Remote Code Execution

Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.

Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.

Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.

Unauthenticated remote code execution in the 'WP images upload on piclect' WordPress plugin (versions through 1.0) arises because the plugin writes uploaded files to a publicly accessible directory without validating the filename or MIME/content type. Any remote attacker can upload a PHP file and request it directly to run arbitrary code as the web server. Reported by WPScan with a maximal 9.8 CVSS; no public exploit code is identified at time of analysis and EPSS remains low at 0.16%.

Remote code execution in the Masteriyo LMS WordPress plugin before 3.4.1 allows an attacker holding a minimal account (e.g. subscriber/student) to inject arbitrary PHP objects via user-supplied metadata that is unserialized on read-back, and to leverage a gadget class in a bundled library to write and execute arbitrary code on the server (CWE-502). A weaker unauthenticated variant of the same flaw yields arbitrary file write rather than full code execution. Publicly available exploit detail exists via WPScan; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified as weaponized in the wild.

Remote code execution in the DS Ad Rotator WordPress plugin (all versions through 0.8) allows unauthenticated attackers to upload arbitrary files, including PHP scripts, because the image upload handler enforces no capability check, no nonce verification, and no file-type validation. Any anonymous visitor can drop a web shell into a web-accessible directory and execute it for full server compromise. WPScan reports the flaw with a public advisory; no public exploit is identified at time of analysis and EPSS risk is low (0.20%), but the exploitation technique is trivial and well understood.

Remote code execution against WordPress sites is achievable through the Gpx2Graphics plugin (through version 0.3) by exploiting a missing CSRF token check and absent file-type validation on the plugin's upload handler. An unauthenticated attacker who tricks a logged-in WordPress administrator into visiting a crafted web page can silently deposit an arbitrary PHP webshell in a web-accessible directory, then invoke it to execute OS commands under the web server's identity. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.14% (4th percentile), indicating low current mass-exploitation probability.

Arbitrary file deletion in the CODE MONKEYS PROPOSALS WordPress plugin (all versions through 1.0.1) allows any authenticated user - including a low-privileged subscriber - to delete arbitrary files on the server, because the plugin neither validates the user-supplied file path nor checks the caller's capability. Deleting critical files such as wp-config.php can force WordPress into a reinstallation state, enabling full site takeover. Reported by WPScan; publicly available exploit code exists via the WPScan advisory, though EPSS remains low at 0.15% (4th percentile) and it is not listed in CISA KEV.

Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The `sys_or1k_atomic()` function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling `access_ok()`, and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. Patches are confirmed in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation is identified.

Remote code execution in the SPIP CMS (all versions before 4.4.18) lets attackers holding a valid nonce inject rows into the internal spip_jobs cron table via the editer_objet action, ultimately executing arbitrary PHP. Because the arg parameter resolves SQL table names without an editable-columns allowlist, a crafted arg=job/0 request smuggles attacker-controlled fonction and args values that are unserialized and invoked when the job queue drains. Publicly available exploit code exists (Lexfo write-up chaining SQL injection to RCE), and the flaw was reported by VulnCheck.

Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.

Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.

Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping malicious arguments in ANSI-C quoting ($'...'), which the permission checker fails to inspect. Any user running the affected AI coding agent can be tricked into executing attacker-controlled shell code without the usual approval prompt. Reported by HiddenLayer with no public exploit identified at time of analysis, though the advisory documents the bypass technique in detail.

Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the /update_weights_from_tensor endpoint when no authentication keys are configured. The SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr remain resolvable, enabling malicious pickle REDUCE instructions to execute attacker-supplied code. EPSS is 0.21% and no CISA KEV or public exploit is identified, but CVSS rates the flaw critical.

Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. CVSS S:C (scope changed) reflects that driver-level execution escapes application boundaries and achieves OS/kernel-level impact. No public exploit or KEV listing has been identified at time of analysis.

Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.

Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.

Heap-based buffer overflow in the Sofia IPC daemon's WS-Addressing Action transformation function allows remote unauthenticated attackers to crash Xiongmai XM530 IP cameras or potentially achieve arbitrary code execution by sending a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. Affected firmware is HMT.CM2005-v220608.1837 and all earlier versions. A public vulnerability research repository exists for this CVE, suggesting exploit code or detailed PoC is available. No public exploit identified as confirmed actively exploited at time of analysis.

