Remote Code Execution

Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 branches, where a buffer overflow in an underlying operating system service permits a network-reachable attacker to run arbitrary commands and fully compromise the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and the independent assessment agree that no credentials or user interaction are needed, so the practical limiting factor is whether the vulnerable interface is reachable from an untrusted network. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (CISA KEV), but the severity, the network-edge placement of these devices, and the credential-free attack path make this a top-priority patch item for exposed gateways.

Arbitrary code execution in the control plane of Apache Airflow deployments using the Apache Kafka provider 1.15.0 up to but not including 2.0.0: an authenticated user who can edit Airflow connections (PR:L) can plant a dotted-path string in a Kafka connection's extra field that the provider resolves into a Python callable via import_string without any allowlist, and confluent-kafka then invokes it inside the scheduler process. Exploitation is conditional and the limiting factors are substantial: the Kafka event producer must be explicitly enabled through dag_run_events_enabled or task_instance_events_enabled (both disabled by default), and the broker must be a plain Kafka cluster or Amazon MSK, since Google Managed Kafka overwrites the user-supplied oauth_cb and is unaffected. This breaks the Airflow security model because connection-configuration users are only supposed to reach code execution on workers, not the scheduler, and EPSS is low at 0.45% (38th percentile) with no public exploit identified at time of analysis; the assessed vector uses AC:H to reflect the required preconditions.

Let me synthesize. CVE-2026-58710: DecodeFilmGrainParams in film_grain_dec.cc — Android libavc / media codec film grain decoding. Missing bounds check → OOB write → RCE. CVSS 8.8 with AV:N/AC:L/PR:L/UI:N — note PR:L is odd but that's given. CWE-120 (buffer copy without checking size). Reported by Google Devices, references Android Security Bulletin Pixel 2026-09-01. CPE google:android. EUVD affected versions: "Android Android kernel" — weird. Tags: RCE, Buffer Overflow, Google. Missing tag maybe "android". Product name: "Android" — or "Android Film Grain Decoder"? 1-3 words. "Google Android" maybe. Let's use "Android Media Codecs"? Hmm. The vulnerability is in film_grain_dec.cc which is part of libavc (Android's AVC decoder) or a codec2 component. Probably Android's media framework. Product name should be specific: "Android". Let's pick "Google Android" (2 words). Prevalence: Android is ubiquitous. Assessed CVSS vector: Given description "remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." But CVSS vector says PR:L. Hmm. Media decoding typically happens when processing a media file — remotely delivered via messaging, or via media server. PR:L suggests some level of privilege required — perhaps access to a media-decoding service context, or the requirement to send media to a privileged process. Actually, for Android media codecs, an app can trigger decoding with its own privileges. The vendor assigned PR:L. I should give my own assessment. Given the description says "no additional execution privileges needed" and UI:N, but AV:N with media parsing... Typically media parsing is AV:L or AV:N depending on delivery. Android media codec flaws are usually CVSS AV:N/AC:L/PR:N/UI:R for a crafted file. Here UI:N suggests it's triggered via a network media stream (e.g., RTP, video call) without user opening a file. PR:L — the attacker needs local privileges? Hmm, in Android, media codec processes (media.

An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack allows an attacker positioned on the cellular signaling path to corrupt memory and achieve code execution inside the privileged process that handles VoLTE/VoWiFi traffic. User interaction on the target is not required, and the September 2026 Pixel bulletin identifies the flaw as remotely triggerable via improperly validated input. No public exploit code or CISA KEV entry was identified at the time of analysis, and no EPSS score was supplied with the source data, so real-world exploitation activity is unconfirmed.

An out-of-bounds write in Android's audio RTP payload encoder node (AudioRtpPayloadEncoderNode.cpp) lets a remote attacker execute arbitrary code in the media framework process by supplying a crafted audio RTP payload that the node fails to validate. Affected builds are Android/Pixel devices covered by the September 2026 Android Security Bulletin; the vendor description states user interaction is required to trigger the flaw, and an NVD/EUVD record exists alongside the source.android.com advisory. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided at time of analysis.

A heap-based buffer overflow (out-of-bounds write) exists in the Android Cellular Modem component, allowing an attacker within adjacent/proximal radio range to corrupt heap memory and potentially execute code in the modem context without user interaction. The flaw carries a CVSS base score of 8.0 (AV:A/AC:L/PR:L/UI:N) and affects Google Android devices per the Android/Google Devices CPE. No public exploit code or CISA KEV listing was provided at time of analysis, so exploitation status is unconfirmed; the vendor fix is documented in the September 2026 Pixel/Android Security Bulletin.

Let me synthesize. CVE-2026-56920: Android HEVC decoder, firmware header parsing (fw_hevc_dec_header.c), s_decode_vui_param out-of-bounds write, CWE-787, CVSS 8.8 AV:N/AC:L/PR:L/UI:N. Note: "remote code execution with no additional execution privileges needed" — but CVSS says PR:L. Hmm, this is typical Android bulletin wording: "This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." That's media framework / remote. But CVSS says PR:L which contradicts "no additional execution privileges needed". Actually Android media codecs often run in a sandboxed process (mediaserver), so PR:L reflects the sandbox context. There's a conflict worth noting. Product name: Android (Google Android). Or "Android HEVC Decoder"? 1-3 words. "Google Android" or "Android". Let's use "Android Media Framework"? Hmm — the file is fw_hevc_dec_header.c, HEVC decoder header parsing. Probably part of Android's media codec/firmware. I'll say "Android HEVC Decoder" — 3 words. Actually the CPE says google:android. Product name: "Android HEVC Decoder". Hmm, maybe safer: "Google Android". The field says the specific product or service name affected. CPE is google:android, and it's the HEVC decoder in Android firmware for Pixel devices (bulletin is Pixel). I'll go with "Android HEVC Decoder". Summary: Out-of-bounds write in HEVC VUI parameter decoding. Affected: Android devices with affected firmware (Pixel bulletin 2026-09-01). Remote code execution with no user interaction. No KEV, no POC identified. EPSS: not provided. KEV: not stated → assume not in KEV. POC: not provided → "no public exploit identified at time of analysis". Technical context: HEVC/H.265 VUI (Video Usability Information) parameters in SPS/VPS NAL units; s_decode_vui_param in fw_hevc_dec_header.c; firmware-based HEVC decoder in Android; logic error → insufficient bounds validation → OOB write → memory corruption in media codec process. CWE-787.

