Remote Code Execution

An out-of-bounds write in Android's wpa_supplicant Robust AV / SCS action-frame handler (wpas_handle_robust_av_scs_recv_action in robust_av.c) can be turned into remote code execution on Android 14 through 17 (including 16-qpr2) devices that receive a crafted SCS action frame. Exploitation is sharply constrained: per the CVSS vector PR:H, the attacker must already hold System-level execution privileges on the target before the malformed frame is processed, and the independently assessed vector (AV:A) places the attacker in Wi-Fi/adjacent range rather than on arbitrary internet-routable paths. User interaction is not required (UI:N), and no public exploit code or CISA KEV entry has been identified at time of analysis; combined with the vendor score of 7.2 and the adjacent-vector reassessment, this rates as a moderate, not emergency, priority.

OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.

Arbitrary code execution in the control plane of Red Hat Multicluster Engine for Kubernetes (HyperShift operator) is possible when an authenticated user with cluster and secret creation permissions supplies a kubeconfig secret containing unauthorized executable credential plugins, which the operator copies without validation into the privileged control plane namespace. Downstream controllers that consume this configuration execute the plugins, granting full control plane compromise. The vulnerability requires low privileges (PR:L) and no user interaction, and no public exploit or CISA KEV entry is identified at time of analysis.

Untrusted in-repo configuration in auto-changelog before 2.6.1 lets attacker-controlled repository content execute code with the privileges of the invoking user or CI job. Because versions prior to 2.6.1 merge the .auto-changelog file and the package.json 'auto-changelog' key into runtime options by default, options such as handlebarsSetup and plugins are passed to Node's require(), yielding code execution without the repository's dependencies ever being installed; under the same conditions output, appendGitLog/appendGitTag, remote and URL templates enable arbitrary file writes, git argument injection and outbound requests. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but the attack requires the victim to invoke auto-changelog against a repository they do not control - most realistically a CI job checking out an untrusted pull-request head - so exposure is concentrated in that specific population rather than being broadly remotely reachable.

Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.

Arbitrary code execution and full compromise of the underlying Mitel Linux virtual machine in Mitel MiVoice Office 400 occur when a high-privileged local attacker plants a shared object (.so) whose name matches a predictable module that a privileged process loads without verifying its origin or integrity (CWE-73), causing the attacker's code to run with that process's privileges. The assessed attack vector is local with high privileges required (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so this is a post-compromise escalation or persistence technique rather than a remotely wormable flaw. A proof-of-concept exploit is assessed (CVSS 4.0 E:P); no CISA KEV entry confirms active exploitation at time of analysis.

Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Search service authentication token to dictate the file path used by the logging configuration interface and thereby write files anywhere on the host, which can escalate to code execution under the P4 Search service account. The flaw is a credentialed, privileged operation rather than an unauthenticated internet-facing attack: exploitation requires the service token, network reachability of the configuration interface, and a version older than the fixed 2026.4.2 release. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical risk is concentrated in environments where the service token is weakly protected or the interface is broadly exposed.

Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exposed Java Debug Wire Protocol (JDWP) interface. An attacker with network access to the JDWP port can execute arbitrary code as the P4 Search service account, potentially compromising the connected P4 Server. No public exploit code has been identified at time of analysis, but the issue is rated critical (CVSS 9.5 in CVSS 4.0, assessed as CVSS 3.1 with scope change) and requires the debug interface to be reachable (attack prerequisite AT:P), making it a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact.

Arbitrary file write in Mitel MiVoice Office 400 backup restoration can lead to root-level code execution if an attacker can supply a malicious TGZ archive to the configured backup repository; however, exploitation requires privileged access to the backup repository and a restore operation, making it a high-severity issue but not an indiscriminate internet-facing threat. No public exploit identified at time of analysis.

Unauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images prior to 2026.4.2 because the service authentication token is reset to a publicly documented default value (CWE-1392). Successful exploitation can lead to arbitrary code execution and compromise of any connected P4 Server, but full impact requires that the P4 Search container be network-reachable and that a P4 Server be connected to it. No public exploit identified at time of analysis, yet this is a genuine top-priority vulnerability because the default-token flaw is trivial to exploit once the service is exposed and the potential scope change to the connected P4 Server is severe.

Papermerge 3.5.3 permits an authenticated standard user to achieve remote code execution by uploading a crafted file to /api/documents/upload with directory-traversal sequences in the filename, causing a malicious Python .pth file to be written into the interpreter's site-packages directory; the embedded code executes only when the Python interpreter next starts, for example on an application or worker restart. Publicly available exploit code exists via a GitHub PoC repository and accompanying PDF, and the flaw is conditionally gated by requiring the Papermerge process to have write access to site-packages and by the attacker not controlling restart timing, making it a credible but conditionally-gated RCE rather than an immediately triggerable one.