Authenticated low-privileged users on WoltLab Suite Core (WCF) 6.1.0 through 6.1.22 and 6.2.0 through 6.2.5 can break out of the nowdoc wrapper used by the disk cache writer and inject arbitrary PHP that executes when the poisoned cache file is included, giving code execution with high confidentiality and integrity impact. The issue is a CWE-94 code-injection defect in the DiskCacheSource class, rated 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), where the only meaningful prerequisite is a valid low-privileged account whose submitted data reaches a cached value. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), so the practical risk is concentrated in unpatched, internet-facing WoltLab communities rather than being a broad ecosystem emergency.

Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.11.5 is achievable by authenticated users who can submit custom component source code to the platform. The built-in static security scanner contains a logic error (CWE-693: Protection Mechanism Failure) in its alias-tracking path: when a dangerous callable is referenced indirectly through an annotated class-body assignment, the resolved callable is never validated against the blocklist, making the scan trivially bypassable with a crafted construct. If the malicious component reaches runtime execution, OS commands run in-process with the full privileges of the Langflow service account. No public exploit has been identified at time of analysis, but IBM has released a patch and the network-accessible, low-privilege attack surface makes this a meaningful risk in any multi-user or shared Langflow deployment.

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows a low-privilege attacker to execute arbitrary OS commands by submitting crafted input that bypasses the platform's security scanner denylist. The root cause is an incomplete denylist (CWE-78) in the scanner responsible for gatekeeping executable content within AI workflow components - meaning certain command injection payloads are not intercepted and reach the underlying OS. No public exploit has been identified at time of analysis, though the authenticated-only barrier is a relatively low bar in multi-tenant or shared Langflow deployments.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows authenticated network attackers to run arbitrary operating system commands by supplying crafted input to an unguarded eval() call within the application. The root cause is CWE-94 code injection - attacker-controlled data is passed directly to a dynamic evaluation function without sanitization or sandboxing. IBM has released a patch and no public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward nature of eval()-based injection and the low privilege bar (any authenticated user) make this a meaningful post-authentication escalation risk.

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows authenticated low-privileged users to execute arbitrary server-side code by exploiting an incomplete environment variable blocklist. The root cause (CWE-94, Code Injection) means the platform's intended restrictions on environment variable access can be circumvented by supplying references to variables omitted from the blocklist, resulting in full confidentiality, integrity, and availability compromise. No public exploit has been identified at time of analysis, and a vendor-released patch is available per IBM advisory node/7286666.

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an unauthenticated remote attacker to run arbitrary code by injecting malicious code that is evaluated during graph construction (CWE-94). Because Langflow is a visual framework for building LLM/agent workflows whose flows are assembled into executable graphs, a crafted flow definition submitted to the server is interpreted as code rather than data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, network-reachable, unauthenticated exploitation, though there is no public exploit identified at time of analysis.

Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user to inject and execute arbitrary OS commands on the underlying host. The CWE-78 flaw stems from insufficient sanitization of user-controlled input before it is passed to a system shell call, and the CVSS 8.8 vector (PR:L) confirms exploitation does not require administrative privileges - any valid account suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the IBM support portal.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows any authenticated low-privileged user to inject and execute arbitrary server-side code by embedding special characters in flow display names. The root cause is inadequate neutralization of user-controlled input before it enters a code-generation or evaluation context (CWE-94), yielding full host compromise across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (PR:L/AV:N/AC:L) confirms that any low-privilege authenticated user can exploit this without special conditions or user interaction, achieving full confidentiality, integrity, and availability compromise. IBM has released a patch via advisory 7286562, and no public exploit has been identified at time of analysis.

Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands, achieving full compromise of the affected system. The CVSS 8.8 score (AV:N/AC:L/PR:L) reflects low-complexity network exploitation gated only by a valid low-privilege credential, with complete confidentiality, integrity, and availability impact on the DataStage host. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in IBM Langflow OSS (versions 1.0.0 through 1.10.3) enables a remote authenticated attacker to escape restricted directory boundaries and execute arbitrary code on the server. The flaw (CWE-22) is present in IBM's enterprise packaging of the Langflow AI workflow platform and is network-exploitable with low-privilege credentials, yielding full C:H/I:H/A:H impact per CVSS 8.8. A vendor patch is available via IBM's security advisory; no public exploit code has been identified at time of analysis.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 lets an unauthenticated attacker run arbitrary code and read or tamper with other users' chat sessions by reaching publicly shared MCP (Model Context Protocol) project endpoints. The flaw stems from Langflow failing to enforce its public-flow security restrictions and session-isolation controls, so exposure exists once a project is shared publicly via an MCP endpoint. No public exploit is identified in the provided data, and the item is not listed in CISA KEV.

IBM WebSphere Application Server 8.5 and 9.0 contain improper authentication controls that allow an attacker who already holds a local, low-privileged foothold on the server to bypass security checks and escalate privileges. Successful exploitation yields high confidentiality and integrity impact — protected resources and configuration can be read and modified — though availability is unaffected per the CVSS vector. No public exploit code has been identified, EPSS is very low at 0.12% (3rd percentile), the issue is not in CISA KEV, and a vendor patch is available from IBM.

Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. No public exploit has been identified at time of analysis, but the SSTI root cause and self-hosted Git-forge target make this a high-priority patch.

Remote code execution in OmniRoute AI gateway 3.8.49 and earlier lets attackers run arbitrary commands in the server container via the POST /api/acp/agents custom ACP agent endpoint. The endpoint accepts attacker-controlled 'binary' and 'versionCommand' values and passes them to execFileSync after only a self-consistency (binary-match) check, so a matching interpreter carrying an eval-style argument (e.g. node -e, python -c) executes as code without any shell metacharacter. Because api/acp/ is excluded from the authentication-required prefixes, exploitation is remote and anonymous whenever requireLogin=false or during the fresh-instance bootstrap window; no fixed version exists and no public exploit is identified, though the GitHub advisory documents the PoC shape.

Kernel pool memory corruption in Silicon Labs silabser.sys (the Windows kernel driver for CP210x USB-to-serial bridge devices) v11.5.0 and earlier allows a local unprivileged user who physically attaches a malicious CP210x-compatible USB device to escalate privileges to kernel-level code execution. The driver fails to validate USB device-supplied packet data before processing, enabling crafted malformed packets to corrupt Windows kernel pool allocations. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

PHP object injection in FileRun before 2026.3.0 enables authenticated attackers with database write access to achieve remote code execution via a misconfigured unserialize() call in Perms::getPerms(). A positional array is passed instead of a named-key array to set allowed_classes, causing PHP to ignore the class instantiation restriction entirely; a serialized gadget chain injected into the permissions table is deserialized on every subsequent authenticated page load, allowing arbitrary file writes - including PHP webshells - to web-accessible paths. VulnCheck reported this flaw with a publicly available proof-of-concept; a vendor patch is available in version 2026.3.0, and no confirmed active exploitation appears in CISA KEV at time of analysis.

SQL injection in FileRun before 2026.3.0 allows delegated or simple administrators to escalate privileges to superuser and chain a path-injection primitive into server-side code execution. The flaw lives in the getValuesString() method of DB/DP.php, where submitting the description parameter as a PHP array causes raw array values to be interpolated directly into an INSERT statement; because FileRun's PDO connection runs in emulated-prepared-statement mode, stacked queries are enabled and the df_users_permissions table can be rewritten at will. A publicly available exploit published by VulnCheck documents both the privilege-escalation path and the secondary RCE vector via unsanitized path values passed to require_once in the logs listing component.

Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker to run code within the application context of the affected thin client, per Dell advisory DSA-2026-389. The root cause is a protection mechanism failure (CWE-284) that bypasses an intended security control rather than exploiting a memory-corruption bug directly. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the network-reachable, no-authentication attack profile makes it high priority.

Remote code execution in Dell ThinOS 10 (all versions prior to 2605_10.2616) allows an unauthenticated attacker who already sits on the same logical or physical network segment as the thin client to run arbitrary commands on the device. No credentials and no user interaction are required, and the vendor CVSS 3.1 vector scores it 8.8 (High) with full confidentiality, integrity and availability impact, but the adjacent (AV:A) attack vector means it is not reachable from the general internet or across routed boundaries by default. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 1.29% (69th percentile), CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and Dell has published a fix via advisory DSA-2026-389.

Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote attackers to read and write arbitrary files outside the project root when a victim developer processes a malicious template. The flaw in template_engine.go (lines 318-344 and 625-636) permits directory-traversal sequences in template destination paths, enabling attackers to overwrite shell initialization files (e.g., ~/.bashrc, ~/.profile) for persistent code execution or exfiltrate credential files from the developer's host. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the full read/write impact on a developer workstation represents significant supply-chain risk.

External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the project root by supplying an arbitrary path in the x-opencode-directory header of the /api/opencode proxy endpoint. Because the header is not validated before it becomes the agent's working directory, file operations can be redirected anywhere on the host, which VulnCheck and the vendor advisory characterize as achieving remote code execution (RCE tag). A vendor patch exists in 0.31.0; no public exploit is identified at time of analysis and this is not in CISA KEV.

Remote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holding only subscriber-level privileges - the lowest WordPress role - via a code injection flaw (CWE-94). A subscriber can send a crafted network request to trigger server-side code execution, achieving full confidentiality, integrity, and availability compromise of the WordPress host. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has disclosed the vulnerability with a dedicated advisory.

Command injection in Renovate's Maven Wrapper manager allows an attacker with write access to a scanned repository to execute arbitrary OS commands on the host running Renovate when `binarySource=docker` mode is active. Unescaped `distributionType` values from `maven-wrapper.properties` are passed directly to a shell, giving the attacker full code execution in the Renovate process context. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patch is available at version 44.14.7.

Heap-based buffer overflow in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2 allows a malicious or compromised USB or BLE peripheral to corrupt host heap memory, leading to process crash or potential arbitrary code execution on the developer's machine. The root cause is that the PC bridge protocol decoder in bridge_decoder.c unconditionally trusts the packet length field supplied by the connected peripheral, passing it directly to mqueue_add_data without validating it against the fixed 255-byte queue slot - enabling a payload of up to ~3 KB to overwrite adjacent heap metadata via memcpy. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for physical or BLE proximity and user-initiated device pairing.

Stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI C library allows a malicious or compromised sensor or bus participant to corrupt host firmware stack memory, leading to denial of service or arbitrary code execution. The flaw resides in bhi385_parse_debug_message() (bhi385_parse.c), which reads an 8-bit message length directly from the attacker-controlled FIFO event payload and passes it unchecked to memcpy targeting a fixed 17-byte stack buffer - any length byte above 16 overwrites adjacent stack data. No public exploit or CISA KEV listing has been identified at time of analysis, but the vendor has published an advisory under BOSCH-SA-223618.

Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in `bhi360_parse_debug_message()`, corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for `%n`-style exploitation. No public exploit code has been identified and exploitation is constrained to physical or bus-adjacent positions (CVSS AV:P), but the double-primitive nature makes this highly reliable on bare-metal targets lacking stack canaries.

Arbitrary code execution in Google Cloud's Gemini CLI (npm @google/gemini-cli < 0.39.1) and the run-gemini-cli GitHub Action (< 0.1.22) lets an unprivileged attacker run code on the host by planting untrusted local .env / .gemini configuration files that override GEMINI_CLI_HOME. In headless (CI) mode, previous versions auto-trusted workspace folders and processed their config/environment variables, so a malicious pull request or issue processed by an automated Gemini workflow could trigger RCE; a related --yolo tool-allowlist bypass compounds the risk. Patched by vendor; no public exploit identified at time of analysis and it is not in CISA KEV.

Cross-tenant remote code execution in Apache Camel K (2.0.0 before 2.9.3, and 2.10.1 before 2.10.2) arises from improper neutralization of directives in dynamically evaluated Maven configuration, letting a tenant supply repository content that is evaluated inside the operator pod. A tenant can thereby execute arbitrary code with the privileges of the shared Camel K operator, escaping their own tenancy. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the impact is a full operator-level compromise in multi-tenant deployments.