Let me synthesize. CVE-2026-56882: Cellular Modem (Android Pixel), information disclosure due to logic error, leading to RCE, no additional execution privileges, no UI. CVSS 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-200 (Exposure of Sensitive Information). Reported by Google_Devices, Pixel bulletin September 2026. Product name: "Android Cellular Modem" — 1-3 words. Maybe "Android Cellular Modem" (3 words). Or "Pixel Cellular Modem". Let's use "Android Cellular Modem". Prevalence: Android is ubiquitous. But cellular modem specifically... The affected component is the cellular modem firmware in Android/Pixel devices. Prevalence of Android = ubiquitous. Hmm. The CPE is google:android. Modem component. I'd say "ubiquitous" given Android base. But the specific modem component... The CPE says google:android, so I'll go with ubiquitous. Actually maybe "high"? Android is on billions of devices — ubiquitous is defensible. Let me say ubiquitous with basis "core platform component across billions of Android devices". Hmm, but cellular modem is only in phones with cellular. Still ubiquitous. Actually, let's be careful — the CPE is google:android which is the whole OS. Cellular modem affects devices with cellular radios = most Android phones. I'll go with ubiquitous. CVSS vector given: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — PR:L is odd for a modem, but that's the input. Note the mismatch: description says "no additional execution privileges needed" but vector says PR:L. That's a conflict to note. My assessed vector: Given it's a modem logic error leading to info disclosure → RCE, remote. I'll assess AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H? Hmm. Let me think. Cellular modem attack — typically over-the-air from a rogue base station or via malicious network. AC:H might be reasonable (requires specific modem state / malformed signaling). But CVSS says AC:L. I'll go with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — hmm, but "no additional execution privileges needed" suggests PR:N. But

Out-of-bounds write in Android's IMS media audio decoder (decodeAmr() in ImsMediaAudioPlayer.cpp) lets a remote party in an IMS-based media session - such as a VoLTE or VoWiFi call carrying crafted AMR-encoded audio - corrupt memory and potentially achieve remote code execution on the device. Affected are Android devices with an active IMS media stack (CPE cpe:2.3:a:google:android:*), and exploitation requires user interaction because the victim must answer or join the call/media session, which significantly limits mass exploitation. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the EPSS score is low (0.21%, 12th percentile), so this is best treated as a serious but currently latent memory-corruption risk pending the September 2026 Android/Pixel security bulletin fix.

An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack, corrected in the September 2026 Android/Pixel security bulletin, can be turned into remote code execution against affected devices. The published vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A all High) indicates network-reachable exploitation with no user interaction, though it assumes low-level privileges while the description claims no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was provided, so active exploitation is not confirmed at time of analysis.

A use-after-free race condition in multiple locations of the Android kernel allows an attacker to corrupt kernel memory and escalate to remote code execution, affecting Android devices covered by the September 2026 Android Security Bulletin. Exploitation requires an attacker to already hold a low-privilege foothold on the device (CVSS PR:L) — typically a malicious or compromised application — and no user interaction is needed once that foothold exists. No public exploit code or CISA KEV listing was identified at time of analysis, so this is currently a patch-now kernel hardening issue rather than a confirmed in-the-wild campaign.

An out-of-bounds write in the Android kernel, caused by a logic error in multiple code locations, allows code execution in the kernel context with high impact to confidentiality, integrity and availability. The flaw is remotely reachable per the CVSS vector (AV:N/AC:L/PR:L/UI:N) and requires no user interaction, though the vector indicates a low-privileged rather than fully unauthenticated attacker. Google published a fix in the Pixel security bulletin dated 2026-09-01; no public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.

An out-of-bounds write in Google's Android Cellular Modem component allows code execution in the baseband when a crafted message is delivered to the modem, with no user interaction required. Google Pixel devices running Android builds prior to the September 2026 patch level are affected, per the Pixel security bulletin. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact); no public exploit code or CISA KEV entry was identified at time of analysis, so the immediate risk is to targeted radio-layer attacks rather than mass exploitation.

An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.

Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF parsing logic, allowing a remote attacker to run arbitrary code in the context of the current process. Exploitation is client-side: the victim must open a malicious document or visit a page that delivers one, so an attacker must first convince the user to interact with the file. The flaw carries a CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787) and was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-28673 / ZDI-26-612; no KEV listing or public exploit indicator was present in the supplied intelligence, so no public exploit is identified at time of analysis.

Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the context of the current process when a victim opens a crafted PDF or loads one from a malicious page. The vendor CPE (pdfforge:pdf_architect:*) gives no version boundaries, so all released builds are presumed affected until a fixed release appears. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28916, advisory ZDI-26-613); at time of analysis there is no CISA KEV entry and no public exploit code identified, and exploitation is gated by the requirement that a user open the malicious document.

Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document in pdfforge PDF Architect, where the PDF parser writes past the end of an allocated buffer (CWE-787). Exploitation requires user interaction - the victim must open the malicious PDF or visit a page that triggers PDF rendering - but needs no prior privileges, and any resulting code runs with the privileges of the PDF Architect process. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29219 / ZDI-26-614); no public exploit code or CISA KEV listing was present in the supplied intelligence, and no vendor fix version is confirmed in the available data.

Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbitrary code in the context of the victim's process. Exploitation requires the target to open a crafted VS file (user interaction), and no authentication or server-side access is needed because the flaw sits in the file parser. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor advisory is ZDI-26-587.

Memory corruption in the OGM file parser of OriginLab Origin Viewer (CWE-119) lets an attacker run arbitrary code in the context of the current process when a victim opens a crafted OGM file or is lured to a page that triggers the viewer. Exploitation requires user interaction and executes with the privileges of the logged-on user rather than escalating to SYSTEM, but all three impact metrics (confidentiality, integrity, availability) are rated high, giving a CVSS 3.0 base score of 7.8. Neither public exploit code nor a CISA KEV entry was identified at the time of analysis, so exploitation is currently treated as targeted rather than widespread.

OriginLab Origin Viewer fails to properly validate user-supplied data while parsing OGWU files, resulting in an out-of-bounds write past the end of an allocated buffer. An attacker who convinces a victim to open a crafted OGWU file (or visit a page that loads one) can corrupt memory and execute arbitrary code in the context of the current process, with CVSS 3.0 base score 7.8 (AV:L/AC:L/PR:N/UI:R). No public exploit code or CISA KEV listing was provided in the intelligence feed, so active exploitation is not confirmed, though the local attack vector and required user interaction mean the primary risk is targeted file-delivery attacks such as email attachments or malicious downloads.

Stack-based buffer overflow in the A2DP profile of the BlueZ Linux Bluetooth stack allows a network-adjacent attacker to run arbitrary code as root on a target once a malicious Bluetooth audio device has been paired with it. The flaw lies in stream endpoint (SEP) handling, where attacker-supplied capability strings are copied into fixed-size stack buffers without a length check (CWE-121), so oversized SEP data corrupts the stack in the privileged bluetoothd process. CVSS 7.1 (AV:A/AC:H/PR:N/UI:R) reflects the requirement for a paired device and radio proximity; no public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.

An out-of-bounds heap write in libwebsockets' HTTP/2 HPACK header decoder lets unauthenticated remote attackers corrupt memory on any instance compiled with HTTP/2 support (LWS_WITH_HTTP2) and exposing an HTTP/2 listener. The flaw is a missing bound check in lws_frag_append(), which appends header/path fragments without verifying the write stays within the configured max_http_header_data limit, so a crafted HPACK-encoded request header can overrun the destination buffer and potentially yield code execution in the server process context. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published an upstream fix commit (824151862f37bc72f46d9a3e01d5b9408d313a0b), and while the raw severity is rated 9.8 (CVSS 3.0), the independent assessment scores it CVSS 3.1 AV:N/AC:H, reflecting that the bounded write must still be shaped by heap layout and platform to become reliable arbitrary code execution rather than a crash. Affected: libwebsockets builds with HTTP/2 enabled; HTTP/1.1-only or non-HTTP/2 builds are not reachable through this path.

A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delivered by a malicious or compromised queue manager, or by an attacker positioned to man-in-the-middle the client-to-manager channel. Successful exploitation can crash the client for a denial-of-service condition or, more seriously, allow arbitrary code execution in the context of the client process. IBM has released a vendor fix via support bulletin 7284943; there is no public exploit code or CISA KEV entry identified at time of analysis, and the elevated complexity (the attacker must control the server side of the connection) keeps real-world risk below its 8.1 CVSS base score for most deployments.

Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / 9.4.0.0-9.4.5.1 CD, and 10.0.0.0) lets an authenticated attacker who can deliver a crafted message trigger JNDI injection and achieve arbitrary code execution inside the consuming client application rather than the queue manager itself. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) characterizes a network-reachable but authentication-gated (PR:L) and high-complexity (AC:H) path whose scope change (S:C) derives from the code execution landing in a downstream client. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available.

Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deployed and network-reachable, because that component performs unsafe JNDI lookups that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can redirect to an attacker-controlled endpoint. Affected builds are IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0, although the non-default, verification-only nature of IVT means exposure is confined to environments where it is actually running and exposed. IBM has released patches, there is no public exploit identified at time of analysis (CISA SSVC exploitation status: none), and while the vendor score of 9.8 reflects total technical impact, our independent assessment raises attack complexity to AC:H to account for the IVT deployment prerequisite.

Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter Installation Verification Test (IVT) application, which fails to properly validate JNDI names. The flaw affects a broad swath of IBM MQ releases: 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, and 10.0.0.0. No public exploit code or CISA KEV entry has been identified at time of analysis, but a vendor patch is available and the CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating full confidentiality, integrity, and availability impact once the attack conditions are met.

IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw that can lead to information disclosure or remote code execution. The issue arises from insufficient input validation before JNDI lookup (CWE-74), and according to the supplied CVSS vector it is remotely reachable without authentication (AV:N/AC:H/PR:N/UI:N), though exploitation requires the attacker to also control a network-reachable directory service and successfully resolve malicious object references in the MQ JVM. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to no; IBM has released patches per its advisory.

Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a channel configured with weak or blank authentication - deliver malicious serialized data that the queue manager deserializes and executes. The flaw affects the 9.1, 9.2, 9.3, 9.4 and 10.0 streams up to their respective maintenance levels (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS and 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS and 9.4.0.0-9.4.5.1 CD, plus 10.0.0.0), giving a 8.8 CVSS base score with high confidentiality, integrity and availability impact under AV:N/AC:L/PR:L/UI:N/S:U. Because the vector requires PR:L, no unauthenticated path is confirmed; no public exploit code has been identified at time of analysis, and IBM has released a vendor fix.