Remote code execution in WookTeam 1.6.6 and earlier lets an attacker inject arbitrary PHP into an eval() call reached through the task export API at /api/project/task/export, granting full server-side code execution. The CVSS 3.1 vector rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), i.e. unauthenticated and network-reachable with total impact, although the assessor cautions that project/task export routes commonly sit behind a login session, so a valid authenticated session or an otherwise exposed/mis-protected route may be the real prerequisite and the PR:N rating should be verified against WookTeam's auth middleware. Publicly available exploit code exists and SSVC rates the attack automatable with total technical impact, while EPSS remains low at 0.15% (4th percentile) - signals conflict on urgency, and overall risk is bounded mainly by WookTeam's limited deployment footprint rather than by exploit difficulty.

Remote code execution in dormakaba evolo Service (all versions) allows an unauthenticated network attacker to execute arbitrary code as SYSTEM via a .NET deserialization flaw, per a 9.8 CVSS vector. The service is typically deployed on internal access-control administration hosts, so exploitation generally requires access to the management network segment, and pre-auth reachability is asserted by the CVSS vector rather than the description. No CISA KEV entry or public exploit was identified at time of analysis; EPSS is 0.29% (20th percentile), while SSVC rates exploitation as none and technical impact as total.

Path traversal in Unimall v4's FileUploadController.local() enables remote attackers to read arbitrary files outside the intended upload directory; the supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, though that remains unconfirmed against the vendor's actual routing. Although the description claims arbitrary code execution, the same vector shows only high confidentiality impact (C:H/I:N/A:N), so RCE would require an unconfirmed write-into-webroot capability; our independent assessment notes that if such a write is possible, integrity and availability impacts could follow. No public exploit or CISA KEV listing was identified, and EPSS is low at 0.24% (13th percentile).

ApiAdmin 5.0 and earlier allow any logged-in administrator to achieve remote code execution by uploading a .php payload to POST /admin/Index/upload; the handler takes the client-supplied extension verbatim with no whitelist, blacklist, or content inspection, and move_uploaded_file() places the file into the web-served public/upload/Ymd/ directory, where it can be requested directly over HTTP. The attack path is gated by an authenticated admin session (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), so practical exposure hinges on credential compromise, reuse, or insider access rather than an unauthenticated vector. EPSS is low at 0.35% (26th percentile) and the issue is not listed in CISA KEV; no public exploit code is identified at time of analysis, though a public proof-of-concept write-up is referenced (GitHub fangtang7/CVE) and the European vulnerability entry EUVD-2026-92468 tracks the same CVE.

Unauthenticated remote code execution affects dromara/northstar (a quantitative trading platform) through version 9.1.1 and earlier, because the application enables the embedded H2 Console while its authentication interceptor only guards the /northstar/** path, leaving /h2-console reachable with no credentials. Because the embedded H2 database also ships with the default 'sa' account and an empty password, any network-reachable attacker (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 9.8) can use the H2 console's CREATE ALIAS capability to execute arbitrary Java and thereby run arbitrary system commands on the host. Exploitation requires only that the Northstar instance be reachable over the network; there is no public exploit identified at time of analysis, though the cited GitHub reference is a technical write-up of the flaw, and this issue is not confirmed actively exploited (CISA KEV).

Local code execution on the Mercusys AC12 V2 router is possible because a 512-bit RSA private key is hardcoded in the firmware image and shared across every unit of that model, so anyone who obtains the key - from the firmware binary or through an on-device shell, serial or UART foothold - can bypass the trust operation it protects and run arbitrary code on the device. Exploitation requires local access only, with no authentication and no user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.7 High), while confidentiality and integrity impacts are rated High and availability is unaffected. There is no confirmed active exploitation (not in CISA KEV) and the SSVC assessment marks the issue non-automatable, but a public advisory/exploit exists and EPSS is low at 0.17% (6th percentile), placing this as a bounded, physical/adjacency-level risk rather than a mass-exploitation emergency.

Plaintext storage of sensitive data on the Mercusys AC12 V2 router, compounded by the absence of any secure boot mechanism, allows an attacker with hands-on access to read stored secrets and reflash or modify the firmware to run arbitrary code. The vendor-derived base score of 7.8 reflects a local, low-privilege vector (AV:L/AC:L/PR:L/UI:N), but independent analysis re-scores the realistic attack path as physical access with no authentication required (AV:P/AC:L/PR:N/UI:N) because reading the flash contents or writing a modified image presupposes possession of the device. Real-world priority is low: EPSS is 0.16% (5th percentile), no publicly available exploit code has been identified, and there is no CISA KEV entry - exploitation is confined to supply-chain, resale, repair-shop, theft, or evil-maid scenarios rather than mass remote compromise.

