Remote Code Execution

Use-After-Free in Autodesk Revit's PDF parser allows arbitrary code execution, sensitive data disclosure, or application crash when a user opens a maliciously crafted PDF file. Affected versions span Revit 2026 (prior to 2026.5.0) and Revit 2027 (prior to 2027.2.0), with full high-impact potential across confidentiality, integrity, and availability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via advisory ADSK-SA-2026-0011.

Use-after-free in Skia, Chrome's 2D graphics rendering engine, enables arbitrary code execution within the renderer sandbox in Google Chrome versions prior to 151.0.7922.109. Exploitation requires an attacker to have already achieved renderer process compromise, making this a second-stage chained payload rather than a standalone initial access vector - a prerequisite that materially constrains real-world exploit delivery. No public exploit code has been identified at time of analysis, and SSVC confirms Exploitation: none and Automatable: no, though C/I/A impacts are rated High within the sandboxed scope.

Remote code execution within the Chrome sandbox via an integer overflow in the V8 JavaScript engine affects Google Chrome prior to version 151.0.7922.109. An unauthenticated remote attacker can trigger the flaw by enticing a user to visit a specially crafted HTML page, resulting in full compromise of confidentiality, integrity, and availability within the renderer process. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, though the total technical impact and low attack complexity elevate real-world priority for patching.

Remote code execution within the V8 JavaScript engine affects Google Chrome prior to 151.0.7922.109, allowing a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in V8 (CWE-693, Protection Mechanism Failure), carrying a CVSS 8.8 rating with high confidentiality, integrity, and availability impact. No public exploit code has been identified and CISA SSVC confirms no active exploitation at time of analysis, though the technical impact is rated total by SSVC, underscoring the severity if exploited.

Use-after-free in the Chrome Extensions subsystem allows sandboxed arbitrary code execution in Google Chrome prior to 151.0.7922.109, requiring a victim to install a crafted malicious extension. The UAF (CWE-416) memory corruption condition is exploitable remotely but demands high attack complexity and active user interaction, resulting in code execution confined within Chrome's sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a fix in the stable channel update of 01 August 2026.

Remote code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.109 through an out-of-bounds write flaw in the V8 JavaScript engine, triggerable by a crafted HTML page. An unauthenticated remote attacker needs only to lure a victim to a malicious page, achieving code execution confined to the sandboxed renderer process. No public exploit or active exploitation has been identified at time of analysis; however, the CVSS 8.8 score and SSVC total technical impact classification indicate significant potential consequences if exploitation is developed.

Remote code execution within the Chrome sandbox is possible in Google Chrome versions prior to 151.0.7922.109 due to a use-after-free vulnerability in the V8 JavaScript engine, triggerable by a remote attacker through a specially crafted HTML page. The attacker achieves arbitrary code execution confined to the Chrome renderer sandbox, requiring no privileges but necessitating user interaction to visit a malicious page. Google has released a fix in version 151.0.7922.109; SSVC assessment confirms no known active exploitation at time of analysis, and no public exploit code has been identified.

Remote code execution within Chrome's sandboxed renderer process is achievable in Google Chrome prior to 151.0.7922.109 through a crafted HTML page exploiting an inappropriate implementation in the V8 JavaScript engine. An unauthenticated remote attacker needs only to lure a victim to a malicious page - no credentials or special privileges are required on the attacker's side. Google has rated this High severity (Chromium classification); no public exploit has been identified at time of analysis, and CISA SSVC reports exploitation status as none, though technical impact is rated total within the sandbox boundary.

Use-after-free in Google Chrome's Translate component (versions prior to 151.0.7922.109) enables remote attackers to execute arbitrary code within the browser's renderer sandbox by directing a user to a crafted HTML page. The CVSS 8.8 score reflects network-accessible, low-complexity exploitation gated only by a single user interaction - visiting an attacker-controlled page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE primitive within one of the world's most widely deployed browsers represents a materially significant attack surface.

Local privilege escalation in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows any local user to execute arbitrary code with root privileges. The flaw stems from improper authorization (CWE-285) in the security agent's privileged components, so a low-privileged or unprivileged local account can fully compromise the host. No public exploit identified at time of analysis, but the CVSS 9.3 rating and scope change to root make this a high-priority patch for macOS fleets.

Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injection payloads that execute arbitrary commands as root, giving full host compromise. Publicly available exploit code exists (Stuub's SSTI-to-Root-RCE PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.28% (20th percentile), indicating no evidence of widespread automated exploitation yet. The combination of a working PoC and root-level impact makes this a high-priority patch target for any internet-exposed WGDashboard instance.

Remote code execution in WGDashboard (a self-hosted WireGuard management web UI) versions up to 4.3.2 lets attackers inject OS commands that execute as root through multiple unsanitized input paths (CWE-78). Publicly available exploit code exists (Stuub PoC targeting v4.3.2), and CISA's SSVC framework rates the technical impact as total and the flaw as automatable, though it is not listed in CISA KEV. Note a data conflict: the CVSS vector marks this as unauthenticated (PR:N) while the description states exploitation requires an authenticated attacker.

Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.

Out-of-bounds read in Autodesk Revit's PDF parsing engine exposes users to crashes, sensitive memory disclosure, and arbitrary code execution within the Revit process when opening a maliciously crafted PDF file. Affected are users of Autodesk Revit across versions covered by advisory ADSK-SA-2026-0011, with the attack requiring only that a target be socially engineered into opening a weaponized PDF - a realistic threat vector for AEC-industry professionals who routinely exchange PDF documents. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the high C/I/A impact profile makes this a meaningful risk for targeted attacks against Revit users.

Arbitrary file write via Zip-Slip in Nx's self-hosted HTTP remote cache extractor allows a malicious or MITM-positioned cache server to overwrite files anywhere on the developer's machine, escalating to remote code execution. Affected are Nx workspaces using self-hosted remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, @nx/shared-fs-cache) running nx >= 20.8.0 and < 22.7.7; Nx Cloud and the default local cache are confirmed unaffected. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the CVSS 4.0 score of 8.7 and trivial exploitability once positioned reflect significant real-world risk for teams using self-hosted caching.

Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b7445, where new_1batch() allocates memory with malloc() but free_1batch() releases it using the C++ delete operator, triggering undefined behavior and heap metadata corruption. This mismatch guarantees denial of service via process crash and, depending on allocator state, may enable arbitrary code execution within the affected Android application process. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV; a vendor-released patch exists as build b7446.

JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over GraphQL-over-WebSocket connections, bypassing @authentication and @subscriptionsAuthorization directive controls. Affected library versions prior to 7.5.6 (v7 branch) and 5.12.14 (v5 branch) accept client-supplied, pre-decoded JWT objects in subscription connectionParams without any cryptographic verification, meaning the library treats attacker-controlled identity claims as authenticated. No public exploit or KEV listing has been identified at time of analysis, but the exploitation barrier is low given the network-accessible vector and absence of authentication requirements.

Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 allows a user holding the Shop Manager role to inject and execute arbitrary code (CWE-94) on the underlying server. The CVSS 3.1 score of 9.1 reflects a scope change where WooCommerce-level access translates into full host compromise. No public exploit identified at time of analysis, and no EPSS or KEV data was provided.

Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.

Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.

Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.

Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch.

Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination to achieve denial of service or, where a compatible deserialization gadget chain is present on the application classpath, remote code execution within the CXF process. All Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 are affected when the JMS transport is in use. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability class (CWE-502 with unrestricted ObjectInputStream) is well-understood and tooling such as ysoserial makes it routinely exploitable wherever gadget libraries are present.

Authentication bypass in WPMU DEV Dashboard (WordPress plugin) versions up to and including 5.0.0 enables unauthenticated remote attackers to invoke privileged Hub actions - including remote code execution by installing a plugin from an attacker-controlled URL, takeover of an administrator account via SSO, deletion of plugins and themes, and forced WordPress core upgrades - on any site not yet connected to the WPMU DEV Hub. The default post-installation state is unconnected, meaning every fresh installation is immediately exposed until Hub onboarding is completed. No public exploit or CISA KEV listing has been identified at time of analysis, though the impact ceiling (unauthenticated RCE) and the breadth of default-state exposure make this a high-priority remediation target.

Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.

Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.