Authenticated remote code execution in GitLab Enterprise Edition (Advanced Search / Elasticsearch indexing) allows a user with project-import rights to overflow a Unicode conversion buffer by importing a specially crafted Git project export, resulting in arbitrary command execution on the GitLab server. All EE versions from 12.3 through 19.1.8, plus 19.2 before 19.2.6 and 19.3 before 19.3.2, are affected under configurations where Advanced Search is enabled. Publicly available exploit code exists and the HackerOne report is referenced, making this a high-priority patching target for internet- or partner-exposed GitLab EE instances, though exploitation requires an authenticated account and a non-default Elasticsearch-backed search configuration.

Improper authorization in Atlassian Jira Service Management Data Center 11.3.0 through 11.3.10 lets an authenticated, low-privileged attacker reach functionality and data they should not be able to access, with the vendor scoring it 7.1 in CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VI:H). Atlassian states the flaw was discovered through its own penetration-testing program and that the impact could extend from exposure of sensitive resources to arbitrary code execution, though the published CVSS 4.0 vector only credits a high integrity impact and rates confidentiality and availability as none. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so at time of analysis this should be treated as a confirmed but not yet observed-in-the-wild authorization bypass; patched versions (11.3.11 and later) are already available.

An improper authorization flaw in Atlassian Confluence Data Center lets an authenticated, low-privileged user reach resources and functionality they should not be able to access, resulting in high confidentiality impact against the affected instance. The defect was introduced across a broad set of release trains — 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 — meaning most currently maintained Data Center deployments built on those lines are exposed until upgraded. Atlassian rates the issue 7.1 (CVSS 4.0, AV:N/AC:L/PR:L/UI:N/VC:H) and has shipped fixes in 9.2.24 and 10.2.17; there is no evidence of public exploit code or confirmed active exploitation at time of analysis.

Sandbox escape in the python_sandbox_server subproject of IBM MCP Context Forge (versions up to and including 1.0.1) allows a remote, unauthenticated attacker to execute arbitrary OS commands with the privileges of the server process. The vulnerable execute_code MCP tool can be exposed over the HTTP/SSE transport without any authentication layer, so any client that can reach the endpoint can submit a payload via tools/call; publicly available exploit code exists (the vendor advisory includes a working local PoC with artifact hashes). Exploitation is conditional on the optional python_sandbox_server being deployed and network-reachable - the core Context Forge gateway and proxy components are not directly affected, and stdio-only deployments are not remotely exposed - but when reachable it is a critical-severity, unauthenticated code-execution path.

Unauthenticated remote command execution in Issabel Framework (the web framework bundled with Issabel PBX) lets any attacker who can reach the pbxapi endpoint forge valid HS256 JSON Web Tokens, because the signing key was a fixed string identical on every installation prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. With a forged bearer token the attacker calls the Asterisk manager originate endpoint using the System application parameter, causing Asterisk to execute arbitrary operating-system commands as the unprivileged Asterisk service user. Rated 9.3 (CVSS 4.0) / assessed 9.8 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and the Shadowserver Foundation observed exploitation evidence beginning 2026-09-09; there is no CISA KEV entry and no public exploit-code reference in the supplied data, but the hard-coded key is trivially recoverable from the public source, so treat exposure as urgent.

Authenticated remote code execution in Koha lets anyone who can reach the affected web service on TCP port 8081 feed a crafted string into an eval() call and run arbitrary code as the service account. The bug is rated CVSS 8.8 (CWE-95) because it needs only a low-privilege authenticated session and no user interaction, yet yields full confidentiality, integrity and availability impact. No CISA KEV listing and no public exploit code were identified at time of analysis.

Let me parse the data. CVE-2026-19407: Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1. Allows RCE and tenant-project token theft. CVSS 7.7, CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. CWE-330 (Use of Insufficiently Random Entropy — actually CWE-330 is "Use of Insufficiently Random Values"). Bucket squatting: attacker registers a cloud storage bucket name that the SDK attempts to use (predictable/guessable name), and the SDK downloads code/artifacts from that bucket, leading to RCE. Related to insufficient randomness in bucket naming. EPSS: not provided. KEV: not provided (no). POC: not provided. Note discrepancy: Description says versions prior to 1.166.1; EUVD says "1.16.0 <1.165.1". That's a data conflict — flag in confidence_notes. Patch: Available from vendor — release notes from March 31, 2026. Affected products: Google Cloud Gemini Enterprise Agent Platform SDK for Python, versions prior to 1.166.1 (fix version 1.166.1). Prevalence: This is a specific SDK — medium/low. It's a Google Cloud SDK for an agent platform — niche enterprise. I'd say "low". Hmm. Gemini Enterprise Agent Platform SDK for Python — AI agent dev kit. Deployment footprint probably low-medium. I'll say "low" with basis "specialized Google Cloud AI agent SDK, limited deployment footprint". Actually maybe "medium" since Google Cloud + Gemini is popular. But the specific SDK for agent platform — low. I'll go with "low". Assessed CVSS vector: AT:P means attack requirements are present (attacker must pre-register the bucket name — that's an attack requirement). PR:N, UI:P (victim must run the SDK / user interaction). So my 3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C? Hmm. Scope — subsequent system impact SC:L/SI:L/SA:L, so scope changed in 3.1 terms. Let's do: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Hmm, but scope change with C:H/I:H/A:H might be too high. Actually the vulnerable system impact is H/H/H.