Code injection in InternLM MindSearch 0.1.0 allows unauthenticated remote attackers to execute arbitrary code through the Planner Agent component, specifically by manipulating the inputs argument processed by ExecutionAction.run in mindsearch/agent/graph.py. The issue is rated critical (CVSS 9.3 per the CVSS 4.0 vector; the independent assessment likewise has PR:N/UI:N with high confidentiality, integrity, and availability impact), and publicly available exploit code exists. The vendor was contacted but did not respond, no vendor-released patch has been identified, and risk is concentrated in internet-reachable or otherwise accessible self-hosted MindSearch 0.1.0 deployments.

Improper privilege management in LaraDashboard before 1.4.8 lets an authenticated Admin-tier user who holds the role.edit permission escalate to Superadmin by renaming or editing roles, or by granting themselves user.login_as rights, which then exposes account takeover and the core-upgrade and module-installation functions needed for code execution. The pre-patch guard in RoleController only refused Superadmin role tampering when the application ran with demo_mode enabled and the role name was literally 'Superadmin', so ordinary production deployments are exposed to any role-management holder by default. Exploitation is access-gated rather than anonymous: it requires a pre-existing Admin account with role.edit, no user interaction is needed, and no public exploit has been identified at time of analysis; the vendor has released the 1.4.8 patch.

Authenticated users holding editor privileges on wcms through 3.18.0 can turn the media upload API into a remote code execution primitive: the [*:path] parameter of POST /api/v0/media/upload/ is not validated, so an editor can write .php files into a web-served location (including outside the media directory via encoded ../ sequences) and have the web server execute them. The same unvalidated path on DELETE /api/v0/media/[*:path] additionally allows arbitrary file deletion, and the underlying flaw is an unrestricted upload of a dangerous file type (CWE-434) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). Exploitation is not anonymous - a valid editor account is mandatory (PR:L) and code execution further depends on the written PHP landing in a directory the web server executes; at time of analysis there is no CISA KEV entry and no public exploit identified at time of analysis.

Unauthenticated remote attackers can instantiate arbitrary Java classes in OpenIdentityPlatform OpenAM before 16.1.3 through the legacy JAX-RPC SOAP interface, leading to server crashes, classpath probing, and potential code execution via gadget chains. The vulnerability requires the JAX-RPC endpoint to be present and network-reachable at /jaxrpc/*, but no authentication or user interaction is needed because the session identifier is accepted without validation. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.8, and the independent assessment rates it as a credible high-priority issue rather than an inflated score.

Arbitrary shortcode execution in the Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress (all versions up to and including 2.11.0.5) lets unauthenticated attackers run attacker-chosen shortcodes on a target site, which in a typical WordPress install with shortcode-extending plugins can escalate to code injection and full site compromise (CWE-94). Exploitation is not automatic: it is gated on the site publishing a Beaver Builder page whose Sidebar module contains a widget rendering attacker-controllable text - the advisory names the core Recent Comments widget - and on either comments being auto-approved (moderation disabled) or the attacker's comment having been approved by a moderator, which makes this a content- and configuration-dependent attack rather than a universally reachable one; the flaws assessed vector therefore carries AC:H rather than the initial AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory (Wordfence threat ID 794e6d9b-ac07-4261-a60d-81c474973005, mirrored as ENISA EUVD-2026-91966) is the authoritative source for patch rollout.

Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.

Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.

Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.

Unauthenticated remote code execution in MikroTik RouterOS allows a network attacker who can reach the built-in web management service (WebFig / HTTP admin interface) to run arbitrary code as root, or to crash the device, with a single crafted request against the service's HTTP request-body handling. The defect is an integer underflow in that parsing path that is reachable before authentication, so no credentials, user interaction, or special privileges are needed on unpatched releases (RouterOS before 7.24). A vendor patch is available in 7.24, no public exploit identified at time of analysis, and the decisive real-world factor is whether the web management service is exposed to untrusted networks, since this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.

Opening a crafted untrusted document in Apache OpenOffice 4.1.16 and earlier can execute arbitrary code at the opening user's privilege level, including code fetched from a remote location, because the document's Java integration fails to authorize the external links it resolves. Exploitation is unauthenticated but requires user interaction: Java runtime integration must be enabled (the default configuration) and the victim must actively open an attacker-supplied file, making social engineering the primary delivery vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV and SSVC both report none), and EPSS is only 0.22% (12th percentile); a vendor fix is expected in Apache OpenOffice 4.1.17, which is still in the release-candidate phase, so the recommended interim mitigation is to disable Java runtime integration in the Preferences dialog or to avoid opening untrusted documents entirely.

