) reflects network exploitation requiring only low-privileged credentials, though the CVE description characterizes the primary effect as spoofing rather than full remote code execution - a tension that deserves verification against the Microsoft MSRC advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis, and SSVC rates exploitation as none and automatable as no, moderating the immediate response urgency.

Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.

Code injection in Vim's vimball plugin prior to version 9.2.0847 allows arbitrary operating-system command execution when a user installs a crafted vimball archive and later uninstalls it. An attacker who delivers a malicious vimball containing a member named .VimballRecord can overwrite the installation record with arbitrary Ex commands - including shell invocations via :! - which execute with the victim user's full privileges when vimball#RmVimball() is subsequently called. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV; the upstream patch is available as Vim 9.2.0847.

Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.

Expression sandbox escape in n8n's workflow engine allows any authenticated user with workflow creation or modification permissions to execute arbitrary operating system commands on the host running n8n. The flaw, classified as CWE-94 code injection, affects all npm releases of n8n-io/n8n prior to version 2.31.5 and all 2.32.x releases prior to 2.32.1. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the full confidentiality, integrity, and availability impact ratings reflect a genuine high-severity remote code execution primitive for any n8n deployment where workflow editing rights are not tightly controlled.

Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.

OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote OS command execution in SPIP before 4.4.18 is achievable by any authenticated editor-level user on SQLite-backed installations via the navigation menu endpoint. Array-typed GET parameters submitted to /ecrire/?exec=navigation bypass the CMS sanitization layer and break out of an internal PHP string evaluation context, enabling arbitrary command execution in the web server process. MySQL-backed deployments are not affected; no public exploit has been identified at time of analysis.

Arbitrary command execution in the goose AI agent's `goose review` command allows a malicious Git repository to run attacker-controlled code on the host before any model interaction occurs. The vulnerability exists in versions prior to 1.44.0 and stems from goose invoking the system `git` binary without suppressing the `core.fsmonitor` configuration key, meaning a repository's `.git/config` can nominate an arbitrary command that Git then executes during index refresh. Exploitation requires only that a user runs `goose review` inside a malicious repository, and the injected command inherits the user's full environment - including provider API keys and filesystem access. No public exploit has been identified at time of analysis, though the fix commit and advisory are public.

Stale mode_callbacks pointer dereference in the Linux kernel xfrm IPTFS subsystem causes kernel panic when deferred garbage collection runs after the xfrm_iptfs module has been unloaded following a failed IPTFS state initialization. The xfrm subsystem's __xfrm_init_state() caches x->mode_cbs before IPTFS setup completes, but releases the temporary module reference immediately on failure - leaving a dangling callback table pointer that xfrm_state_gc_task later dereferences against an unloaded module. No public exploit code exists and EPSS is 0.17% (6th percentile), though the vendor-assigned CVSS of 7.8 reflects worst-case kernel memory impact if the race is won.

Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letting an attacker who can influence a database connection string coerce the server into loading attacker-controlled JDBC driver behavior and executing arbitrary code on the Ranger host. This flaw affects the centralized authorization framework used to govern access across Hadoop-ecosystem services, so compromise undermines the very control plane meant to enforce data security. There is no public exploit identified at time of analysis and EPSS is low (0.36%, 29th percentile), but the fix in 2.9.0 and the critical 9.8 CVSS warrant prompt patching.

Remote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-schema-registry component, letting an attacker who can reach the affected interface load and run attacker-controlled classes and achieve full compromise (CWE-94). The flaw carries a critical CVSS 9.8 and is fixed in Ranger 2.9.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with EPSS at a modest 0.58% (45th percentile).

Remote code execution in Apache Ranger versions up to and including 2.8.0 stems from unsafe script evaluation in the GraalScriptEngineCreator component, letting an attacker inject and execute arbitrary code (CWE-94) on the Ranger host. Because Ranger is the central authorization and data-governance layer for Hadoop-ecosystem services, compromise can undermine access control across an entire big-data platform. There is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is modest (0.34%, 26th percentile), but the 9.8 CVSS rating reflects the potential for full host compromise once conditions are met.