Server-side remote code execution in Nuxt's server island feature (nuxt >=3.4.0 <3.21.10 and >=4.0.0 <4.5.1) allows unauthenticated network attackers to execute arbitrary code in the Nitro server process by injecting a `template` key into island props delivered to the `/__nuxt_island/` endpoint. Exploitation requires two simultaneous preconditions: `vue.runtimeCompiler: true` must be explicitly enabled (it is off by default), and the application must expose a server island whose rendered output routes attacker-controlled prop values into Vue's dynamic component resolution - a condition that can arise implicitly via Vue's attribute-fallthrough mechanism when the island's root is a polymorphic component such as @nuxt/ui's UButton. No public exploit code or CISA KEV listing has been identified at time of analysis, and the non-default configuration requirement substantially limits the real-world attack surface.

Unauthenticated remote code execution in Nuxt DevTools (@nuxt/devtools before 3.3.1) lets any client reaching the Vite HMR WebSocket invoke RPC methods that were never gated by the ensureDevAuthToken check. By chaining updateOptions() to poison the persisted behavior.openInEditor value and then calling openInEditor(), an attacker runs an arbitrary program on the developer's machine via the launch-editor package. Only development environments are affected; production builds do not run DevTools. This is rated CVSS 9.6 (scope-changed), and no public exploit has been identified at time of analysis.

Newline injection in boringproxy 0.10.0 and earlier allows authenticated low-privileged users with tunnel-creation permission to write arbitrary entries into the server's SSH authorized_keys file, achieving persistent shell access to the host. By supplying a percent-encoded newline (%0a) in the domain parameter of the tunnel creation API endpoint, an attacker inserts an unrestricted public key, then SSHs directly into the server and reads plaintext credentials - including all user tokens, tunnel private keys, and TLS certificates - from the application's database file. A public proof-of-concept exploit is available via GitHub, and no patched release has been identified at time of analysis.

Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe directory to execute arbitrary code as the PraisonAI process user. Affected are praisonai 3.9.26-4.6.57 and praisonaiagents 0.12.12-1.6.57. This is a hardening bypass: the vulnerable sink in Workflow._execute_include() skips the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates and the centralized safe loader that protect all other tools.py autoload paths, making it a distinct variant within an established advisory family. No public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to SYSTEM-level and execute arbitrary code, as confirmed by the NI vendor advisory. Affected deployments include NI-PAL versions 26.3.1 and all prior releases running exclusively on Microsoft Windows. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, but the low access complexity (AC:L, AT:N in CVSS 4.0) means exploitation requires no special conditions beyond a local user session.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated attacker due to improper validation of module imports, classified under CWE-94 (Code Injection). The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with no user interaction required beyond low-privilege authentication. No public exploit code has been identified at time of analysis, EPSS sits at 0.34% (27th percentile), and SSVC designates exploitation as 'none' currently - though the SSVC technical impact is rated 'total', confirming the severity of successful exploitation.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by remote attackers holding low-privilege credentials via server-side code injection (CWE-94). The CVSS score of 8.8 reflects full confidentiality, integrity, and availability impact with a low-complexity network attack path requiring only valid user authentication. No public exploitation has been confirmed - EPSS places the exploitation probability at 0.36% (29th percentile) and SSVC rates exploitation status as none and the attack as non-automatable, though SSVC's technical impact rating is total, consistent with arbitrary code execution.

Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated remote attackers to inject and execute arbitrary Python code by crafting payloads that evade the platform's AST-based security scanning mechanism. The flaw (CWE-94, Code Injection) is particularly insidious because the defensive AST validation layer gives a false sense of protection while silently passing malicious constructs to the Python runtime. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity, fully network-accessible attack path with complete confidentiality, integrity, and availability impact warrants urgent patching - especially for any internet-exposed or multi-tenant deployments.

Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege users to trigger arbitrary Python execution on the backend server by submitting crafted Agentic Assistant workflows containing malicious LLM-generated components that are evaluated server-side during validation before user approval is granted. The flaw (CWE-94, Code Injection) arises because the validation pipeline eagerly executes model-generated Python without sandboxing or deferral, giving attackers backend process-level privileges to exfiltrate data, interact with the file system, or initiate outbound network connections. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability at 0.22% (13th percentile), but SSVC rates technical impact as total, making this a high-priority patch target for multi-user or internet-exposed deployments.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows any internet-reachable attacker to execute arbitrary server-side code using only two HTTP requests. The vulnerability is rooted in CWE-94 (Code Injection), enabling full server compromise with no user interaction. A vendor patch is available via IBM advisory, and no public exploit has been identified at time of analysis - however the trivially low attack complexity makes any internet-exposed instance an immediate remediation priority.

