Code Injection

OS command injection in gpsd's gpsprof profiling utility (through release-3.27.5) lets an attacker who controls GPS input inject shell commands via the SKY.satellites[].used field. The value is written unsanitized into a gnuplot heredoc, so a crafted used value containing the heredoc terminator EOD closes the data block early and appends gnuplot system() calls that execute as the user running gpsprof in polar mode. No public exploit identified at time of analysis; the flaw is code-execution class (CWE-94) with a CVSS 4.0 base score of 8.5.

Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.

Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sandbox used to define build configurations-as-code and run arbitrary code in the context of the CI server. Because TeamCity servers hold VCS credentials, deployment keys, and build artifacts, a successful escape effectively compromises the entire build pipeline and downstream software supply chain. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS is low at 0.40% (33rd percentile).

Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by convincing a developer to open a malicious UI Designer form file, leading to full system compromise. No active exploitation or public exploit code has been reported, but a critical-severity vendor patch is available.

Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.

Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in the WordPress "Advanced Views" plugin (by wplake) affects all versions up to and including 3.8.11, allowing an authenticated user with only Subscriber-level privileges to inject and execute arbitrary code (CWE-94) on the server. Rated CVSS 9.9 by Patchstack because a low-privilege account - trivially self-registered on many WordPress sites - can achieve full compromise with no user interaction. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.

Remote code execution in Fujitsu openFT managed file transfer software (Linux and Oracle Solaris variants) before version 12.1D00 lets remote attackers run arbitrary code without authentication (pre-auth RCE) over the network. The flaw is a CWE-94 code injection carrying a CVSS 4.0 base score of 9.3, and the CVSS vector confirms it needs no privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-auth, network-reachable nature makes it a high-priority patch target.

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone under an NSEC-signed parent forge insecure DNS answers for unrelated sibling zones sharing that parent. The root cause is insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing, allowing fraudulent wildcard DS records to bring non-existent delegations into 'insecure' existence and inject spoofed records. Reported by NLnet Labs with a 7.5 (High) integrity-only CVSS; no public exploit identified at time of analysis and no EPSS/KEV data supplied.

Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated attackers run arbitrary code as root by sending a crafted request to the /test endpoint of a service listening on TCP port 9002. The flawed handler fetches, extracts, and executes attacker-supplied files, yielding full device takeover with no authentication or user interaction. Publicly available exploit code exists (published by CyberDanube) and the CVSS 4.0 score is 10.0; the vulnerability is not currently listed in CISA KEV.

Remote code execution in Atlassian Sourcetree for Mac and Windows 3.4.11-3.4.12 enables an authenticated attacker to execute arbitrary code on a victim's machine via code injection (CWE-94), achieving full confidentiality, integrity, and availability compromise. The attack requires low-privilege authentication and user interaction - consistent with a scenario where a victim opens or processes attacker-controlled repository content within the application. No public exploit identified at time of analysis; EPSS at 0.30% (22nd percentile) reflects low current exploitation probability, and the vulnerability was responsibly disclosed through Atlassian's Bug Bounty program rather than discovered in active exploitation.

Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages.write permission plant a malicious Class::method callable directive in page frontmatter, which Blueprint::dynamicData() feeds unfiltered into call_user_func_array(). The injected command then executes as the web-server user for any subsequent visitor to the page, including unauthenticated ones. Reported by VulnCheck (CWE-94, CVSS 4.0 base 9.3); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder user (holding core.create or core.edit permissions) embed raw PHP tags in element content that are subsequently executed when the server's view-cache layer include()s the cached template. Exploitation requires caching to be enabled, which is the default, and yields full remote code execution on the underlying web server. No public exploit identified at time of analysis, though the reporter is Joomla itself and the CVSS 4.0 base score is 8.9 (High).

Eval-based command injection in the Net::DNS module for Perl (versions through 1.55) lets a malicious or man-in-the-middle DNS server run arbitrary shell commands on a client that parses an EDNS EXTENDED-ERROR option. The EXTRA-TEXT field is tokenised and passed to Perl's eval with escaping for $ and @ but not backticks, so a crafted response reaching option('EXTENDED-ERROR') in array context executes attacker-supplied commands. Rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory publishes a working {0:`"<command>"`} payload, EPSS is low at 0.41%, and it is not in CISA KEV.

Arbitrary code execution in SJCAM SJ4000-Air action cameras (firmware V1.4C and earlier), and unbranded whitelabel devices built on the same v1.4C firmware, is possible via a maliciously crafted FEX file - the Allwinner firmware/partition configuration format used by these AllwinnerTech-based devices. The flaw is classified as code injection (CWE-94) with a supplied CVSS of 9.8; no public exploit or CISA KEV listing exists at time of analysis, though a detailed reverse-engineering writeup of the device firmware is publicly referenced. The AV:N network rating in the supplied vector is inconsistent with the description's file-processing mechanism and warrants verification.

Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any external user to run arbitrary code inside the project's trusted CI context prior to firmware 2.7.21.1370b23. Because main_matrix.yml (and related workflows) triggered on pull_request_target while the check, build, and build-debian-src jobs checked out and executed code from the attacker's fork with no approval gate, a pull request from an author_association of NONE automatically ran attacker-controlled files with access to repository secrets and an elevated GITHUB_TOKEN. This is CWE-94 code injection scoring CVSS 10.0; no public exploit identified at time of analysis, though a linked Google Drive writeup may contain proof-of-concept detail.

Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.

Use-after-free in the Linux kernel IPsec transport-mode input path (xfrm) allows a struct net pointer cached in skb->cb to be dereferenced after the associated network namespace has been torn down, because deferred reinjection via xfrm_trans_reinject() did not hold a netns reference. On affected kernels (5.6 through the fixed stable releases) this can corrupt kernel memory or crash the host when IPsec transport-mode traffic is processed during namespace destruction. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and the issue is not listed in CISA KEV.

Denial-of-service in the Linux kernel's generic Fibre Channel transport (scsi_transport_fc) lets an adjacent fabric actor hang a host driving an lpfc (Emulex) or qla2xxx (QLogic) FC HBA. By sending a crafted FPIN ELS frame whose 32-bit pname_count exceeds 255, an attacker wraps a u8 loop counter in the Link-Integrity and Peer-Congestion descriptor walkers, producing a non-terminating loop (non-return) in kernel context. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the flaw is remotely triggerable without authentication from within the SAN fabric.

Memory corruption in the Linux kernel's cgroup BPF sysctl filtering path allows a local privileged user to corrupt kernel memory and potentially escalate privileges. The bug is a mismatched allocator/deallocator: proc_sys_call_handler() allocates the temporary sysctl buffer with kvzalloc() (which falls back to vmalloc() for large writes) but the replacement path in __cgroup_bpf_run_filter_sysctl() frees it with kfree(), which is invalid for vmalloc-backed memory. It carries a CVSS of 7.8 (High) with a local vector; EPSS is very low (0.19%, 9th percentile) and there is no public exploit identified at time of analysis, consistent with a memory-safety fix flagged by an experimental static-analysis tool rather than in-the-wild abuse.

Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to arbitrary code injection by low-privileged authenticated users with network access. The flaw is classified as CWE-94 code injection, meaning attacker-supplied input reaches an execution context without adequate sanitization. Broadcom has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the EPSS score of 0.68% (48th percentile) reflects modest current exploitation probability despite the high CVSS 8.8 rating.

Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-privileged, network-connected user, stemming from a code injection flaw (CWE-94) in the controller. Multiple major version branches from 22.1.1 through 32.1.1 are confirmed affected, with vendor-released patches available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating and full high-impact triad (C:H/I:H/A:H) make this a high-priority patch target for any deployment where the control plane is network-reachable.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override arbitrary component parameters at runtime through the API, bypassing the parameter filtering logic in the apply_tweaks() function (CWE-94 code injection). Because a low-privileged authenticated account is sufficient and the impact is full compromise of confidentiality, integrity, and availability (CVSS 8.8), this maps to server-side code execution on the Langflow host. There is no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Python — and therefore arbitrary OS commands — with the privileges of the Langflow server process. The flaw is a design failure in the POST /api/v1/validate/code endpoint, which passes user-supplied code straight into Python's exec() with no sandbox, validation, or privilege drop. Rated CVSS 9.9 by IBM; no public exploit identified at time of analysis, though the trivial exec()-based trigger makes exploitation straightforward once authenticated.

Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to elevate their account to superuser by directly manipulating the underlying database, then execute arbitrary system commands and achieve full compromise of the host running the Langflow service. The flaw (CWE-94, code injection) carries a critical CVSS 9.9 with a scope change, meaning code runs with the Langflow service account's permissions beyond the vulnerable component. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.

Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenticated users with flow-creation privileges to bypass the allow_custom_components=false control via the Policies component's ToolGuard integration. Because validation only inspects the main component code and ignores dynamic CodeInput fields, attackers persist malicious Python in a flow that runs server-side when a guarded tool executes. No public exploit has been identified at time of analysis, but the flaw is IBM-confirmed with a vendor patch and carries a critical 9.9 CVSS due to cross-tenant escalation through the agentic MCP update_flow_component_field tool.