Opening an attacker-controlled Kerchunk reference document with fsspec's ReferenceFileSystem can execute arbitrary Python code, because versions from 0.9.0 up to (but not including) 2026.6.0 render reference fields through unrestricted jinja2 templates instead of treating them as inert data. The vulnerability is exploitable by unauthenticated attackers but requires user interaction: the victim application - or a downstream consumer such as xarray - must actually open the malicious document, which can be supplied inline or fetched from an attacker-controlled URL, and the gen-array code path triggers with no special configuration at all. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-94), it is addressed by the vendor's 2026.6.0 release, which makes jinja interpretation opt-in; no public exploit identified at time of analysis.

Code injection in Tinypool versions prior to 2.1.2 allows an attacker who first pollutes Object.prototype to load attacker-controlled JavaScript modules via the worker pool, potentially reading or modifying task data with host process privileges. The flaw is exploitable only when an application calls pool.run(task, options) with its own options object; calls that omit the options argument use a trusted default and are unaffected. No public exploit code or active exploitation has been identified, and the attack requires a pre-existing prototype-pollution vulnerability in the host application, making real-world exploitation condition-gated.

Prototype pollution in the Tinypool npm package prior to 2.1.1 escalates to code execution: an unauthenticated remote attacker who can first pollute Object.prototype.execArgv or Object.prototype.env.NODE_OPTIONS (via a separate prototype-pollution flaw in the host application) has those inherited values copied into ThreadPool.options and forwarded to worker_threads.Worker, so every newly spawned worker loads attacker-supplied JavaScript through --import/--require preload arguments or NODE_OPTIONS. The payload executes with the host process's privileges, potentially exposing CI secrets, signing material, or build artifacts. The vendor assigns a CVSS 4.0 base score of 9.5 (AT:P - the attack requires an existing pollution primitive), exploitation is not confirmed as actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although the upstream fix commit includes a regression test that demonstrates the execArgv/NODE_OPTIONS technique.

Heap-based buffer overflow in Google Chrome's WebRTC component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page; all Chrome builds prior to 154.0.8037.97 on desktop and mobile platforms are affected. Successful exploitation requires user interaction (the victim must navigate to or open the attacker-controlled page), but no authentication or prior privileges are needed, and WebRTC is enabled by default. Impact is high for confidentiality, integrity, and availability within the renderer process, though the attack scope is unchanged - breaking out to the host operating system would require chaining a separate sandbox-escape flaw. Exploitation signals are currently weak: EPSS is only 0.25% (15th percentile), CISA SSVC rates exploitation as 'none', and no public exploit code has been identified at time of analysis; a vendor patch is available.

Use-after-free in Google Chrome's MediaStream component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, affecting all Chrome builds prior to 154.0.8037.97 on the stable channel. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but depends on user interaction: the target must load a malicious page that exercises the WebRTC/MediaStream path, and the resulting code execution is confined to the sandboxed renderer (S:U), so host-level compromise would require a separate sandbox-escape bug. At time of analysis there is no public exploit identified and no evidence of active exploitation (SSVC Exploitation: none, EPSS 0.21% / 11th percentile), while a vendor patch exists at Chrome 154.0.8037.97, making this a serious-but-not-emergency patching priority.

Use-after-free in SVG rendering in Google Chrome versions prior to 154.0.8037.97 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting unauthenticated remote reach with high confidentiality, integrity and availability impact, but it does require user interaction - the victim must navigate to or render attacker-controlled content, and no non-default configuration is needed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the practical severity is further bounded by the fact that code execution stays within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug. Vendor-released patch: Chrome 154.0.8037.97.

A use-after-free flaw in Chrome's Contextual Tasks component on Windows lets an attacker who has already compromised the renderer process break out of the browser sandbox and execute arbitrary code with the browser's privileges, triggered when the victim loads a crafted HTML page. Only Chrome builds on Windows prior to 154.0.8037.97 are affected, and exploitation is not an initial-access path: it requires a pre-existing renderer compromise plus user interaction, which is why the CVSS 3.1 base score of 8.3 reflects high attack complexity (AC:H). No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), with CISA SSVC rating exploitation as 'none' and automatable as 'no'; Google has shipped a vendor patch in version 154.0.8037.97, and Chrome's default auto-update resolves the exposure.

Type confusion in the V8 JavaScript engine of Google Chrome allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page, affecting all versions prior to 154.0.8037.97 (Chromium severity: High, CVSS 3.1 base 8.8). Exploitation is unauthenticated but requires user interaction (UI:R) - the victim must navigate to or render attacker-controlled HTML/JavaScript - and code execution is confined to the sandbox with scope Unchanged, so escaping to the host OS would require a separate sandbox-escape flaw and site isolation further limits cross-origin reach. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available.