Remote code execution in IBM Langflow OSS (versions 1.0.0 through 1.10.3) allows authenticated attackers to execute arbitrary Python code by exploiting a cryptographic weakness (CWE-326) in the custom component validation mechanism. When the optional hardening mode is enabled - the feature intended to restrict execution to trusted component templates - the application validates submitted component code against a truncated SHA-256 digest, making it computationally feasible for an attacker to craft a malicious Python file that collides with a trusted template's hash and bypasses the validation gate entirely. No public exploit code has been identified at time of analysis; a vendor patch is available per IBM advisory, though the exact fixed version is not stated in available data.

Remote code injection in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated remote attacker to execute arbitrary code on the underlying server by supplying malicious input through user-controlled code fields within the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms the attack is network-reachable at low complexity, requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact on the host. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated remote attackers to run arbitrary commands by supplying crafted configuration parameters that bypass the application's incomplete input denylist (CWE-184). The flaw carries a CVSS 8.8 score with full confidentiality, integrity, and availability impact, and SSVC rates the technical impact as total. No active exploitation is confirmed - EPSS sits at 0.42% (35th percentile) and the vulnerability is absent from CISA KEV - though the low attack complexity makes it a genuine priority for any internet-exposed Langflow deployment with untrusted authenticated users.

Remote code execution via CSRF in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows a network attacker to execute arbitrary code within the Jenkins controller JVM by inducing a low-privileged authenticated user to trigger a forged request. The Jenkins security advisory published 2026-08-05 formally discloses this as SECURITY-3823(2), with EUVD-2026-53526 corroborating the affected version range. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network reachability and low attack complexity make this a meaningful risk wherever Jenkins is accessible and users browse untrusted sites within the same browser session.

Unsandboxed Groovy script execution in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows any attacker holding Item/Create or Item/Configure permission to run arbitrary code directly on the Jenkins controller JVM. The plugin exposes Groovy scripting capabilities that intentionally bypass the Script Security Plugin - the standard Jenkins mechanism for confining script execution to a restricted sandbox - meaning scripts execute with the full privileges of the Jenkins service account. The fix is available in Multijob Plugin 677.v7ffc23d6a_4c2; no public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim to execute arbitrary commands with the victim's full OS privileges. The mechanism is git's core.fsmonitor hook: Mistral Vibe calls git status --porcelain without suppressing hook execution, so a malicious fsmonitor entry embedded in a repository's .git/config is executed whenever any vibe command runs inside that repository. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack pattern is straightforward and the fix is confirmed at v2.23.3.

Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.

Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.

Unsafe pickle deserialization in Hugging Face PEFT's LoRA-GA and CorDA initialization modules allows arbitrary code execution when a victim loads a malicious cache or covariance file. The affected code paths in corda.py (lines ~102 and ~163) and loraga.py (line ~101) call torch.load() without weights_only=True, bypassing the safe-loading wrapper that PEFT enforces elsewhere in the codebase. An attacker who can supply or substitute a pre-computed LoRA-GA or CorDA cache file - for example via a shared model repository or poisoned download - achieves full code execution in the victim's ML environment upon initialization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Remote code execution and arbitrary file deletion in Zigbee2MQTT stem from an unsanitized path.join() call in ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts), allowing any MQTT client with publish access to escape the extensions directory via traversal sequences and write arbitrary files to the host filesystem. Once the malicious .js file is written, Zigbee2MQTT immediately imports it via Node.js import(), executing attacker-controlled code in the application process context. The same vulnerable code path also backs the extension-removal handler, yielding a second primitive for arbitrary file deletion. No public exploit or KEV listing was identified at time of analysis, but the exploitation path is mechanically straightforward given the detailed description.

Unauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in the server process by creating a malicious "calc rule". The POST /calc-rule/create endpoint omits the AuthToken guard applied to other routes, and the supplied script field is later passed unsandboxed to quick_js::Context::eval(), giving full script execution once triggered. CVSS is 9.8; no public exploit identified at time of analysis, though the flaw is trivially reachable and the root cause is confirmed by source-level reference.