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attacker achieve full RCE on default deployments by chaining two endpoints: /api/v1/auto_login, which mints SUPERUSER tokens to any caller, and /api/v1/validate/code, which passes user-supplied code to Python's exec(). CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N) and a vendor patch is available; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Code injection leading to remote code execution affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 when an attacker can influence the JDBC connection URL passed to the driver. An attacker who controls the JDBC URL (typically via an application that builds connection strings from user input) can inject malicious properties or references that cause arbitrary code to execute in the context of the connecting application/driver host. IBM has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.

Build-time remote code execution in Nuclio (serverless/FaaS platform) versions <= 1.15.27 lets remote attackers run arbitrary OS commands as root inside the function-builder container. The Java runtime renders user-supplied runtimeAttributes.repositories values into a Groovy build.gradle file via Go's text/template using the non-escaping {{ . }} action, so an attacker can inject a closing brace to break out of the repositories {} block and append Groovy that Gradle executes during its configuration phase. Because the Dashboard API defaults to NOP (no) authentication, exploitation needs no credentials; a dynamically-verified proof-of-concept is published in the vendor advisory, though there is no public exploit identified as being used in active attacks.

Code injection in Frogman before 1.6.2 lets an authenticated PERM_WRITE caller of the MCP/HTTP dialplan API inject arbitrary Asterisk directives - including System() and Set(SHELL(...)) - into extensions_custom.conf, yielding remote command execution on the PBX host. The flaw stems from fm_dialplan_apply sanitizing only the context name while passing template parameters such as greeting, dest, url, extension, code, and file into generated dialplan text unchecked. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the CVSS is 9.9 and the fix (v1.6.2) plus root-cause commit are public.

Arbitrary JavaScript execution in Microsoft's @prompty/core TypeScript loader (2.0.0-alpha.1 through 2.0.0-beta.2) allows an attacker who supplies a crafted .prompty file to run code during prompt loading. The loader passed .prompty markdown to gray-matter without disabling its executable 'js'/'javascript' frontmatter engines, so a '---js' frontmatter block is evaluated as Node.js at parse time. Exploitation requires the victim's application to load the malicious file (UI:P); no public exploit is identified at time of analysis and it is not on CISA KEV, but the fix commit ships a working proof-of-concept test.

Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the install command that Kiota presents to developers. When a developer runs `kiota info` (or the VS Code extension's `kiota info --json` dependency-install flow) against an attacker-controlled spec, Kiota reads the `x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand` field plus attacker-chosen dependency name/version values and surfaces them as its trusted recommended install command, achieving arbitrary command execution when that command is run. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the fix explicitly removes the untrusted extension field.

PHP code generation in Microsoft Kiota prior to 1.32.4 permits injection of arbitrary PHP code when the generator processes attacker-controlled OpenAPI specification fields, because the shared `SanitizeDoubleQuote()` helper in `Writers/StringExtensions.cs` fails to escape the `$` character before embedding schema-derived strings into PHP double-quoted literals. Developers or CI/CD pipelines that generate PHP API clients from untrusted or third-party specifications will produce PHP files containing live interpolation expressions (`${...}`, `$var`, `{$obj->prop}`) that execute attacker-chosen code at PHP runtime in production environments. No public exploit has been identified and SSVC rates exploitation as currently none, but technical impact is rated total; the realistic risk is tightly gated on whether teams consume external or attacker-influenced specs without generated-code review.

Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls an OpenAPI description to embed arbitrary Python that executes when a developer generates and imports the resulting client. The flaw stems from unsanitized x-ms-enum.values[].description strings being emitted as inline comments; embedded newlines break out of the comment and run at module scope. No public exploit identified at time of analysis, and the issue is not in CISA KEV. The assigned CVSS 3.1 base score is 7.5, though its impact metrics (C:N/I:N/A:H) understate what is functionally full code execution.

Code injection in Microsoft Kiota Ruby code generator allows remote code execution through crafted OpenAPI specifications. Kiota versions prior to 1.32.0 fail to escape '#' characters in schema-derived strings embedded in Ruby double-quoted literals, enabling Ruby interpolation sequences such as '#{code}' to execute arbitrary commands when the generated client code runs. While no active exploitation is confirmed, the attack is automatable, EPSS indicates moderate probability (1.47%), and the vendor has released a fix.

Code-generation injection in Microsoft Kiota's C# XML documentation-comment writer allows an attacker who controls or compromises an OpenAPI specification to inject arbitrary C# statements into generated client source files. Affected packages Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder in versions prior to 1.29.1 and in the 1.30.0-1.32.2 range fail to strip C# line-terminator characters from description and externalDocs fields before emitting them as single-line /// doc comments, enabling payload breakout into compilable namespace-level code. No public exploit confirmed in the wild at time of analysis, though SSVC reports a POC exists and rates technical impact as total; exploitation culminates when a developer or CI pipeline builds the tainted generated output.