Use-after-free in the FedCM (Federated Credential Management) component of Google Chrome can allow a remote attacker to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, with the only stated precondition being user interaction (CVSS UI:R); no authentication is required per the assessed vector (PR:N). The 9.6 score reflects a scope change (S:C) - successful exploitation escapes the renderer sandbox onto the underlying host - but signals diverge sharply: EPSS is only ~0.21% (11th percentile) and CISA's SSVC records Exploitation: none, so no public exploit has been identified at time of analysis. Google has released a fix in Chrome 154.0.8037.97, and Chromium rates the underlying issue High severity.

Sandbox escape and arbitrary code execution in Google Chrome on Windows (versions prior to 154.0.8037.97) arise from incorrect authorization in the browser's FileSystem component, letting a remote, unauthenticated attacker break out of the renderer sandbox and run code at the browser's privilege level after convincing a victim to open a crafted HTML page. Exploitation requires the user to visit an attacker-controlled page (CVSS PR:N/UI:R, scope changed) and is neither automatic nor zero-click; no public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none with automatable flagged no. That said, the signal is mixed: 9.6 CVSS with total technical impact contrasts with a low EPSS of 0.21% (10th percentile) and a platform-restricted, interaction-dependent attack path.

Out-of-bounds write in the WebGL implementation of Google Chrome prior to 154.0.8037.97 allows remote attackers to corrupt memory and potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction - the target must visit or be redirected to an attacker-controlled page that exercises the WebGL path (enabled by default) - but no authentication or prior privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6, Chromium security severity Critical). No public exploit code or confirmed active exploitation was identified at time of analysis; Google credits its own Chrome team for the report, and a vendor patch is available, so the primary risk window is unpatched Chrome installations that continue to browse untrusted content.

Code execution in Sapling SCM versions prior to v0.2.20260929-102736 can be triggered by cloning a maliciously crafted Git repository whose subtree URLs contain embedded control characters; simply running an otherwise read-only command such as 'sl log', 'sl blame', or 'sl annotate' against that clone is enough to execute attacker-controlled code. Exploitation is not remote or automatic: the CVSS vector (AV:L/PR:N/UI:R) requires the victim to clone an untrusted repository and then invoke one of the affected commands, so an attacker must first socially engineer the clone. At time of analysis there is no public exploit identified, CISA SSVC records Exploitation as 'none', the issue is not in CISA KEV, and no EPSS signal was provided; nonetheless the potential technical impact is total (confidentiality, integrity, and availability all High), so patched installations (v0.2.20260929-102736 and later) should be treated as the only safe configuration.

Authenticated Ghost administrators can obtain remote code execution by uploading a crafted theme whose translation (i18n/locale) files abuse path traversal (CWE-22) to load attacker-controlled content that the Node.js server then executes. The vulnerability affects Ghost 6.10.3 through every release before 6.64.0, and exploitation requires a full administrator account with access to the theme upload/management feature - anonymous visitors, members, authors, and editors cannot trigger it, and no end-user interaction is needed once admin rights are held. No public exploit code has been identified at time of analysis, and this is an access-gated risk rather than a drive-by threat; the vendor has shipped a fixed release, with details in advisory GHSA-jj74-hc2q-xrvm and a parallel VulnCheck advisory.

Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.

Stored cross-site scripting in the WHM Manage SSL Hosts interface of cPanel and WP Squared allows an authenticated attacker who can create or modify an SSL host entry to inject arbitrary script that executes in the browser of a higher-privileged operator - typically a server administrator - when that administrator later views the interface, giving the attacker arbitrary code execution in the victim's session context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) confirms the prerequisites: a prior authenticated foothold and administrator user interaction, which is a low barrier in multi-tenant or reseller hosting environments where low-privileged accounts are routine. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); vendor-released patches are available in cPanel builds 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11 and WP Squared 11.138.1.13.

Stored cross-site scripting (XSS) in the WHM Mass Modify Accounts interface of cPanel and WP Squared allows an authenticated low-privilege WHM user (such as a reseller) to inject malicious script that executes when a higher-privileged operator views the affected interface, potentially leading to arbitrary code execution in the context of the victim's browser session. Affected versions include cPanel before 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11, and WP Squared before 11.138.1.13. No public exploit identified at time of analysis, but vendor patches are available; the high CVSS score (9.0) is tempered by the requirement for an authenticated foothold and victim interaction.