Arbitrary file write leading to remote code execution in OpenPLC Runtime v3 lets a low-privileged web user upload a crafted Structured Text (.st) program whose embedded `(*FILE:path content*)` directive escapes the intended ./core directory via path traversal. Because the compile_program() sink never calls the project's own validate_file_path() guard, an attacker can plant files such as a cron job or SSH authorized_keys to gain code execution as the runtime user. Exploitation is further eased by OpenPLC's shipped default credentials (openplc:openplc); no public exploit identified at time of analysis and the issue is not in CISA KEV.

Missing authentication in IoTSharp's BlobStorageController lets unauthenticated remote attackers reach Upload, Download, List, Modify, and Delete blob endpoints that every other controller (Devices, Customers, Tenants) guards with [Authorize]. Because the path and filename parameters are written to disk without sanitization, attackers can traverse outside the blob directory to read, alter, or delete arbitrary files - and drop a webshell into a web-accessible path for remote code execution. No public exploit identified at time of analysis, but the combination of unauthenticated access and a clear RCE path makes this trivially weaponizable.

Remote code execution in ESPHome through 2026.7.0-dev allows any attacker who can supply a crafted YAML configuration to execute arbitrary Python code on the machine that processes it. The vulnerability is an operator-precedence bug in the cv.url() validator: Python's 'and' binding tighter than 'or' causes any file:// URI to unconditionally pass validation, bypassing the intended network-URI-only restriction on the external_components git source URL field. ESPHome then invokes git clone against the attacker-supplied local path and loads the resulting repository into Python's import machinery, yielding full code execution with the privileges of the esphome process; no public exploit has been identified at time of analysis.

Out-of-bounds heap/stack write in nanoMODBUS through v1.23.0 lets an unauthenticated network client corrupt memory in the Modbus server via a single crafted Read File Record (FC 0x14) request. The server-side handle_read_file_record() function validates per-request and per-sub-request sizes but never checks the cumulative response size, and a uint8_t accumulator (response_data_size) silently overflows, allowing swap_regs() to write up to ~8490 bytes past the 260-byte receive buffer. There is no public exploit identified at time of analysis, but the flaw yields reliable denial of service and, on embedded/bare-metal targets lacking memory protection, potential remote code execution.

WP-DownloadManager WordPress plugin (all versions prior to 1.69) grants any WordPress administrator holding the manage_downloads capability the ability to achieve full remote code execution by uploading arbitrary PHP files through the unvalidated download-add.php handler. The upload path is additionally constructed from a raw, unsanitized POST parameter, enabling directory traversal into web-accessible locations under WP_CONTENT_DIR where uploaded PHP files execute on direct request. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the complete absence of server-side file-type controls and path sanitization makes exploitation trivially simple for any attacker who has obtained admin credentials.

Arbitrary server-side code execution in Magistrala's Rules Engine exposes any authenticated low-privileged user to full file system access, environment variable exfiltration, database manipulation, and SSRF against internal microservices. The platform's two script runtimes - Go via Yaegi and Lua - both fail to sandbox dangerous capabilities: the Go engine exposes the complete standard library behind a trivially insufficient regex filter, while the Lua engine performs no validation whatsoever and explicitly preloads file I/O, HTTP client, and database libraries. No public exploit code has been identified at time of analysis, but the attack requires only a valid account and the ability to create rules, making exploitation straightforward for any tenant or internal user.

Remote code execution in MacCMS10's admin template editor enables authenticated administrators to execute arbitrary OS commands by exploiting an incomplete PHP function blacklist in conjunction with ThinkPHP's native `{if}` template tag. The `Template.php` controller filtered dangerous functions via regex but omitted `exec`, `passthru`, `popen`, `create_function`, `register_shutdown_function`, `register_tick_function`, `show_source`, and `error_log`, allowing payloads such as `{if condition="exec('id > /tmp/pwned.txt')"}{/if}` to pass validation and execute at render time. No public exploit repository has been independently cited and this CVE is not listed in the CISA KEV catalog; an upstream fix was committed on 2026-06-22.

Backdoored firmware in Zbtlink routers ships ENDLESSDOORS, an embedded implant (librctl.so, based on the open-source ycsunjane/rctl tool) present in every published build across the product line, granting unauthenticated remote root code execution. Started at boot as root and masquerading as a kernel [kworker/*] thread, it beacons every ~35 seconds over cleartext, unauthenticated TCP to a hardcoded command-and-control server, passing any received command to popen() as uid=0 and offering an interactive root shell via a reserved 'rctlbash' command. Because the channel has no authentication or encryption, control is not restricted to whoever planted it - anyone who answers at the C2 address, hijacks the network path (DNS/route), or registers the hardcoded fallback domain obtains root; no public exploit is identified in the input and there is no CISA KEV listing, though the underlying rctl tooling is publicly available open-source code.