Reflection-based remote code execution in DataEase before 2.10.23 lets an authenticated operator who can configure a Redshift datasource achieve arbitrary code execution on the server. The Redshift JDBC driver loads an attacker-controlled rsjdbc.ini from the system temp directory and honors a malicious socketFactory pointing at Spring's FileSystemXmlApplicationContext, turning a normal JDBC connection into a code-execution chain. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor has confirmed and patched the flaw in 2.10.23.

Server-side arbitrary code execution in TDengine time-series database (versions prior to 3.4.1.15) allows a database user holding the 'create udf' privilege to upload a malicious shared library, register it as a user-defined function (e.g. named 'eval'), and execute attacker-controlled native C code on the server by invoking that function through ordinary SQL queries. This is a privileged-user code injection issue (CWE-94) with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV. The flaw is fixed in version 3.4.1.15.

Authenticated remote code execution in MantisBT versions 1.3.0 through 2.28.3 allows an administrator to run arbitrary PHP as the web server user (www-data) via the 'Manage Configuration' page (adm_config_set.php). When a config value is stored with a non-string type, the ConfigParser/Tokenizer path calls eval() on attacker-controlled code guarded only by a 'return;' prefix; because PHP hoists class and function declarations at compile time regardless of the return, an attacker can plant a class that later hijacks the autoloader. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw was reported privately by watchTowr and fixed in 2.28.4.

Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.

Arbitrary code execution in PraisonAI (praisonaiagents) before 1.6.78 lets an attacker who can drop a Python file into a plugin directory run their own code. The plugin manager auto-discovers and executes any .py file found in project-level or user-home .praisonai/plugins/ directories at initialization, with no code signing, integrity checks, or sandboxing. VulnCheck reported it under CWE-94; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Code injection in PraisonAI before 4.6.78 lets attackers who control deployment configuration achieve arbitrary Python execution because the API-server deployment generator fails to safely encode the deploy.api.host and agents_file values before emitting them into generated Python source (CWE-94). Injected expressions run when the generated API server starts or handles requests, yielding full code execution in the server process. No public exploit is identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.

Stored server-side template injection in Grav's bundled Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 lets a low-privileged content author inject Twig code through the dynamic collection/object title frontmatter, which is passed unsanitized to template_from_string() and executed. Because the title path bypasses Grav's Security::cleanDangerousTwig() filter, an attacker can reach internal Grav services such as the scheduler and escalate arbitrary Twig evaluation to full remote command execution. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.

NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operations because the DataValue.index field is not escaped when the manager builds inventory-sync bulk requests. Because those requests execute under the manager's OpenSearch admin credentials, a single low-trust agent can delete documents, tamper with alerts, and manipulate SIEM state across all other agents. Rated CVSS 10.0 by the reporter (VulnCheck); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in xszyou Fay 4.3.1 lets an unauthenticated remote attacker reach the publicly exposed MCP (Model Context Protocol) management interface and register an MCP STDIO server with attacker-chosen commands, which the service then executes on the host. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-authentication, low-complexity exploitation. There is no public exploit identified at time of analysis; EPSS is modest at 0.61% (45th percentile), and this CVE is part of a broader MCP-ecosystem supply-chain advisory published by ox.security.

Arbitrary Groovy code execution in the jadx Dex-to-Java decompiler (prior to 1.5.6) allows a malicious APK to run attacker-controlled code on the analyst's machine. When jadx exports a decompiled APK as an Android Gradle project, it copies the android:versionName value from AndroidManifest.xml into the generated build.gradle Groovy template without sanitization, letting a crafted value break out of the string literal and inject code that executes when the victim opens or builds the exported project. No public exploit identified at time of analysis; EPSS risk is low (0.15%, 5th percentile) and CISA SSVC records exploitation as none, but the technical impact is total.

Remote code execution in Aetopia Digital Asset Management (DAM) v1.0.0 is achievable through a server-side template injection flaw: attacker-controlled input in the 'name' and 'description' parameters of the Add/Update Project function is evaluated by the server-side template engine, letting an attacker run arbitrary code on the host. NVD scores this CVSS 9.8 (network, low complexity, no privileges required), and a public researcher writeup detailing the SSTI exists on the eslam3kl GitBook; however, there is no public exploit identified as weaponized code and it is not listed in CISA KEV, so it is not confirmed as actively exploited. Note the CVSS PR:N rating conflicts with the fact that Add/Update Project is normally an authenticated application feature.