Code execution on the agent host is achievable in atomic-agents-stack through version 1.0.0 because the HTTP MCP server-registry backend factory accepts cleartext http:// catalog URLs alongside https://, letting a network man-in-the-middle rewrite catalog responses and inject arbitrary command/args values that MCPClientPool subsequently spawns as local subprocesses. The flaw is genuine but conditional and its real-world risk is materially lower than the 9.2 CVSS 4.0 headline suggests: exploitation requires an operator to have configured a cleartext http catalog URL (a deployment choice, not a default-reachable condition), an active man-in-the-middle position on the path to that catalog server, and no operator-authored allowlist (mcp_allow_fn defaults to None); the https:// path is not vulnerable because httpx verifies certificates and does not follow redirects. No authentication or user interaction is required and no LLM involvement is needed, no public exploit code has been identified at time of analysis (SSVC exploitation: none, automatable: no), and the vendor-released fix in 1.1.0 requires https by default and gates http:// behind an explicit opt-in.

Heap-based buffer overflow in FreeRDP client versions before 3.31.0 allows a malicious or compromised RDP server to corrupt client memory by sending a Server Redirection PDU whose LoadBalanceInfo field is longer than the fixed 512-byte heap buffer used in nego_send_negotiation_request. Successful exploitation crashes the client and, when chained with a memory-disclosure primitive, could lead to code execution on the connecting workstation. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record, so current exploitation appears opportunistic rather than confirmed in the wild.

FreeRDP clients prior to 3.31.0 leak uninitialized heap memory through the urbdrc USB-redirection channel when a malicious RDP server forces USB transfers to fail, handing the attacker reliable client-side memory contents. The disclosure is a high-severity confidentiality weakness (CWE-457) that defeats ASLR and becomes remote code execution only when chained with a separate memory-corruption flaw in the client. Publicly available exploit code exists per CISA's SSVC assessment (Exploitation: poc), and SSVC rates technical impact as partial and automatable as no, meaning exploitation is feasible but requires an attacker-controlled RDP server plus a victim who initiates the connection.

Heap memory corruption in FreeRDP's server-side static virtual channel handling (all versions before 3.31.0) allows an authenticated RDP client to send channel messages larger than the expected chunk size, triggering an integer underflow that corrupts heap memory and can overwrite live pointers, potentially yielding code execution on the RDP server. Reachability is gated on the server enabling CHANNEL_OPTION_SHOW_PROTOCOL for the channel, and on the attacker already holding a valid session, so this is a post-authentication, configuration-dependent flaw rather than a pre-auth RCE. A vendor fix is available in 3.31.0 via upstream commit 40d9202, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Authenticated remote code execution affects Flowise versions before 3.1.4 through a validation bypass in MCP server configuration nodes: the path validation routine inspects the clean filename passed in the args array but never checks the cwd (working directory) parameter, so an account able to create or modify an MCP server node can point the working directory at attacker-controlled content and have the spawned process execute it. Publicly available exploit code exists, and the independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (vendor score 9.0 under CVSS 4.0), meaning full confidentiality, integrity and availability loss once the low-privileged authentication prerequisite is satisfied. No CISA KEV entry confirms active exploitation at time of analysis, and CISA's SSVC decision marks the issue as not automatable, so real-world risk concentrates in deployments where ordinary user accounts can define or edit MCP server configuration.

Authenticated remote code execution in Flowise versions before 3.1.4 lets a low-privileged user who can create or edit a Custom MCP node run arbitrary code on the Flowise server by supplying attacker-controlled npm package names in the mcpServerConfig parameter, which Flowise then invokes through npx. The issue carries a vendor-published CVSS 4.0 score of 9.0, while our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), reflecting that the attacker must first hold a valid Flowise account with access to the node editor - no pre-authentication path was identified. No public exploit code was identified at time of analysis and the vulnerability has not been confirmed actively exploited (no CISA KEV listing), so risk is driven mainly by how many users can reach the MCP node configuration UI and whether the instance is internet-facing or uses weak or shared credentials.

Code execution is possible on Dell SmartFabric OS10 switches running versions prior to 10.6.1.3 because the platform downloads code and software images without validating their integrity (CWE-494), so a high-privileged administrator - or an attacker who has already hijacked such an account - can make the device fetch and execute attacker-supplied code. The vendor rates this 9.1 using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, but the flaw is explicitly not pre-authentication: remote network reachability to the management plane plus existing administrative credentials are mandatory, which is why CISA's SSVC assessment records Exploitation: none, Automatable: no, and Technical Impact: total, and no public exploit was identified at time of analysis. Dell has released a fixed build, OS10 10.6.1.3, under advisory DSA-2026-343.

Heap-based buffer overflow in Ghostscript's JPEG 2000 (JPX) stream decoder (base/sjpx_openjpeg.c) allows unauthenticated remote attackers to corrupt memory, and potentially achieve code execution, by supplying a crafted PDF containing a JPEG 2000 image whose components declare mismatched subsampling factors. All Ghostscript/GhostPDL releases before 10.08.0 are affected; exploitation requires only that the target render the malicious file, which is effectively automatic in server-side pipelines such as CUPS/print spoolers, ImageMagick/GhostPDL conversion services and web PDF renderers, while desktop use requires a victim to open the document. Vendor-released patch: Ghostscript 10.08.0; no public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV), though the CVSS 4.0 base score of 9.3 reflects the trivial attack complexity and the high confidentiality, integrity and availability impact of a heap allocator corruption primitive.

Sandbox escape in Docker Sandboxes on macOS (0.28.0 through 0.41.x) lets a workload running inside a sandbox break out of its shared workspace and read or modify arbitrary files on the host as the VMM user, with host code execution possible where the reachable files are executable or otherwise privileged. The virtio-fs host server follows symlinks when reopening an unlinked file from a stored path, so a guest that replaces a parent directory of a workspace file with a symlink can redirect host-side file operations outside the workspace bind mount. Exploitation requires the attacker to already control a guest workload (for example an untrusted agent or repository), is macOS-specific, and depends on winning a directory-swap timing race; SSVC records Exploitation: none, and no public exploit code was identified at time of analysis. The raw 9.4 CVSS 4.0 score should be read alongside these preconditions rather than at face value - this is a genuine sandbox escape leading to host compromise, but it is not remotely reachable and is bounded by the privileges of the VMM user rather than root.