Code injection in Apache Camel K (2.0.0-2.9.2 and 2.10.1) lets an authorized custom-resource author smuggle arbitrary Kubernetes object definitions through YAML in CR configuration, which the operator then materializes using its own elevated service-account privileges. Because the operator typically holds broad cluster permissions, this converts limited CR-authoring rights into unauthorized creation of arbitrary Kubernetes resources - a privilege-escalation and in-cluster RCE primitive. Apache-released fixes exist; there is no public exploit identified at time of analysis and EPSS is low (0.16%).

Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation.

Stack-based buffer overflow (CWE-121) in the Nintendo Switch local wireless networking subsystem allows an adjacent unauthenticated attacker within wireless range to execute arbitrary code via a Return-Oriented Programming (ROP) chain embedded in crafted network traffic. All Nintendo Switch firmware versions prior to 23.0.0 are affected, and Nintendo has released version 23.0.0 as the remediation. No public exploit code or active exploitation has been identified at time of analysis, though SSVC rates technical impact as total.

Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch.

HTTP request smuggling via inconsistent request framing in Puma's native http11_parser (reported range Puma 5.0.0 through 8.0.3) allows a remote, unauthenticated attacker to desynchronize request boundaries between Puma and an upstream HTTP intermediary, enabling request hijacking, cache poisoning, or bypass of front-end access controls; the description's claim of arbitrary code execution is unverified and inconsistent with CWE-444. Exploitation is deployment-dependent: it requires a reverse proxy, CDN, or load balancer whose parsing of ambiguous Content-Length/Transfer-Encoding framing diverges from Puma's, which is why our independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:C rather than the published 9.1. Risk signals are weak and conflicting - EPSS is 0.17% (6th percentile), there is no CISA KEV listing and no confirmed public exploit code, and the only third-party reference is an unverified GitHub issue - so raw severity should be discounted.

Remote code execution in Flowise 3.1.2 (the FlowiseAI low-code LLM/agent builder) lets a remote attacker run arbitrary code by sending crafted input to the /api/v1/prediction/<flowId> endpoint. The CVSS vector marks it unauthenticated (PR:N), and the vendor source references to validateKey.ts suggest the endpoint's API-key check can be bypassed so untrusted callers reach code-executing flow nodes. CVSS is 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though EPSS/POC signals were not supplied.

Unauthenticated LAN access to the ESPHome Device Builder dashboard on Home Assistant add-on deployments allows any device on the local network to gain host-equivalent control with no credentials. The ingress site, which deliberately skips authentication because the HA supervisor is supposed to authenticate upstream, was bound to 0.0.0.0 instead of loopback and the supervisor gateway. Because the add-on uses host networking for mDNS, this exposed the no-auth site on the host's LAN interface, directly bypassing the supervisor's authentication layer. An attacker with LAN access can run arbitrary Python via external_components at compile time, execute arbitrary shell through compile/validation subprocesses, and read or write arbitrary files in the config and data directories. No public exploit has been identified at time of analysis.

Remote code execution in functype-mcp-server 1.4.3 and earlier allows any MCP client - including an LLM agent manipulated via prompt injection - to execute arbitrary JavaScript in the server process by invoking the `set_functype_version` tool with a `file:`, `git+`, or URL package-alias as the version string. The server interpolates the unsanitized input directly into a `pnpm add` specifier, installs the attacker-controlled package as the `functype` alias, then immediately dynamic-imports `functype/cli` from the poisoned location, running module-level attacker code with full MCP server process privileges. A fully automated Docker-based proof-of-concept confirming end-to-end RCE is documented in GHSA-wcjj-9m6g-2fr2; no public exploitation has been confirmed (not in CISA KEV), and a patched version 1.4.4 is available.

Unauthenticated remote task execution in @yeger/turbo-graph ≤ 2.8.8 allows any adjacent-network attacker to invoke arbitrary Turborepo tasks with the victim developer's OS-level privileges. Two independent implementation flaws combine: the embedded Next.js server omits the hostname argument to Node.js `.listen()`, causing the process to bind on all interfaces (`0.0.0.0`/`::`), while the `/api/run` HTTP endpoint reads task names from an attacker-controlled query string and passes them directly to `spawn()` with no authentication, CSRF protection, or allowlist check. No public exploit database entry or CISA KEV listing was identified, but a fully functional PoC with containerized end-to-end reproduction is included in the GitHub Security Advisory GHSA-2r5q-h53f-9rp3, significantly lowering the bar to exploitation.

