Remote Code Execution

Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.

Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.

Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.

Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale.

Integer overflow in U-Boot's SquashFS filesystem parser (fs/squashfs/sqfs.c, function sqfs_concat_tokens) enables heap under-allocation followed by a heap-based buffer overflow via strcpy() when a crafted SquashFS image with manipulated token lists is processed during boot. All U-Boot releases through v2026.01-rc4 are affected. No public exploit code and no CISA KEV listing have been identified at time of analysis; a confirmed fix is available in v2026.04-rc1 (commit adccdb2).

Heap buffer overflow in U-Boot's do_mv shell command (fs/fs.c) affects all versions through v2026.01-rc4 and allows an attacker with U-Boot shell access to corrupt pre-boot heap memory and potentially execute arbitrary code before any OS-level security controls activate. The flaw is rooted in missing bounds checks during string length addition when constructing move-command path arguments: integer overflow causes a heap under-allocation, which is then overflowed by an unchecked strcpy() call. No public exploit code or active exploitation has been identified, and the upstream fix is confirmed in v2026.04-rc1.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.

Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.

Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected JSON injection in PrivateBin v2.0.4 and earlier allows remote unauthenticated attackers to inject arbitrary key/value pairs into JSON-LD API responses served at the /?jsonld= endpoint. PHP's FILTER_SANITIZE_URL passes double-quote characters through unmodified into JSON template construction via str_replace(), breaking out of the JSON string context and reflecting attacker-controlled fields. The vulnerable response path additionally omits X-Content-Type-Options: nosniff while setting Access-Control-Allow-Origin: *, enabling any cross-origin structured-data consumer to read the manipulated output. No public exploit or KEV listing exists, though the advisory includes a dynamically verified proof-of-concept on v2.0.4.

Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Remote code execution in Pimcore (all releases up to 12.3.9, plus 2026.1.0 through 2026.1.5) lets any authenticated user holding only the ordinary low-privilege 'objects' DataObjects permission import a DataObject class definition whose field name breaks out of the generated 'protected $<name>;' property and injects attacker-controlled PHP into the class file Pimcore emits, executing arbitrary code as the web-server user when an object of that class is instantiated. The same unvalidated field name is concatenated into ALTER TABLE DDL, giving a parallel SQL-injection primitive. It is an incomplete-fix sibling of CVE-2026-5394, which hardened only the composite-index sink; the advisory (GHSA-9x44-4gxf-8c25) ships a working browser-console PoC, but there is no CISA KEV entry and no EPSS score in the provided data.

PHP Object Injection leading to remote code execution affects the Pimcore DXP/CMS (composer pimcore/pimcore) in versions 2026.1.0-2026.1.5 and all 12.3.x through 12.3.9, where the Hotspotimage DataObject field marshaller deserializes the persisted `*__hotspots` object-store column with no class allowlist. Any attacker able to write crafted PHP-serialized bytes into that column gains arbitrary object instantiation on the next object load, chainable to RCE via gadgets in Pimcore's own bundled dependencies (guzzlehttp/guzzle 7.11.0). A working proof-of-concept demonstrating attacker-controlled file write is published in the vendor advisory; publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided.

Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Path traversal in the aws:downloadContent plugin of amazon-ssm-agent before 3.3.4515.0 allows an authenticated attacker with a specifically scoped ssm:SendCommand IAM permission to write arbitrary files outside the intended download directory with root privileges on targeted managed instances. By directing the AWS-DownloadContent SSM document to retrieve from a controlled S3 source containing crafted object keys with path traversal sequences, an attacker can overwrite sensitive system files and escalate to full remote code execution as root. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root-privilege arbitrary write primitive represents a high-impact capability in compromised-credential scenarios.

Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.

Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.

Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.

Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.

Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.

Unbounded native-token (KLV) minting in the Klever blockchain node (klever-go < 1.7.19) lets any funded account inflate the ledger at will. Split-royalty percentages on a KDA asset are validated by summing per-entry values into a uint32 accumulator with no per-entry cap, so two entries near 0x80000000 wrap the sum below the 10000 (100%) limit and pass validation while each stored percentage stays astronomically large; at payout every split recipient is credited pool × hugePct / 10000 and the negative remainder is silently dropped, minting KLV out of thin air. A full working proof-of-concept is published in the GitHub Security Advisory (GHSA-cgc5-v3f2-8m2v); it is not in CISA KEV and no EPSS score was provided, but the flaw is exploitable on current mainnet and not gated by any fork flag.

Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.

Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.

Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.

Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connection utilities, which instantiate JDBC driver classes from configurable driver names without validating them against an allowlist. An attacker who can control administrative system configuration parameters can force the server to load and execute arbitrary Java bytecode already present on the application classpath, running with the full privileges of the PaperCut server process. No public exploit identified at time of analysis, but the PR:H requirement and PaperCut's history of being targeted make prompt patching advisable.

Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.

Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.

Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.

Unauthenticated remote code execution in SOY CMS arises from unsafe deserialization of attacker-controlled data (CWE-502), letting a remote attacker run arbitrary code with the privileges of the web server process. The flaw was coordinated through JPCERT/CC and JVN (JVN04485476) and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the deserialization root cause and network-reachable, no-authentication vector make it high priority.

PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.

Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.

Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.

Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.

Cross-site scripting via `javascript:` URI injection in Omeka S 4.2.0 allows an attacker who controls site navigation configuration to plant a malicious custom URL that executes arbitrary JavaScript in any visitor's browser when the navigation link is clicked. The flaw resides in the `Url.php` navigation link handler, which failed to reject URLs using the `javascript:` scheme. A researcher-published writeup exists, but no confirmed active exploitation or CISA KEV listing is present at time of analysis.

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

Cleartext cluster key disclosure in Wazuh 4.14.0-4.14.6 allows any low-privilege API user with the default readonly or cluster_readonly role to retrieve the shared secret that authenticates and encrypts all inter-node cluster traffic. The GET /cluster/local/config endpoint was missing the mask_sensitive_config decorator applied to every sibling config endpoint, causing the cluster.key field to be returned unredacted to accounts that are explicitly denied update-config permission. The severity of this information disclosure is amplified by prior Wazuh advisories that establish cluster-peer remote code execution chains contingent on possessing the cluster key, making this a practical stepping stone to full cluster compromise. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog.

Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.

Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to the appliance's VPN listener. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication RCE profile on an internet-facing firewall makes this high priority.

Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.

Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.

Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.

Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.

Out-of-bounds read in V8, Chrome's JavaScript engine, enables remote code execution confined within the renderer sandbox on all platforms running Chrome prior to 151.0.7922.72. The flaw is triggered by a specially crafted HTML page, requiring only that a user visit a malicious site - no authentication or elevated privileges are needed from the attacker. No public exploit code has been identified and no active exploitation is confirmed; EPSS probability stands at 0.30%, aligning with SSVC's 'exploitation: none' classification despite the high CVSS score.

Remote code execution is possible in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier through malformed Bluetooth extended advertisements that trigger out-of-bounds writes and stack corruption. The vulnerability is reachable only from devices already provisioned into the target mesh network, and only on provisioner nodes that have enabled extended advertisement support. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 base score of 8.9 reflects the high impact if exploitation conditions are met.

Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.

Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.

Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.

Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.

Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including 0.103.0, where the default-on "Safe import" filter sanitizes HTML for text notes but omits the 'book' note type. Because book-note content is rendered through the same HTML path as text notes and injected via jQuery's html() in grid-view preview cards, an attacker-supplied import archive can smuggle an executable payload past sanitization; on the Electron desktop client with Node integration enabled this becomes full RCE. No public exploit identified at time of analysis, though the upstream fix commit ships a proof-style test payload, and it is not listed in CISA KEV.

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where the default-on "Safe import" filter sanitizes HTML only for text notes and skips the mindMap note type entirely. An attacker who gets a victim to import a crafted note archive can embed a dangerouslySetInnerHTML payload in the mind map's unsanitized JSON, which Mind Elixir assigns directly to a node's innerHTML when the map is opened; on the Electron desktop client, Node integration turns that XSS into full RCE. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.104.0.

Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumstances, inject and run arbitrary code within a ServiceNow instance and read or modify instance data beyond intended authorization boundaries. ServiceNow rates it CVSS 4.0 10.0 (maximum) with a fully unauthenticated network vector and total confidentiality, integrity, and availability impact including subsequent-system impact. There is no public exploit identified at time of analysis, and ServiceNow states it is not currently aware of malicious exploitation.

Sandbox escape in ServiceNow's Now Platform enables remote code execution within the platform environment, potentially granting attackers access beyond their intended permission level. Scored 8.7 under CVSS 4.0, the vulnerability is network-accessible with low complexity and high impacts on confidentiality, integrity, and availability of the vulnerable system. ServiceNow has deployed patches to hosted SaaS instances and provided updates to partners and self-hosted customers; no public exploit code and no known malicious exploitation have been identified at time of analysis.

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Root code execution in Unitree G1 EDU robot firmware through version 1.5.2 is achievable by proximate unauthenticated attackers via a chained BLE GATT and WiFi provisioning exploit requiring no pairing or credentials. Crafted BLE writes overflow a fixed BSS buffer in the SSID chunk accumulator, corrupting an adjacent mainloop function pointer dispatch entry; the cleanup path subsequently invokes this corrupted pointer, passing attacker-controlled data to system() as uid 0. A public proof-of-concept (UniBLEed) is available, and the CVSS 4.0 score of 7.7 reflects the adjacent attack vector and high complexity of the exploit chain.