Unauthenticated arbitrary file write in Eclipse Theia 1.73.1 and earlier (browser-mode deployments) allows any cross-origin web page to overwrite files at any absolute path the backend process can access, with a realistic escalation to remote code execution. The `POST /file-upload` handler in `@theia/filesystem` accepts attacker-controlled absolute paths with no workspace boundary check, while a distinct HTTP middleware flaw in `@theia/core` lets the connection token check pass without rejection for tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, browsers send the exploit request cross-origin with no preflight and no credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing appears in the provided data, but the attack mechanism is straightforward and requires only that a victim visit an attacker-controlled page.

Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.

Remote code execution in Pluck CMS through 4.7.21 is achievable by any authenticated administrator who exploits a gap in the file upload blacklist: the extension '.php8' is absent from the hardcoded deny-list in data/inc/files.php, allowing a crafted file to be stored and subsequently executed as PHP on servers running PHP 8.x. Reported by TuranSec, this CWE-434 flaw carries a CVSS 7.2 (PR:H), meaning exploitation is constrained to admin-level accounts but delivers full confidentiality, integrity, and availability impact once triggered. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the bypass is trivially reproducible from the CVE description by any administrator with upload access.

OS command injection in the Backup Migration WordPress plugin (all versions through 2.1.5.1) allows authenticated attackers holding Administrator-level access - or any user granted the plugin's custom `do_backups` capability - to execute arbitrary operating-system commands as the web-server user. The flaw stems from misuse of `esc_attr()`, an HTML sanitizer, as a shell sanitizer in the `restoreBackup()` AJAX handler, enabling shell metacharacter injection into an `exec()` call. This represents an incomplete remediation of CVE-2023-7002; the equivalent fix applied to `handleQuickMigration()` was never ported to the `$backupName` variable path. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Arbitrary file upload in LightSync Pro WordPress plugin (all versions through 2.1.6) enables authenticated attackers with Author-level access to upload executable files - including PHP webshells - via the unvalidated `rest_replace_media()` REST API function, with remote code execution as a realistic outcome. The root cause is CWE-434: missing file type validation on the server side, allowing any file extension to be accepted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 reflects the high post-exploitation impact given the minimal privilege bar (Author role).

Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.

Privilege escalation to SYSTEM in NetKids iMark (all versions through V5.2.5.0) is achievable by authenticated local attackers exploiting an unquoted Windows service executable path. Because the service path contains spaces but lacks surrounding quotation marks, Windows' path resolution logic will execute an attacker-placed binary at an intermediate path before reaching the legitimate service binary. JPCERT/CC has issued an advisory (JVN#28045338) and the vendor has published remediation PDF guidance; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Remote code execution and denial of service in OpenSIPS SIP server (versions 4.0.0 and prior) arises from a stack buffer overflow in the sip_to_json() function, where an attacker-controlled SIP header name longer than 255 bytes is memcpy'd into a fixed 255-byte stack buffer. Because both the length and content of the overwrite are attacker-controlled, a single unauthenticated UDP packet to SIP port 5060 can crash the process or, on builds lacking stack protections, hijack the saved return address for RCE. No public exploit identified at time of analysis; the issue was not fixed at publication, making this an unpatched flaw affecting any deployment whose routing script invokes sip_to_json().

Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.

Uncontrolled search path execution in Amazon Kiro CLI on Windows allows arbitrary code execution when a local user opens the CLI within a maliciously crafted project directory. Affected versions are all Kiro CLI releases before 2.10.0 on Windows; the flaw bypasses workspace trust protections by placing a malicious executable in a directory that Kiro CLI resolves via an uncontrolled search path. No public exploit code has been identified at time of analysis, though exploitation requires only user interaction - not attacker presence on the system - making social engineering a viable delivery mechanism.

Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.