Unauthenticated OS command injection in the ping.php endpoint of Trexom's TrxTimeATTENDANCE (versions 1.0.5 through 1.9.5, fixed in 1.9.6) allows any remote attacker who can reach the endpoint to execute arbitrary operating-system commands and obtain remote code execution with the privileges of the web server process. The flaw, classified CWE-78 and scored 9.3 under CVSS 4.0, is remotely exploitable with no authentication or user interaction (PR:N/UI:N/AC:L), and publicly available exploit code exists, elevating the risk for any instance exposed beyond a trusted LAN. CISA's SSVC assessment records exploitation as 'none' at time of analysis (no KEV listing), but the total technical impact and full automatability make this a high-priority patch item for the niche organizations running this time-and-attendance application.

Server-side template injection in Polyaxon through 2.16.4 lets any user who can submit a run execute arbitrary operating-system commands in the scheduler process by embedding Jinja2 payloads in spec fields such as queue, namespace, conditions, presets, or dependencies. Because the scheduler renders those fields with an unsandboxed Jinja2 environment, a low-privileged authenticated tenant can reach database credentials and service tokens held by the scheduler, turning a normal ML experiment submission into host-level code execution (CWE-1336, CVSS 4.0 base 8.7). No public exploit code or CISA KEV entry was identified at time of analysis, but the attack requires only a valid low-privilege account and no user interaction.

Remote code execution in the PraisonAI TypeScript `codeMode` tool (npm package `praisonai` <= 1.7.1) lets an attacker who can influence the model-generated `code` argument escape the regex blocklist 'sandbox' and run arbitrary JavaScript with the host process's privileges, reading and writing files, harvesting environment credentials, and executing operating-system commands. The CVSS 3.1 vector is unauthenticated and network-facing (AV:N/AC:L/PR:N/UI:N, 9.8) with total confidentiality and integrity impact, though the real-world prerequisite is that `codeMode` is enabled for an agent and the attacker can steer the tool argument - typically through prompt injection into untrusted content the agent ingests. Publicly available proof-of-concept code exists (published in the GitHub advisory, demonstrated against Node.js v20.20.0), EPSS is a low 0.77% (54th percentile) and CISA SSVC records Exploitation: none, so there is no confirmation of active exploitation at time of analysis; the vendor fix is version 1.7.2.

Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.

Path traversal in the Weights & Biases (wandb) Python client before 0.29.0 lets a malicious or compromised W&B backend push crafted file names through the File.download path, writing attacker-controlled files outside the intended download directory. Publicly available exploit code exists, and because arbitrary file writes can target shell startup files or Python import paths, successful abuse can escalate to code execution on the victim host. No CISA KEV listing has been reported, so exploitation appears to be proof-of-concept driven rather than confirmed widespread activity.

Authenticated command injection in the MitraStar GPT-2742GX4X5v6-SV gateway (firmware GL_g2.5_100XNT0b23_3) lets an attacker who already holds valid web-interface credentials run arbitrary operating-system commands through the /cgi-bin/device-management-utilities-internet.cgi endpoint, taking full control of the device. The flaw is scored CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78, so compromise yields complete loss of confidentiality, integrity and availability of the unit. No CISA KEV entry or EPSS score was supplied with the intelligence, and no vendor-released patch has been identified; the cveorg reference points to a public GitHub repository that appears to carry technical detail, so publicly available exploit code should be assumed plausible pending verification.

Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.

CVE-2026-86320 is a vulnerability reported via the Ubuntu vendor channel for which no public description, CVSS score, CWE classification, or technical detail has been disclosed at time of analysis. The affected product and impact cannot be independently characterized from available intelligence. Security teams should monitor the Ubuntu Security Notices (USN) portal and the Ubuntu CVE tracker for disclosure once an advisory is published.

Path traversal during in-pod file synchronization in DevSpace through 6.3.21 allows an attacker who controls a container to write arbitrary files on the developer's workstation, enabling code execution. The sync client extracts tar entries streamed from a running pod without sanitizing parent-directory (..) sequences in entry names, so a malicious container can escape the intended sync target directory and overwrite shell RC files, SSH authorized_keys, IDE configuration, or other user-writable paths. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis, though the VulnCheck disclosure and GitHub issue #3290 provide full technical detail.

Remote code execution affects IBM MQ across the 9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD and 10.0.0.0 release lines because the queue manager deserializes untrusted data (CWE-502), letting an attacker who can already authenticate to the messaging service run arbitrary code under the broker's privileges. The flaw carries a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and rates as a credentials-gated but fully compromising issue for any exposed MQ listener. No CISA KEV listing, EPSS score, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis; patch availability is signalled by the IBM PSIRT advisory but no fixed build number is stated in the source data.

Remote authenticated users of the Plesk 'Ruby' (before 1.6.6) and 'Node.js Toolkit' (before 2.5.0) extensions can inject arbitrary shell directives into statically generated application startup code via custom environment variables, resulting in code execution with root privileges on the Plesk server. The flaw is a classic static code injection (CWE-96): user-supplied values are written verbatim into persisted configuration/startup files rather than being escaped. No public exploit code or CISA KEV listing is present in the provided intelligence, and no EPSS score was supplied, so exploitation appears limited to actors who already hold a valid low-privileged Plesk account; vendor patches are available.