Code injection (CWE-94) in Adobe ColdFusion 2023 (Update 21 and earlier) and ColdFusion 2025 (Update 10 and earlier) allows a low-privileged, network-adjacent attacker to execute arbitrary code in the context of the current user without any user interaction. Because the CVSS scope is changed, successful exploitation can extend impact beyond the vulnerable component to the underlying host. There is no public exploit identified at time of analysis and the EPSS probability is low (0.43%, 35th percentile), but the near-maximum CVSS of 9.9 and Adobe's own PSIRT reporting make this a high-priority patch.

Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote attacker holding administrator credentials to inject and run arbitrary operating-system commands on the appliance under specific conditions. It affects SMA1000 firmware branches 12.4.3 and 12.5.0, is confirmed actively exploited (CISA KEV), and has publicly available exploit code, though the EPSS probability sits at a moderate 1.65% (74th percentile), consistent with targeted rather than mass exploitation. Successful abuse yields total control of the management plane of an internet-facing remote-access appliance.

Local privilege elevation in Microsoft .NET Framework (and .NET 8.0/9.0 plus Visual Studio 2022/2026) via code injection (CWE-94) that lets an unauthorized attacker run code with full confidentiality, integrity, and availability impact after a victim is tricked into interacting with attacker-supplied content. Microsoft reported the issue and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation requires local access and user interaction (UI:R), which meaningfully limits mass-exploitation despite the high 7.8 CVSS score.

Ban-list poisoning in OpenWrt's luci-app-banip (banIP) before 1.8.10 lets an unauthenticated remote attacker steer the automated IP-blocking engine at an arbitrary victim. Because the awk-based log monitor grabs the first IPv4 address it finds on a log line regardless of field position, an attacker can embed a spoofed IP inside an attacker-controlled field such as a login username; banIP then bans that injected address while the real attacker's source IP is never blocked. Reported by VulnCheck with a vendor patch available; no public exploit code or active exploitation is identified at time of analysis.

Incorrect equality comparison in CedarJava (cedar-java) versions before 4.9.0 causes EntityIdentifier.equals() to return true when comparing against null and false when comparing an object to itself, due to inverted null/self-reference branches. Cedar's actual authorization decisions are unaffected because they are computed in Rust from JSON, but integrators who call equals() on entity identifiers in their own Java logic may make incorrect trust or access decisions. No public exploit identified at time of analysis; the issue is fixed in 4.9.0.

Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circumstances, to execute arbitrary code within the ServiceNow platform, carrying a critical CVSS 4.0 base score of 9.5. ServiceNow has patched hosted instances directly and issued fixes to self-hosted customers and partners; there is no public exploit identified at time of analysis, and the vendor states it is not currently aware of exploitation. The high CVSS complexity metric (AC:H) indicates the exploit is not trivially reproducible against arbitrary instances, tempering the otherwise maximal impact rating.

Authenticated remote code execution in DIRAC's RequestManagementSystem lets any logged-in grid user run arbitrary commands as the DIRAC service account, enabling full compromise of the DIRAC installation. The flaw stems from an eval() call reachable through the export_getRequestCountersWeb service method, and successful exploitation exposes dirac.cfg secrets, database credentials, and all stored user proxies and tokens. Rated CVSS 9.9; no public exploit code has been released, though the vendor advisory documents a complete working exploitation path.

Man-in-the-middle interception of Apache Airflow's Git provider (apache-airflow-providers-git before 0.4.1) is possible because git-over-SSH operations run with StrictHostKeyChecking=no by default, so no SSH host-key verification occurs. An attacker positioned on the network path between an Airflow worker and its Git server can impersonate the server to steal the SSH deploy key or inject malicious DAG content, leading to code execution on workers. No public exploit identified at time of analysis, and it is not listed in CISA KEV; CVSS is 8.1 (High) driven by high attack complexity (AC:H) requiring an on-path position.

Remote code injection in the Realtyna Organic IDX WordPress plugin (real-estate-listing-realtyna-wpl) affects all versions up to and including 5.2.0, allowing remote attackers to inject and execute arbitrary code (described as 'Remote Code Inclusion') against affected WordPress sites. Patchstack assigned a maximum CVSS 3.1 base score of 10.0 with an unauthenticated network vector and scope change, indicating full compromise of the host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Server-Side Template Injection in Centreon's centreon-open-tickets module enables authenticated users to achieve remote code execution on the Centreon Infra Monitoring server. The message_confirm field is persisted without sanitization and later rendered by the Smarty template engine with no security policy applied, so injected template directives execute as server-side code. Rated CVSS 9.6 with a scope change; no public exploit identified at time of analysis and no EPSS score supplied, but the low authentication barrier and RCE outcome make this a high-priority patch.