Remote code execution via uncontrolled search path (CWE-427) in Amazon Kiro IDE before 1.0.228 on Windows allows an unauthenticated remote actor to execute arbitrary code on a victim's machine by supplying a maliciously crafted project directory containing a strategically placed executable. Exploitation requires the local user to open the attacker-controlled directory, at which point Kiro IDE resolves an uncontrolled search path and executes the malicious binary, bypassing workspace trust protections intended to prevent exactly this class of attack. No public exploit has been identified at time of analysis, and a vendor-released patch is available at version 1.0.228.

Remote code execution in Flowise (npm flowise / flowise-components <= 3.1.2) lets an unauthenticated attacker who can query a chatflow built on the CSV Agent node coerce the backing LLM, via prompt injection, into returning a Python payload that slips past the regex blocklist validator and runs in an unsandboxed pyodide runtime, yielding arbitrary code execution as the Flowise service account. Trend Micro ZDI (Dre Cura, TrendAI Research) demonstrated eight distinct validator-bypass techniques and shipped a working proof of concept; this is scored CVSS 4.0 9.5 (CWE-94). Publicly available exploit code exists, but there is no CISA KEV listing or evidence of active exploitation at time of analysis.

Remote code execution in Keysight IxChariot Endpoint and related Keysight network-test products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single specially crafted packet. The flaw is a classic stack-based buffer overflow reachable over the network with no user interaction (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the trivial attack complexity and lack of any authentication make it a high-priority patch for any environment running these test tools.

Unauthorized workspace variable disclosure in Flowise (<= 3.1.2) allows any authenticated user or API key - even one explicitly denied the `variables:view` RBAC permission - to exfiltrate all workspace secrets by calling `/api/v1/node-custom-function`. The `$vars` object, populated with static variable values and runtime secrets resolved from `process.env`, is unconditionally injected into every custom JavaScript execution sandbox (utils.ts:1782), while the official `/api/v1/variables` endpoint correctly enforces the permission gate - creating a direct privilege boundary bypass. Depending on workspace configuration, exposed data can include database passwords, JWT signing secrets, SMTP credentials, and cloud provider API keys. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilities in NVIDIA Dynamo for Linux examples and recipes, affecting all versions through v1.1.0. The root cause is CWE-1357 (Relies on Insufficiently Trustworthy Component), meaning the examples or recipes bundle or reference a dependency or component without adequate integrity or trust verification, enabling an attacker to exploit that trust boundary over a network. No public exploit code exists and no active exploitation has been confirmed; EPSS places probability at 0.36% (29th percentile) and SSVC confirms exploitation status as none with a non-automatable attack path, suggesting low near-term weaponization risk despite the high CVSS base score.

Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.

Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.

Server-side file-write and server-side request forgery (SSRF) in Django's GeoDjango spatial lookups expose authenticated staff users as an attack surface capable of writing arbitrary files to disk or issuing outbound network requests as the Django process user. Affected are Django 5.2 (before 5.2.17) and 6.0 (before 6.0.8), where the Django admin changelist's standard filter mechanism made the flaw reachable by any staff account holding view permissions on a model with a spatial field. Depending on the GDAL raster driver available on the server, file writes can escalate to remote code execution. No public exploit is identified at time of analysis; patched releases Django 5.2.17 and 6.0.8 were issued August 4, 2026.

Remote code execution in FlowiseAI Flowise 3.1.2 lets an authenticated user abuse the 'SQLite Record Manager' node's `additionalConfig` input to override the target database path and write an attacker-shaped SQLite file to any location on disk. Because the official Docker image runs as root, the file can be planted at /etc/chromium/exploit.conf, and a second Upsert operation that launches Puppeteer/Chromium sources that .conf file and executes an embedded reverse-shell payload, yielding full application compromise as root. No public exploit is identified at time of analysis beyond the detailed reproduction steps in the elttam advisory; the issue is patched in 3.1.3.

Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.

Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.

Remote code execution in Flowise (flowise and flowise-components <= 3.1.2) is possible through the CSVAgent node, which executes user-supplied Python in a pyodide runtime. A regex denylist blocks imports and dangerous builtins, but attackers bypass it entirely by calling the pre-imported pandas library's read_pickle() to deserialize an attacker-controlled base64 pickle, achieving arbitrary command execution. A detailed working proof-of-concept (pickle __reduce__ gadget plus a custom file-like reader class to feed the payload) is published in the vendor GHSA advisory; publicly available exploit code exists, but there is no public exploit identified as being used in the wild and it is not in CISA KEV.