Remote code execution in WebPros WHMCS allows unauthenticated network attackers to run arbitrary code on affected installations by feeding crafted serialized data into a code path that deserializes untrusted input (CWE-502). All WHMCS builds from 9.0.0 up to (but not including) 9.0.8, and from 8.0.0 up to (but not including) 8.13.7, are affected; the vendor vector (PR:N/UI:N/AC:L) indicates no authentication or user interaction is required and that default configurations may be exposed, although the specific vulnerable endpoint or feature is not named in the advisory. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation: none and EPSS is 0.69% (51st percentile), but the SSVC Technical Impact is rated total and Automatable is yes, so patching should be treated as high priority.

Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS

A path traversal flaw (CWE-22) in Apple macOS is addressed by improved path validation and allows an attacker who controls a network directory server to execute arbitrary code with root privileges on a connecting client. Affected are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in all three release trains. There is no public exploit code and no CISA KEV listing at time of analysis, and the CVSS 3.1 vector (7.8, AV:L/PR:L) reflects a local vector requiring the attacker to already hold a foothold as a directory service rather than a remote unauthenticated path.

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.

A use-after-free in Apple macOS kernel memory management allows a locally installed and executed app to escalate to kernel privileges and run arbitrary code with full system control. Affected releases are macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27; Apple shipped fixes in all three branches. The flaw is a local privilege escalation (CVSS 7.8, AV:L/PR:L) rather than a remote code execution bug, and there is no public exploit code or CISA KEV listing identified at time of analysis, so real-world exploitation currently depends on an attacker first getting a malicious app onto the target Mac.

Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.

Memory corruption in Apple macOS WebDAV client handling allows code execution when a user connects to an attacker-controlled WebDAV server, affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The flaw is an out-of-bounds write (CWE-787) reachable over the network but gated by user interaction, rated 8.8 by Apple/NVD with an unauthenticated network attack vector. Apple has released fixes in three OS updates, and exploitation is not confirmed — no public exploit code and no CISA KEV listing — while EPSS sits at 0.18% (8th percentile), indicating low predicted mass-exploitation activity; this reads as a credible but targeted risk rather than a wormable event.

A remote input-validation weakness in Apple macOS allows crafted data to terminate an application unexpectedly or, more seriously, achieve arbitrary code execution on the host. Apple has fixed the flaw in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, and only those or later builds are protected. Exploitation requires the victim to interact with the malicious content (CVSS UI:R, PR:N), there is no public exploit code identified at time of analysis, and neither CISA KEV nor the SSVC decision framework indicates observed exploitation, so this is best treated as a patch-now hygiene issue rather than an emergency.

Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.

Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.

IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.

Local arbitrary code execution affects IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27, caused by improper neutralization of special elements used in an OS command (CWE-78). Successful exploitation lets a local attacker run commands in the context of the App Connect Enterprise runtime, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R). IBM has published a fix; CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV listing was identified at time of analysis.

Insecure deserialization in IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27 lets a local attacker run arbitrary code on the host running the integration node or toolkit. The flaw rates CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) with total loss of confidentiality, integrity and availability, but CISA's SSVC assessment records no known exploitation and low automatability, and no public exploit code has been identified at time of analysis. IBM has published a fix; the exact patched build is not enumerated in the supplied data, so the vendor advisory should be consulted for the precise version.

Insecure deserialization in IBM App Connect Enterprise (12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0) allows a local attacker to execute arbitrary code with the privileges of the affected runtime, provided the attacker can get a user or process to handle crafted serialized content. CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:N/UI:R, C/I/A all High), and CWE-502 identifies the root cause as untrusted deserialization. No public exploit code has been identified and CISA's SSVC assessment records exploitation status 'none' with automatable 'no'; IBM has published a vendor fix referenced in its support advisory.

Authentication bypass in ESPHome Device Builder (the esphome-device-builder package powering the `dashboard` subcommand of the ghcr.io/esphome/esphome container) versions before 1.0.12 silently disables dashboard authentication on upgrade for operators who had protected it with the legacy bare $USERNAME/$PASSWORD environment variables. A rename to $ESPHOME_USERNAME/$ESPHOME_PASSWORD (PR #265) dropped the old names with no fallback, so `using_password` becomes false and both the REST auth middleware and WebSocket login gate switch off, leaving the dashboard open to anyone who can reach its port. Because a compromised dashboard caller can compile arbitrary code and read/write config and data directories, this is effectively unauthenticated RCE; publicly available exploit/PoC code exists, though it is not in CISA KEV (SSVC exploitation: none).

Insecure deserialization in the Laravel MagicLink package (cesargb/laravel-magiclink) versions 2.0.0 through 2.25.0 lets an attacker who can already write to the magic_links.action database column — for example via a separate SQL injection or a compromised administrator account — plant a malicious serialized object graph containing an executable closure inside a magic link record. When that link is visited, the package deserializes the record without HMAC integrity checks or class allowlisting and executes the payload as arbitrary PHP code in the application process, yielding full remote code execution at the application's privilege level. The issue is fixed in 2.25.1; there is no public exploit code and no confirmed active exploitation, and CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no'.

An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.

PraisonAI's optional standalone async-jobs HTTP server can be driven by any unauthenticated network client that can reach its listener, which binds 0.0.0.0:8005 by default, because every route under /api/v1/runs lacks authentication and per-job ownership checks. An attacker can submit jobs carrying attacker-controlled prompts and agent YAML/configuration, causing the operator's process to execute agents with access to its environment variables, service credentials, and connected tool capabilities, and can also list, read, stream, cancel, or delete any job system-wide. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with publicly available exploit code exists per SSVC exploitation: poc, an EPSS of 0.97% (60th percentile), and no CISA KEV listing; the vendor has published patched releases.