Local file inclusion in the SiteOrigin Widgets Bundle WordPress plugin, in all versions up to and including 1.73.2, lets authenticated attackers with contributor-level access or higher (PR:L per the assessed vector) include and execute server-side .php files, bypassing access controls and exposing sensitive data; full attacker-controlled code execution is conditional on also having a way to place a .php file on the server that can then be included. The flaw is reached remotely by POSTing a crafted widgetData payload containing a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint, a structure that slips past validation because update_fields() only processes declared form fields. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar (any contributor account) and the fact that the vulnerable endpoint is REST-reachable without UI interaction make this a conditional priority rather than a drop-everything emergency.

Unauthenticated arbitrary file read, write, and deletion in the Ninja Forms - File Uploads WordPress plugin (versions up to and including 3.3.34) can be triggered by supplying a malicious file_path through the external Amazon S3 upload flow, enabling remote code execution when the External File Upload (Amazon S3) action is configured. Exploitation is remote and unauthenticated (CVSS 8.1, AC:H) but gated by deployment conditions: the S3 external upload action must be in use, and the read variant additionally requires a form Email action that attaches the uploaded file. No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is not provided, and the main risk is to sites using the gated configuration.

Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.

Arbitrary Python code execution in sinaptik-ai pandas-ai 3.0.0 allows remote, unauthenticated attackers to run attacker-controlled code through the CodeExecutor.execute path, giving full compromise of the host or container running the agent. The flaw is rated CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection, meaning no privileges, credentials or user interaction are required per the assessed vector. EPSS is low at 0.16% (4th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis, although a GitHub issue and a public gist referencing the bug are linked from the CVE record and should be reviewed as possible reproduction detail.

Code injection in Vanna 2.0.2's VannaBase.get_plotly_figure presents conflicting signals that must be weighed carefully: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), yet EPSS is only 0.36% (27th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis. In CVSS terms this is an unauthenticated remote issue, but the governing exploitation condition is that a deploying application exposes vanna's figure/plot-generation entry to attacker-influenced input; where the plotting path is exposed via bundled Flask/Streamlit/API front ends, an attacker who can shape the question or prompt can achieve attacker-controlled code or command execution, while embedded deployments that gate, authenticate, or do not expose that path are substantially less exposed than the 9.8 score implies.

Code injection in FinRobot 1.0.0's CodingUtils.create_file_with_code() allows unauthenticated remote attackers to execute arbitrary code when the agent pipeline is exposed to untrusted input, per the CVSS 3.1 vector (9.8 Critical, CWE-94). Exploitation requires that attacker-controlled text-such as a malicious prompt, document, or tool input-reaches the vulnerable function without neutralization; typical local or orchestrated deployments that only process trusted input materially reduce real risk. No public exploit identified at time of analysis, and EPSS is 0.21% (10th percentile), indicating low predicted exploitation activity.

Code injection in FinRobot v1.0.0 via CodingUtils.modify_code allows an attacker who can control input reaching that function to have their content executed as code by the host Python process, with the independent assessment scoring the worst case as high confidentiality, integrity and availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). FinRobot is an AI agent framework rather than a network service, so real-world exposure depends on whether the embedding application feeds untrusted prompts, agent tasks or data fields into modify_code without sanitization; there is no evidence of a default network listener, and NVD's 7.3 score (AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:L) most likely reflects a worst-case integration rather than an out-of-the-box remote service. No public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.21% (10th percentile), so practical priority is modest despite the High base score.

Code injection in AgentScope v1.0.20 allows unauthenticated remote attackers to execute arbitrary commands if a host application exposes the execute_shell_command tool to attacker-influenced input. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so exploitation depends on that exposure/deployment condition; the NVD-style vector of AV:N/AC:L is more optimistic and conflicts with the assessed high attack complexity. No public exploit identified at time of analysis, and EPSS is low at 0.27% (17th percentile).

Unauthenticated attackers with network reachability to the Mooncake transfer engine's TCP transport data port on releases before 0.3.13 can achieve arbitrary process memory read and write by sending a crafted SessionHeader whose addr and size fields are attacker-controlled under a READ or WRITE opcode. Successful exploitation discloses in-memory KV cache contents, prompts and other secrets, and corrupts memory in the transfer engine process, giving a credible route toward further compromise of the served model; the 9.3 score reflects a network-reachable, no-credentials, no-interaction attack with high confidentiality, integrity and availability impact confined to the vulnerable component. No public exploit code has been identified at time of analysis, and the practical limiting factor is exposure of the data port, which is normally bound inside a trusted LLM-serving cluster network - flat, misconfigured or internet-facing deployments carry the highest risk. Vendor-released patches are available in v0.3.13.