Improper URL encoding in Apache Gravitino versions 1.0.0 through 1.2.0 lets remote attackers inject crafted path segments through unencoded, user-supplied metadata identifiers, redirecting or manipulating the internal HTTP requests Gravitino issues on the user's behalf. Because the CVSS vector (AV:N/PR:N) indicates no authentication and yields a 9.1 Critical score with high confidentiality and integrity impact, an attacker can potentially reach unintended endpoints, tamper with metadata operations, or exfiltrate data from back-end catalog services. No public exploit identified at time of analysis, and the flaw is fixed in version 1.2.1.

Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating the LLM that drives the CodeAgent component. Because CodeAgent._execute_python() runs LLM-generated code with no AST validation, import restrictions, or sandbox, an attacker who can shape model output via prompt injection can exfiltrate all environment secrets and gain full control of the agent host. VulnCheck reports the flaw with a maximum CVSS 4.0 score of 10.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authenticated account takeover in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.10) lets a Contributor-or-above user inject a Bcc header into WordPress's administrator password-reset email via the plugin's Login/Register widget, capturing a valid admin reset link and seizing the site. The flaw stems from an email-header (CRLF) injection where the allowed-values check is enforced only in the browser editor, not server-side. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor fixed it in version 6.6.11.

Authenticated remote code execution in the Smackcoders WP Ultimate CSV Importer WordPress plugin (versions up to and including 8.0.1) lets a low-privileged Subscriber run arbitrary PHP on the server. Missing capability checks on the install_addon, saveMappedFields, and StartImport AJAX handlers, plus a plugin nonce leaked to any authenticated admin-page viewer, let an attacker install the WooCommerce add-on, persist PHP expressions in the MappedFields parameter, and force their evaluation through eval() in ImportHelpers::get_meta_values(). No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; with an EPSS signal not provided, the CVSS 8.8 and trivial subscriber prerequisite make it a high patch priority.

Object injection in the Drupal Tealium iQ Tag Management contributed module (versions before 2.4.0) lets authenticated attackers manipulate dynamically-determined object attributes to compromise data confidentiality and integrity. Because the CVSS vector (AV:N/AC:L/PR:L) indicates a low-privileged authenticated user over the network, any user with a foothold on the site can potentially abuse the flaw; there is no public exploit identified at time of analysis and the EPSS probability is low (0.42%). Drupal has published advisory SA-CONTRIB-2026-064 and released a fixed version.

Object injection in the Drupal Plotly.js Graphing contributed module (all releases 0.0.0 through 3.0.2) lets an authenticated attacker with low privileges tamper with dynamically-determined object attributes, undermining both confidentiality and integrity of the site. The flaw stems from improperly controlled modification of object properties (CWE-915), and the network-reachable, low-complexity CVSS 3.1 vector (8.1) reflects meaningful severity; however, EPSS is only 0.16% (6th percentile) and no public exploit identified at time of analysis. It is not listed in CISA KEV.

Object injection in the Drupal contrib module Flag attendance field (all versions up to and including 1.2) lets an authenticated user with low privileges pass attacker-controlled data into a dynamically-determined object attribute (CWE-915), enabling PHP object injection and high-impact compromise of data confidentiality and integrity. The Drupal Security Team published advisory SA-CONTRIB-2026-049 and a fixed release is available. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.17%, 7th percentile).

Object injection in the Drupal Formatter Field contributed module (all versions from 0.0.0 up to but not including 2.0.0) allows remote unauthenticated attackers to improperly modify dynamically-determined object attributes, potentially leading to arbitrary code execution or full site compromise. The flaw carries a CVSS 9.8 rating, but with no public exploit identified and a low EPSS probability (0.17%, 7th percentile), and SSVC currently rates exploitation as 'none'. A vendor patch is available via Drupal advisory SA-CONTRIB-2026-048.

PHP object injection in the Drupal AlternativeCommerce (Basket) contributed module (all versions up to and including 2.1.17) allows remote unauthenticated attackers to modify dynamically-determined object attributes and inject crafted objects into the application. Successful exploitation can lead to code execution or full compromise of the Drupal site, with CVSS 3.1 scoring it 9.8 (Critical). No public exploit identified at time of analysis, and EPSS is low at 0.16% (6th percentile), indicating no observed exploitation activity yet despite the high severity rating.

Sensitive configuration exfiltration in Grav CMS before 2.0.2 lets an authenticated page author bypass the Twig sandbox and read the full config tree, including plugin SMTP credentials, API keys, and database passwords. The flaw is an incomplete fix for the earlier GHSA-j274-39qw-32c9 sandbox escape: the redacted 'config' facade is still trivially bypassed through the allow-listed grav.offsetGet('config') call. No public exploit has been identified at time of analysis, though the bypass technique is fully described in the vendor advisory.