Heap corruption triggered by a race condition in the Zscaler Client Connector (ZCC) ZPA tunnel handler allows remote, unauthenticated attackers to crash the client process and, under conditions requiring successful heap grooming, potentially execute code in the context of that process. Only ZCC builds below 4.6.0.486, 4.7.0.350, 4.8.0.267 and 4.9.0.412 are affected, and the practical outcome is more reliably a denial-of-service (client crash) than dependable code execution because the underlying race is non-deterministic and hard to win. No public exploit has been identified at time of analysis and the risk is low-immediacy (EPSS ~0.23%, 14th percentile; SSVC Exploitation: none, Automatable: no), despite the vendor's CVSS 8.1 rating.

Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.

Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Path traversal leading to remote code execution in LaraDashboard 0.9.2-1.2.2 allows an authenticated user holding only the delegated settings.edit permission to delete arbitrary host-filesystem files or restore a ZIP archive from any on-disk location, writing arbitrary content into application directories and achieving code execution. CoreUpgradeController and BackupService::deleteBackup() concatenate user-supplied filename parameters directly onto the storage/app/core-backups base path without normalization, basename() sanitization, or boundary verification - and the associated form requests validate only string length, not path content. No patched version was available at time of publication; no public exploit has been identified at time of analysis.

Unauthenticated remote code execution affects ModelTC's LightLLM LLM inference framework in all versions through 1.2.0, where the Config Server's /visual_register WebSocket endpoint deserializes the first client frame with pickle.loads() without any authentication. An attacker who can reach the Config Server port can send a crafted pickle payload whose __reduce__ method runs arbitrary commands with the privileges of the Config Server process. Reported by VulnCheck; a proof-of-concept exists (SSVC exploitation=poc) though the flaw is not listed in CISA KEV.

Arbitrary code execution is possible on Contec CAN 2.0B series communication converter units (CAN-2-WF wireless LAN and CAN-2-USB USB variants) via unrestricted file upload. A remote attacker holding high-privilege credentials can upload a specially crafted file to the device's web interface, resulting in code execution directly on the embedded unit. Reported by JPCERT/CC with a vendor advisory; no public exploit or CISA KEV listing identified at time of analysis.

Eval injection in CONPROSYS HMI System (CHS) by Contec allows authenticated network attackers to execute arbitrary code on the server hosting the HMI application. The flaw (CWE-95) occurs when user-supplied input reaches a dynamic code evaluation function without proper neutralization, enabling full server-side code execution. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, network-accessible nature of the vulnerability makes it a priority for ICS/OT environments running this product.

DLL hijacking in the Rakuten Kobo Desktop Application installer for Windows allows arbitrary code execution at the privilege level of the installing user. The installer performs an insecure DLL search, loading libraries from its own working directory before trusted system paths; if an attacker pre-positions a crafted DLL in that directory, execution is hijacked when the victim runs the installer. Reported by JPCERT and covered by a vendor security advisory; no public exploit code or CISA KEV listing identified at time of analysis.

Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account.

Cross-tenant code execution in Apache Storm Client 3.0.x allows any authenticated cluster user to pre-position a malicious JAR under a predictable blob key and have it loaded into a victim tenant's worker topology. The blob key for `--artifacts` dependency uploads is derived solely from the Maven coordinate, making it identical and guessable for all cluster principals; when the key already exists the client silently reuses the blob without verifying ownership or content integrity. Exploitation results in arbitrary code execution inside the victim's Storm topology, enabling full access to the data and credentials that topology processes. No public exploit has been identified at time of analysis.

Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.

Remote code execution in Spug through v3.4.0 allows authenticated users holding monitor permissions to inject arbitrary OS commands via the `/monitor/run_test/` HTTP endpoint, where user-supplied ping target addresses are interpolated directly into Python f-string shell commands executed with `subprocess.run(..., shell=True)`. Exploitation yields arbitrary command execution as the Spug process user, enabling full server takeover. No public exploit identified at time of analysis, but the vulnerable code path is trivially constructable from public source and the upstream patch commit is publicly visible.

Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/write of host process memory and code execution by exploiting an unchecked calloc() return value during funcref table allocation. When calloc() fails, table->data is left NULL while table->size retains the guest-declared element count, causing bounds checks to pass and element accesses to resolve to absolute low-memory addresses - fully defeating the isolation wasm2c exists to provide. Firefox's RLBox sandboxing of Graphite, Hunspell, Ogg, Expat, and Woff2 libraries is affected, and a public proof-of-concept ('table flip') is available, though exploitation requires specific memory-failure conditions to be present.

Sandbox escape in Flatpak before 1.18.1 allows a malicious sandboxed application to gain arbitrary read and write access to host filesystem paths, with direct escalation to code execution outside the sandbox. The root cause is missing symlink validation in Flatpak's app data directory bind-mount logic: attacker-controlled path components (such as the 'tmp' directory under ~/.var/app/APP_ID/cache/) can be replaced with symlinks pointing to arbitrary host locations, which the Linux kernel resolves when bwrap processes the bind-mount. No public exploit has been identified at time of analysis, and this is catalogued as a separate issue from the related CVE-2026-76925.

Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in `call_get_attribute()` (src/sip_call.c) and `msg_get_attribute()` (src/sip_msg.c), where unbounded `sprintf` calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix commit is publicly accessible, making independent weaponization feasible.

Remote code execution in vLLM's LlavaOnevision2 processor loader allows an attacker who controls a model repository to execute arbitrary code on systems that load that model, bypassing the trust_remote_code=False safety parameter entirely. All vLLM installations prior to version 0.28.0 are affected when loading LlavaOnevision2-architecture models; the security control that operators rely on to safely evaluate third-party models is silently non-functional for this processor class. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only the ability to publish a model to an accessible registry and social-engineer a user into loading it.

Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.