Unauthenticated remote code execution in Unitree G1 EDU firmware through 1.5.2 allows any network-adjacent attacker to gain a root shell on the robot by chaining three design flaws without credentials or user interaction. The attack exploits an open WebRTC-to-DDS bridge on TCP port 9991, a hardcoded world-readable AES-128 key, and a path traversal flaw in the chat_go knowledge upload API to plant and execute arbitrary scripts as uid 0 via the bashrunner service. Publicly available exploit code (UniBLEed on GitHub) and a full technical writeup confirm reliable exploitation; no KEV listing has been observed, but the adjacent-network vector makes this a real priority for any institution operating these robots on shared campus or lab networks.

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where an attacker-supplied import archive can carry a note whose title contains an HTML event-handler payload. The default-on "Safe import" filter strips scripts but never escapes titles, and the GeoMap view interpolates the marker note's title directly into innerHTML, so the payload fires the moment the victim opens the map; on the desktop Electron client, Node integration turns that XSS into full RCE on the victim's host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw is fixed in version 0.104.0.

Remote code execution in the Silverstripe Advanced Workflow module allows high-privileged authenticated CMS users to execute arbitrary PHP on the server by injecting a crafted payload into the workflow email template field. The vulnerability affects the `symbiote/silverstripe-advancedworkflow` Composer package across three version lines, with patches released as 6.4.5, 7.1.3, and 7.2.1. No public exploit tool or CISA KEV listing exists at time of analysis, but the GitHub Security Advisory (GHSA-39mm-rwm3-29jp) and accompanying PR test case explicitly document the injection technique, lowering the reproduction barrier for any attacker who reads the advisory.

Remote code execution in the Silverstripe userforms module allows any authenticated CMS author to inject PHP into the email recipient's subject field, which is evaluated server-side by the Silverstripe template engine during form submission email dispatch. Affected are composer package silverstripe/userforms versions below 6.4.9, 7.0.0-7.0.6, and 7.1.0, all of which pass the EmailSubject field through the template parser without sanitizing PHP-bearing localization tags. No CISA KEV listing and no standalone public exploit exist at time of analysis, though the patch PR documents the exact payload format, materially lowering the exploitation barrier for any attacker holding CMS credentials.

Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Safe Import filter, which fails to mark the shareTemplate relation as dangerous. An attacker distributes a crafted export archive containing a malicious EJS template; when a user imports it and subsequently publishes the note, the public share renderer passes raw EJS content to ejs.render() in the server's Node.js process, executing attacker-controlled JavaScript with full access to the filesystem, network, and Node.js runtime. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed public advisory significantly lowers the barrier to exploit development.

Reflected XSS in Netron desktop application versions 9.1.2 and earlier enables arbitrary JavaScript execution within the Electron/Chromium renderer by injecting payloads into unsanitized model node names, types, and attribute descriptions. Reported by HiddenLayer, the vulnerability allows an attacker who can deliver a crafted ML model file to hide graph nodes, conduct local network port scanning, and - when chained with a Chrome n-day exploit - escalate to full Remote Code Execution on the victim's machine. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog.

Reflected XSS in Netron ≤9.1.2 desktop application executes attacker-controlled JavaScript when a user opens a specially crafted ML model file containing malicious node names, descriptions, or type labels. Because Netron is Electron-based, XSS runs in a privileged Chromium renderer context - enabling SSRF-style local port scanning and, when chained with an unspecified Chrome n-day vulnerability, potential remote code execution on the host. No public exploit confirmed at time of analysis, but HiddenLayer published a security advisory documenting the impact chain.

Reflected XSS in Netron desktop application versions ≤9.1.2 executes attacker-controlled JavaScript when a victim opens a crafted neural network model file containing malicious node names, type labels, or value descriptions. Because Netron runs on Electron (a Chromium-based runtime), the injected script operates within a privileged renderer process capable of port-scanning local networks and, with a separately-acquired Chrome n-day, achieving full remote code execution on the host machine. HiddenLayer reported the vulnerability and a vendor fix is available via GitHub commit cd14bad8c91; no public standalone exploit has been confirmed and this CVE does not appear in CISA KEV.

Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.

Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-supplied plugin to run in the host process at import time. Because the plugin signature policy defaulted to WARN, an unsigned or unverifiable non-built-in plugin was compiled and executed before the runtime sandbox was installed, with only a bypassable AST denylist as a gate. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw yields full code execution as the invoking user once a malicious plugin is loaded.

Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite.

Symlink-following in the openssl-encrypt pip package (jahlives/openssl_encrypt) before 1.4.9 allows an evil-maid attacker with physical access to a target USB drive to bypass the verify-usb v2 integrity check and achieve code execution on the victim's machine. The attacker replaces a tool-tree directory with a symlink to a crafted copy that includes byte-identical visible source files and a planted __pycache__/*.pyc compiled bytecode file; CPython's rglob() does not enumerate symlinked directory contents, so the planted file is never counted, verify-usb reports PASSED, and the malicious bytecode executes when the victim launches the portable install. No public exploit has been identified at time of analysis, and the attack is gated behind physical drive access and victim interaction.

Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.

Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.

Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.

WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.

Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Arbitrary PHP file upload leading to remote code execution in the Joomla Event Manager extension (joomlaeventmanager.net) versions before 5.0.1 allows an authenticated administrator to write dangerous file types through the administrator source model and execute code on the underlying server. The flaw is a CWE-434 unrestricted upload weakness that turns legitimate back-end file-handling into a webshell delivery path; no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 9.4 reflects total confidentiality, integrity, and availability impact, though exploitation requires existing high privileges (PR:H).

Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.

Arbitrary code execution via Jackson deserialization affects Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 when applications use Jackson2ExecutionContextStringSerializer and read job execution contexts from an untrusted data source. The JobParameterDeserializer's failure to enforce Jackson's trusted-types allowlist exposes the application to well-known Jackson polymorphic deserialization gadget chains, which can yield full remote code execution on the batch server. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the exploitation technique leverages established RCE primitives broadly understood by attackers targeting Java environments.

Unsafe Java deserialization in Spring Integration's SerializingHttpMessageConverter exposes applications to remote code execution via crafted HTTP requests bearing Content-Type: application/x-java-serialized-object. The converter passes the request body directly to a raw java.io.ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist, meaning any Serializable object - including known gadget-chain payloads - is fully deserialized. Exploitation is conditional on the presence of a compatible gadget library (e.g., Apache Commons Collections) on the classpath, but that condition is frequently met in enterprise Java deployments; no public exploit has been identified at time of analysis and CISA KEV status is not confirmed.

Arbitrary code execution across entire WordPress multisite networks is possible in the Defender Security plugin (versions 5.0.0 through 6.1.x) due to a missing access control check on a network-wide setting. Any site-level administrator on a multisite installation - a role with significantly lower trust than a network/super administrator - can modify this setting to inject and execute code affecting all sites on the network. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), but SSVC rates technical impact as 'total', consistent with the network-wide RCE consequence if exploited by a malicious or compromised site admin.

Privilege escalation to network-wide remote code execution in the Smush WordPress plugin (versions 3.22.1 through 4.3.2) allows any authenticated single-site administrator on a WordPress multisite network to execute arbitrary code across all sites in that network. The flaw arises because the plugin's network-wide configuration interface fails to restrict access to network administrators only, permitting lower-privileged site admins to reach settings with cross-network impact. No public exploit has been identified and SSVC confirms no active exploitation, though the technical impact is rated 'total' given successful exploitation grants full control over the entire multisite infrastructure.

A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.

An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components

Remote code execution in gpt-researcher v0.14.7 and earlier lets an unauthenticated attacker run arbitrary code on the host by pushing malicious Model Context Protocol (MCP) configurations through the application's WebSocket endpoint. Because the endpoint accepts these configurations without authentication, any network-reachable instance is exploitable with no user interaction, and the MCP config path effectively becomes a command-execution primitive. No public exploit and no CISA KEV listing are indicated at time of analysis, and the EPSS probability is low (0.27%), so this appears to be an unexploited-but-severe issue rather than one seeing active campaigns.

An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.

Remote code execution via symlink following in Plesk's Site Import and Migrator extensions allows network-accessible, low-privilege authenticated users to execute arbitrary code as root on the hosting server. Both webpros:plesk_migrator and webpros:plesk_site_import are affected across all versions per CPE wildcard data, with the flaw rooted in CWE-59 improper link resolution during privileged file operations. No public exploit or active exploitation is confirmed at time of analysis, but the low-complexity, network-accessible attack path and root-level impact make this a high-priority remediation target for Plesk hosting environments.

Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.

OS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged authenticated users. The CWE-78 root cause indicates that user-controlled input is passed unsanitized to OS-level shell commands exposed through a network-accessible interface. Dell confirmed this in advisory DSA-2026-369; no public exploit or CISA KEV listing has been identified at time of analysis, though the full C:H/I:H/A:H impact profile makes this a high priority for any organization running this data protection platform.