Remote code execution in PraisonAI before 4.6.78 lets an attacker who can supply the agents_file parameter to deploy/api.py run arbitrary Python, because that value is interpolated directly into an f-string that is later executed as generated server code via subprocess.Popen(). The CVSS 4.0 base score is 9.4 and the vector requires high privileges (PR:H), meaning the attacker must already be able to reach and drive the deployment API. No public exploit has been identified at time of analysis and it is not on the CISA KEV list.

Arbitrary OS command execution in Vim prior to 9.2.0736 arises from the bundled PHP omni-completion script (runtime/autoload/phpcomplete.vim), which interpolates an attacker-controlled class or trait name from the edited buffer into a search() pattern executed via win_execute() without escaping. When a victim opens a crafted PHP file and invokes omni-completion, a name containing a single quote breaks out of the search string and the trailing text is honored as Ex commands, letting an attacker run shell commands through :! . There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is fixed and the mechanism is well documented in the vendor advisory.

Arbitrary Ex command execution in Vim before 9.2.0735 arises from its C omni-completion script (runtime/autoload/ccomplete.vim), which interpolates the unescaped typeref: or typename: field of a tags entry into a :vimgrep pattern passed to :execute. Because :vimgrep treats the bar character as a command separator, a crafted tag field can terminate the search pattern and append an attacker-controlled command that runs with the privileges of the editing user when a victim opens a malicious .c file and triggers C omni-completion. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.4 reflects high confidentiality, integrity, and availability impact.

Remote code execution in Metabase (open-source BI/analytics platform) versions 1.55.0 through the fixed releases arises because one database-creation code path failed to validate unsafe H2 JDBC connection properties, letting an authenticated administrator register a crafted H2 datasource and run arbitrary Java on the server host. Because the CVSS scope is Changed (S:C), successful exploitation escapes the application context and yields full host compromise. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.1 and RCE nature make it a high-priority patch for any exposed Metabase instance.

Cross-user remote code execution in Open WebUI before 0.10.0 lets an authenticated user run arbitrary code interpreter Python or invoke tools inside another logged-in user's session. The get_event_call handler dispatched execute:python and execute:tool Socket.IO events to any client-supplied session_id that was merely 'connected', so an attacker who harvested a victim's socket ID via the ydoc:document:join collaboration flow could hijack that session. A proof-of-concept is indicated in the SSVC data, though the flaw is not in CISA KEV and EPSS rates near-term mass exploitation low (0.28%, 19th percentile).

Directory data disclosure in PEAKUP Technology's PassGate (all versions through build 30042026) allows remote unauthenticated attackers to manipulate LDAP queries by injecting special characters into user-controlled input. Reported by TR-CERT (Turkey's national CERT), the flaw carries a CVSS 8.2 driven by high confidentiality impact with no authentication or user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, indicating no confirmed active exploitation.

Man-in-the-middle exposure in Nozomi Networks Remote Collector arises because configuring an upstream Guardian or CMC through the n2os-tui interface generates a configuration that disables TLS certificate verification, with no option to re-enable it. Any attacker positioned on the network path between the Remote Collector and its Guardian/CMC can intercept the channel to steal the sync token, impersonate the server, inject spoofed asset or vulnerability data, or disrupt telemetry flow. There is no public exploit identified at time of analysis, and the issue is not on CISA KEV; the vendor (Nozomi) self-reported it.

Argument injection in bosh-cli versions before v7.10.4 lets a compromised or malicious BOSH Director inject arbitrary OpenSSH command-line options into the ssh process that the CLI spawns locally, achieving code execution on the operator's own workstation. It triggers during non-interactive SSH paths such as bosh ssh -c, bosh logs -f, and similar flows where the CLI builds an ssh command from Director-supplied data. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.7 (High).

Remote code execution in the Generic OEM UZ801_v2.1 4G LTE Router (firmware V3.4.3) lets unauthenticated attackers run arbitrary code by sending crafted requests to the /ajax web management API served by the device's MifiService.apk component. The flaw stems from broken access control on the management endpoint, giving remote attackers full control of the device with no credentials. Publicly available exploit code exists on GitHub, though EPSS probability is low (0.24%, 15th percentile) and it is not on the CISA KEV list.

Remote code execution in DSpace 8.0-8.3 and 9.0-9.2 allows an authenticated administrator to execute arbitrary Java via Velocity templates used to render COAR Notify/LDN messages, using reflection to escape the templating sandbox. Exploitation requires valid DSpace administrator credentials and is most impactful when chained with the related LDN path-traversal flaw (GHSA-9qm4-rh6w-pq5x). No public exploit identified at time of analysis, and CVSS is 8.0 (High).