Remote code execution in HPE Aruba ClearPass Policy Manager (CPPM) allows an authenticated attacker with high-privilege access to the web-based management interface to execute arbitrary commands on the underlying operating system. The attack is network-reachable with no user interaction required beyond obtaining administrator credentials. No public exploit has been identified at time of analysis, but full system compromise is achievable upon successful exploitation.

Heap-based memory corruption in GPAC's DVB-MPE/DSM-CC transport-stream parser lets an attacker who supplies a crafted MPEG-2 TS file trigger out-of-bounds reads and writes that can be turned into arbitrary code execution in the context of the parsing process. The flaw lives in src/media_tools/dvb_mpe.c in descriptorTime_slice_fec_identifier(), gf_m2ts_ipdatagram_reader() and the DSM-CC section/descriptor loops, and is fixed by commit 0e4093392e1f847c90d20e031e893cd942fef938. No public exploit code or in-the-wild exploitation is known, EPSS is a low 0.16% (5th percentile), and the vendor-supplied CVSS of 8.4 assumes local access with no privileges or user interaction.

Integer overflow leading to heap buffer overflow in GPAC's JPEG 2000 decoder filter allows arbitrary code execution when a user opens a crafted media file. The vulnerable computation in j2kdec_process() multiplies width, height, and component count without overflow checking, producing a truncated out_size that causes an undersized buffer allocation followed by an out-of-bounds write. SSVC exploitation status is 'poc' (proof-of-concept exists), though EPSS is low at 0.18%, indicating no widespread in-the-wild exploitation at time of analysis.

A stack buffer overflow in GPAC's NHNT demuxer (nhntdmx_process() in src/filters/dmx_nhnt.c) allows an attacker to execute arbitrary code when the affected build processes a crafted NHNT media file, because an unbounded strcpy/strcat writes a file-supplied media string into a fixed-size stack buffer. The flaw is rated 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects GPAC at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3; it is fixed upstream in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6, which replaces the unsafe calls with gf_strlcpy/gf_strlcat. Exploitation likelihood appears limited: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.

Stored cross-site scripting in SkillTree (NSA skills-service) before 4.4.2 lets an unauthenticated attacker self-register with a malicious firstName/lastName/nickname that executes in an administrator's browser when they open the Quiz Runs page. Because registration fields are stored unsanitized and later rendered through Vue's v-html directive, the flaw escalates from simple alert() proof to remote script loading via import() and full XSRF-token theft, enabling any admin action (delete projects, create backdoor accounts, exfiltrate user data). Publicly detailed in the GitHub Security Advisory; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.

Remote code execution is possible in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior via an argument injection flaw (CWE-88) in backup configuration parameter handling. An attacker holding a privileged account can supply crafted arguments that are passed unsanitized to an underlying backup command, resulting in arbitrary OS-level code execution on the server. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable attack vector and full CIA impact make this a meaningful risk for any organization operating this data center infrastructure management platform.

Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.

Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.

Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.

Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem, and to create arbitrary directories via os.MkdirAll. The Document API's sanitization function cleanDocPath() strips slashes and .md suffixes but leaves ../ sequences intact, allowing filepath.Join() to resolve paths outside the intended documents directory. In the default deployment - where the Management API binds to all interfaces without authentication - this is directly exploitable with a single crafted HTTP request, and the arbitrary-write primitive may be chained toward code execution. No confirmed active exploitation or public exploit code identified at time of analysis.

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during VPN negotiation, letting a remote unauthenticated attacker run arbitrary code on the gateway itself. The CWE-295 root cause means the gateway accepts or mishandles an untrusted/forged certificate in the IKE/SSL-VPN handshake, and processing that malicious certificate leads to code execution rather than merely a trust bypass. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Arbitrary code execution in GitPython before 3.1.60 is possible when a victim application calls index.commit() on an attacker-controlled repository. The root cause is insufficient validation of the git directory location: GitPython trusts tracked files such as gitdir, commondir, and HEAD to resolve the effective git directory, allowing a crafted repository to redirect that resolution to an attacker-controlled path containing a malicious pre-commit hook. No public exploit has been identified at time of analysis, but the attack is realistic in any Python-based DevOps pipeline, CI/CD system, or tooling that opens and commits to externally sourced repositories.

Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Policy Manager console host. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request slip past authentication and reach an endpoint that evaluates attacker-supplied script without sandboxing. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the no-auth/no-interaction profile makes this a top-priority patch.

Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.

Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR Sep-2026 Release 1 enables local privileged attackers to execute arbitrary code within the Trusted Execution Environment. The CVSS 4.0 score of 7.1 with AV:L/AC:H/PR:H reflects a high technical bar: exploitation demands pre-existing high-privilege local access plus significant exploit engineering to achieve reliable heap corruption. Samsung confirmed the fix in the September 2026 Monthly Security Release; no public exploit or active exploitation has been identified.

Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges and execute arbitrary code at root level on affected Samsung Mobile Devices. DualDAR (Dual Data At Rest) is a Samsung Knox encryption subsystem implemented as a kernel-space driver across Android 14 through 17; a flaw in its input handling allows a caller with existing elevated privileges to corrupt driver state and reach kernel execution context. The patch ships in SMR Sep-2026 Release 1. No public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).

Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.

Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).

Arbitrary code execution at firmware privilege level is possible in InsydeH2O UEFI firmware code developed specifically for HP-branded systems, exploitable by a local attacker with high OS-level privileges. The root cause is an unvalidated memory boundary (CWE-20), consistent with an SMM (System Management Mode) handler that fails to verify caller-supplied buffer boundaries, allowing memory corruption that escapes the OS privilege boundary into firmware-controlled memory. The scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms the impact extends beyond the calling OS context, characteristic of SMRAM-targeting vulnerabilities. No public exploit code or CISA KEV listing has been identified at time of analysis.

Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.

Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.

Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.

Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.

OS command injection in Tanium Enforce enables a local attacker to execute arbitrary operating system commands at the privilege level of the Enforce agent process. The flaw (CWE-78) requires user interaction and specific exploitation preconditions, reflected in a CVSS 7.0 score despite full C:H/I:H/A:H impact ratings. Tanium self-disclosed the issue via advisory TAN-2026-022; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Heap-based buffer overflow in Google Chrome's WebRTC component (all versions prior to 153.0.8010.36) enables a remote unauthenticated attacker to potentially execute arbitrary code within the Chrome renderer sandbox by luring a target to a crafted HTML page. The vulnerability is classified CWE-122 and carries a CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); however, Chromium's own internal severity rating is 'Low,' which is notably discordant and implies that exploitation is constrained to within-sandbox code execution rather than full OS compromise. No public exploit code and no CISA KEV listing have been identified at the time of analysis.

Race-condition-triggered code execution in Google Chrome's V8 JavaScript engine (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to execute arbitrary code inside the Chrome renderer sandbox by serving a crafted HTML page to a victim. Exploitation is constrained to the Chrome sandbox process rather than the underlying OS, which aligns with Chromium's own internal severity rating of 'Low' despite the CVSS base score of 7.5. No public exploit code or CISA KEV listing is present at time of analysis; the high attack complexity metric reflects the timing-sensitive nature of race-condition exploitation.

Memory corruption in V8, Chrome's JavaScript engine, allows an attacker who can get a user to install a crafted Chrome extension to execute arbitrary code confined within the Chrome sandbox, affecting all Chrome versions prior to 153.0.8010.36. Despite the CVSS 8.8 base score, Chromium's own security team rates this 'Low' severity, reflecting that exploitation is bounded by Chrome's sandbox and does not constitute a full OS-level compromise without a separate sandbox escape primitive. No public exploit code or active exploitation has been identified at time of analysis. Vendor-released patch is available.

Sandbox escape via incorrect authorization in the Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the browser's sandbox using a crafted local program. Affected versions are all Google Chrome releases prior to 153.0.8010.36 on Windows. The Chromium team rates internal severity as 'Low' - notably lower than the CVSS 8.1 score - suggesting that while the impact is high if exploited, real-world attack complexity limits practical risk. No public exploit or active exploitation has been identified at time of analysis.