Remote code execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions 3.1.2 and earlier lets an authenticated user achieve root command execution on the host by injecting Python into the CSV Agent's Pyodide sandbox, which bridges back to the host Node.js process. Attackers reach OS command execution, credential theft, arbitrary file read, and server crash. A working Metasploit module and root Meterpreter session are documented, so publicly available exploit code exists, though the flaw is not listed in CISA KEV.

Remote code execution as root in Flowise (npm packages flowise and flowise-components, versions 3.0.5 through 3.1.2) lets any authenticated user with a valid API key escape the NodeVM sandbox used by the custom-function feature and run arbitrary OS commands. The flaw stems from executeJavaScriptCode() merging caller-supplied nodeVMOptions over its secure defaults with a JavaScript spread, so an attacker can re-enable blocked builtins (child_process, fs) via require.builtin:["*"]. A detailed working exploit is published in the vendor's GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing, meaning no confirmed active exploitation at time of analysis.

Remote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privileged authenticated attackers to inject arbitrary Groovy code into message template script fields processed by the GlueFactory component, resulting in OS command execution on the backend server with the privileges of the Java process. The GlueFactory compiled and ran these scripts via GroovyClassLoader with no sandboxing, AST restrictions, or class whitelisting in place. A publicly available exploit exists via GitHub issue #408, and CVSS 4.0 rates this 8.7 with full confidentiality, integrity, and availability impact on the vulnerable system.

Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary commands via the check_connection endpoint, which insecurely deserializes attacker-supplied YAML/JSON. By setting the __type__ field to subprocess.check_output with chosen arguments, an attacker instantiates arbitrary Python objects and executes OS commands with the application's process privileges. Publicly available exploit code exists (VulnCheck advisory and upstream issue), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as actively exploited.

Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.

Authenticated remote code execution in FlowiseAI Flowise 3.1.2 and earlier lets any logged-in user escape the vm2 sandbox and run arbitrary OS commands on the host. The MySQL/Postgres/SQLite Record Manager and MySQL/Agent Memory nodes expose an unfiltered additionalConfig input passed directly into the TypeORM DataSource constructor, whose entities/subscribers/migrations options can load attacker-supplied JavaScript files. A full public reproduction (including a root reverse-shell payload) was published in the elttam advisory, and the vendor fixed it in 3.1.3.

Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS command execution via Python eval() injection. The server passes client-supplied expression strings to eval() with only __builtins__={} cleared - a well-known insufficient sandbox - enabling attackers to traverse Python's loaded class hierarchy to reach subprocess.Popen through crafted TableValidateExprReq or TableMakeViewReq protobuf messages. A public exploit is confirmed by VulnCheck, and five vulnerabilities were disclosed simultaneously in the researcher's blog post, suggesting a broader attack surface in this release. No KEV listing is identified, but the published PoC substantially lowers the exploitation barrier.

Unauthenticated remote code execution in Puwell IP Camera firmware versions 2.x through 4.x lets remote attackers achieve root-level control by sending a crafted JSON payload to an undocumented DebugShell service listening on TCP port 34567. Because the service performs neither authentication nor input sanitization, any attacker with network reach to the port can pass operating-system commands directly to the device, resulting in full compromise. Reported by VulnCheck with publicly available exploit code exists; no public evidence of active in-the-wild exploitation (not in CISA KEV).

Stack-based buffer overflow in Autodesk FBX SDK's fbxsdk::ExtractDrive function allows arbitrary code execution in the context of the current process when a user opens a maliciously crafted FBX file. Any application embedding the FBX SDK for 3D asset import - including game engines, VFX pipelines, and CAD tools - inherits this attack surface, making the blast radius broader than the SDK itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS score (7.8) and RCE primitive make this a priority for organizations ingesting untrusted 3D content.

Stack-based buffer overflow in Autodesk FBX SDK's binary file parser allows arbitrary code execution when a user opens a maliciously crafted FBX file. The vulnerable function `fbxsdk::FbxIO::BinaryReadSectionHeader` fails to properly bound-check attacker-controlled data from binary section headers, overflowing the call stack and enabling control-flow hijacking in the context of the host process. Any application embedding the affected SDK version - including Autodesk DCC tools and third-party game engine editors - is exposed when users import FBX assets from untrusted sources; no public exploit or CISA KEV listing has been identified at time of analysis.

GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.

PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.