Command injection in yt-dlp and youtube-dl before 2026.7.4 lets a malicious video/webpage host smuggle attacker-controlled data into shortcut files generated by the --write-link, --write-url-link, and --write-desktop-link options. Because webpage_url and filename metadata are written to .url/.desktop files without validation or escaping, an attacker can inject a file:// URI on Windows or a newline-based Desktop Entry key on Linux that runs commands when the victim later opens the generated shortcut. No public exploit identified at time of analysis; EPSS is modest at 0.55% and CISA SSVC records exploitation as none, but technical impact is rated total.

Arbitrary Perl code execution in the DBI database-interface module (versions before 1.650) allows attackers who influence a handle's Profile attribute to run host commands. DBI splits a string-form Profile spec into path/package/arguments and interpolates the package portion into a string eval with no validation, so any untrusted value reaching Profile - via the DBI_PROFILE environment variable, direct attribute assignment, or a dbi:Driver(Profile=>SPEC):db DSN clause - becomes executable Perl. The most severe exposure is a network-facing DBI::Gofer or DBI::ProxyServer whose per-request DSN reaches Profile, letting a remote client execute code on the broker. There is no public exploit identified at time of analysis and EPSS is low (0.24%), but technical impact is total.

Remote code execution in Koodo Reader (versions 2.3.0 and earlier) lets an attacker who supplies a malicious EPUB file run arbitrary OS commands with the victim's privileges once the book is imported and opened. The flaw combines a dangerously permissive Electron IPC handler (nodeIntegrationInSubFrames enabled) with unsanitized innerHTML rendering of chapter content, turning ebook display into a Node.js code-execution primitive. No public exploit has been identified at time of analysis; the issue is fixed in version 2.3.1 and is not listed in CISA KEV.

Arbitrary Python code execution in calibre (e-book manager) before 9.10.0 lets attackers run code on a victim's machine simply by having them import or edit a malicious EPUB, OPF, or PDF. The crafted file embeds a custom column definition containing a python: template inside the calibre:user_metadata field, which calibre passes unsanitized to exec() in its template formatter during routine metadata reading (Add books / Edit books). No public exploit has been identified at time of analysis, but the flaw triggers through normal user workflows, making weaponized e-book files a realistic delivery vector.

Arbitrary code execution in DataEase before 2.10.24 lets authenticated users bypass H2 JDBC URL validation using special Unicode characters whose case conversion differs between DataEase's validator and the H2 parser, smuggling dangerous parameters such as INIT into a malicious H2 connection string. Because H2's INIT clause executes SQL/DDL at connection time, an attacker can run arbitrary code on the host. No public exploit has been identified at time of analysis, but a fix commit and release exist, making the mechanism reproducible from the public patch.

Privilege-escalation-capable LDAP injection in HAVELSAN Liman MYS (all releases before Master.1107) lets an authenticated attacker inject unsanitized special characters into LDAP queries, subverting directory-backed authentication and authorization logic. Because Liman is typically wired into corporate LDAP/Active Directory for login, a successful injection can expose directory data, bypass access controls, and manipulate query results. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; risk is driven by the high CVSS 8.8 rating rather than confirmed in-the-wild activity.

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user with write access to any subtree to inject a malicious sudoRole object and gain root-level sudo on every SSSD-enrolled host. The flaw exists because, when ldap_sudo_search_base is left unset, SSSD searches the entire directory tree for sudoRole objects, trusting rules planted anywhere in the DIT. Rated CVSS 8.8 by Red Hat and reported against RHEL 6 through 10 and OpenShift Container Platform 4; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full site takeover of WordPress installations running Uncanny Automator Pro before 7.3.0.6, caused by a supply-chain compromise of the vendor's build/distribution infrastructure that shipped a backdoored plugin build to customers. The injected backdoor hands unauthenticated attackers a working administrator session and beacons the site's secret keys and administrator details to attacker-controlled servers. This is a trojanized-update incident rather than a coding flaw; no public exploit is identified at time of analysis and EPSS probability is low (0.15%, 4th percentile), consistent with the threat being embedded in the code itself rather than requiring an external exploit.

Authenticated remote code execution in FOSSBilling 0.6.10 through 0.7.2 lets an admin-privileged user inject arbitrary PHP into config.php via the Config::prettyPrintArrayToPHP() method, which fails to escape single quotes in string configuration values. Because config.php is pulled in through a bare include on every HTTP request, injected code runs persistently on all subsequent requests. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 8.9, elevated by the persistent, server-wide impact once an admin account is abused.