Unauthenticated remote code execution affects endpoints where the Thales SConnect native host component is installed, with an attacker reaching the host through an unrestricted browser native-messaging interface from a malicious or compromised web page. Exploitation requires no credentials (CVSS vector PR:N) and only passive user interaction - the victim must visit or be redirected to an attacker-controlled page - after which crafted input bypasses the component's security checks and, per the reported analysis, chains an improper cryptographic signature verification flaw (CWE-347) with memory-management issues to achieve code execution in the native host's context. Only systems that actually deploy SConnect (a smart-card authentication component, not present by default on general endpoints) are exposed, and there is no public exploit identified at time of analysis, though the severity is rated 9.4 under CVSS 4.0 and the reported vendor is Thales.

Out-of-bounds write in PeaZip's PEA archive extractor allows an attacker to execute arbitrary code with the privileges of the user who opens or extracts a crafted .pea file in PeaZip 11.2.0 and earlier, on Windows, Linux, macOS and BSD. The defect is in the first PCOMPRESS1 block: an attacker-controlled 32-bit compsize value is taken straight from the archive and used as both the blockread length and the copy-loop bound into fixed 1,114,112-byte global buffers, with no archive password, integrity tag or non-default configuration required. Exploitation is local and requires the victim to open or extract the archive (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H; CVSS 4.0 base 8.4), and no public exploit was identified at time of analysis, although the reporting researchers demonstrated code execution against the official Linux x86-64 and Windows x64 builds.

Out-of-bounds write in pgvector before 0.8.7 lets an authenticated database user corrupt memory while building or populating a vector index, which can escalate to arbitrary code execution on the PostgreSQL server host. Only users who can create/rebuild a vector index or insert rows into an indexed vector column can trigger it, and the trigger is supplying a vector whose dimensionality does not match the index definition, since affected versions perform no dimension validation. Patch status is a vendor-released fix (0.8.7) and no public exploit code was identified at time of analysis; SSVC scores exploitation as 'none' and automatable as 'no', and EPSS/KEV signals are absent, so this is a high-priority hardening item rather than an emergency - but SSVC rates technical impact as 'total', so multi-tenant databases where untrusted roles hold index or insert privileges are the realistic risk surface.

Remote code execution in GetSimple CMS CE (Community Edition) prior to 1.5 stems from a cross-site request forgery flaw in the UpdateCE update form, which ships without an anti-CSRF token and whose POST handler performs no token or request-origin verification. A remote attacker, unauthenticated per the CVSS vector (PR:N), can host a page that auto-submits a forged POST to the update endpoint; when a logged-in administrator visits that page, the server performs an attacker-directed download-and-deploy of a malicious update package inside the administrator's session, and because the deployed content is executed (see the related ZIP-extraction advisory), the outcome is remote code execution. Exploitation is gated by the UI:R social-engineering precondition - an authenticated admin with an active session must be lured to the attacker's page - and no public exploit has been identified at time of analysis; the vendor fix is included in version 1.5.

Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.

Stack-based buffer overflow in the TDDPv2 service (/usr/bin/tddp) on TP-Link Deco M9 Plus v2 mesh units lets a network-adjacent, unauthenticated attacker crash the device or potentially execute arbitrary code, but only while the unit is in its setup/provisioning phase. A crafted TDDP request whose decrypted payload is longer than the fixed-size stack buffer used by the subtype 0x91 handler (CWE-121) triggers the overflow with no user interaction. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; TP-Link has published fixed firmware. The risk is genuine but conditionally gated: the attacker must already sit on the same Wi-Fi/link-local segment during onboarding, which substantially narrows realistic exposure.

Remote code execution in DHIS2 Core versions 2.42.0 through before 2.42.5.1 and 2.43.0 through before 2.43.0.1 allows an authenticated attacker with high privileges to execute arbitrary code via unsafe Java deserialization. The vulnerability is remotely reachable but requires PR:H credentials, limiting exploitation to insiders or attackers who have already compromised an administrative account; no public exploit has been identified at time of analysis. Vendor fixes are available in versions 2.42.5.1, 2.43.0.1, and 2.44.

Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only low-level permissions to bypass the safemode sandbox in the provisioning/report templating engine and execute arbitrary commands on the management host, carrying a vendor score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is authenticated (CVSS vector PR:L) and requires the ability to author or render templates; the scope-changed impact is severe because a successful escape yields control of the Satellite/Foreman management server, not just the template context, but the prerequisite of valid credentials plus template privileges means the 9.9 rating overstates how easily the issue is reached in hardened deployments. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.

Privileged local attackers who can control Foreman configuration data can chain server-side template injection with insecure deserialization through the foreman-rake initialization logic in /usr/share/foreman/config/settings.rb to execute arbitrary code on Red Hat Satellite 6.19 for RHEL 9 hosts, resulting in full host compromise and downstream supply chain risk. The assessed CVSS 3.1 vector (7.7, AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) confirms the attack is local and authenticated with high privileges plus a user-interaction component, so it is not remotely or unauthenticated reachable against a default deployment and real exposure is largely confined to compromised or malicious privileged operators. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Red Hat has published errata RHSA-2026:74503 addressing it.

Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms this is a local, high-privilege-context privilege escalation rather than a remotely reachable flaw, and no public exploit code or CISA KEV entry was identified at time of analysis.

Authenticated WordPress administrators using the Prime Mover migration plugin before version 2.2.1 can abuse a Zip Slip path traversal (CWE-22) to write attacker-controlled files to arbitrary filesystem locations outside the intended extraction directory, which may escalate to remote code execution when the written path is PHP-executable by the web server. The flaw is reached through the plugin's migration ZIP import workflow, where malicious ZIP entry names are processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php. Exploitation requires a high-privileged admin account (CVSS PR:H, AV:N, UI:N) and crafted archive contents; no public exploit code was identified at time of analysis, and the vendor has released a patch. The risk is genuine but access-gated, since the admin prerequisite is the primary limiting factor and full RCE additionally depends on the hosting configuration.

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthenticated client to crash the server or potentially execute arbitrary code by sending an HTTP request whose Host header exceeds 8192 bytes. The flaw is not reachable in default deployments: the operator must have configured VirtualDocumentRoot (or VirtualScriptAlias) with a hostname format specifier such as %0 or %1 and must have raised LimitRequestFieldSize above its 8192-byte default, a non-default and uncommon combination that is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No KEV listing, EPSS score, or public exploit code was available at time of analysis, so there is no public exploit identified at time of analysis; the dominant uncertainty is the absence of any quantitative exploitation signal, while the real-world exploitability is sharply constrained by the required operator-set configuration. Users are advised to upgrade to 2.4.69, which fixes the issue.

Arbitrary file write as the grading teacher in Classroom 50 (the `gh teacher` CLI) before 1.11.0 lets an enrolled student escalate from a writable assignment repository to code execution in the teacher's session: because `gh teacher download` writes autograde artifacts (`result.json` and `results.json`) into the just-cloned student working tree without guarding pre-existing entries, a student who commits either name as a symlink, hardlink, FIFO or directory redirects that write to any path the teacher can reach - `~/.ssh/authorized_keys`, `~/.zshrc`, a cron file, or an in-clone `.git/hooks/*` script that git then executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`, or student-chosen submit-tag names for `results.json`), and the compromised `gh` token carries `admin:org`, `repo` and `workflow` across the whole classroom organization. Rated 9.4 under CVSS 4.0 and high priority by our independent review, exploitation is not anonymous and not zero-click: it requires classroom enrollment, a planted malicious entry, and the teacher running the vulnerable command against that untrusted repository (UI:P); no public exploit code was identified at time of analysis, no CISA KEV listing is present, and no EPSS score was supplied. Version 1.11.0 contains the patch.

Arbitrary PHP code execution is achievable in Pandora FMS version 777 and later by chaining a CSRF-protection bypass with an unrestricted file upload in the Plugin File Manager, allowing an attacker to place and execute a malicious PHP payload on the server. Attackers do not need credentials of their own (CVSS PR:N), but exploitation is not a fire-and-forget network attack: it requires a specific attack condition to hold (AT:P) and a logged-in Pandora FMS administrator to interact with the forged request (UI:A), meaning the victim must be socially engineered into triggering it from an authenticated console session. Successful exploitation yields full confidentiality, integrity, and availability impact on the affected instance; no public exploit code or confirmed active exploitation was identified at time of analysis.

Authenticated WordPress users with only Subscriber-level access can recursively delete arbitrary files and directories - up to and including the entire WordPress installation - on any site running the Super Forms - Drag & Drop Form Builder plugin version 6.3.316 or earlier. Because the super_save_form AJAX handler performs no capability check, a low-privileged attacker can first enable the file_upload_submission_delete setting for the form and then pass an unsanitized subdir value through super_submit_form into SUPER_Common::delete_dir(), with a trivially bypassed ABSPATH guard allowing deletion of wp-config.php and other critical files at the site root. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, the low privilege bar (sites with open registration are effectively exposed to anyone) and the destructive, site-wide impact make this a genuinely high-priority vulnerability rather than a CVSS-inflated paper risk.

Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.

Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management interface to enable the normally-disabled Telnet service via a crafted HTTP request, then execute arbitrary commands with root privileges on the router and potentially pivot to other devices on the same network. The flaw requires valid administrative credentials and a non-trivial request (vendor CVSS 4.0 8.9, AV:N/AC:H/PR:H), but once triggered it yields full root-level control with a scope change because the compromised router can be used to attack connected devices. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); ASUS has published a firmware remediation section in its security advisory.

Remote unauthenticated code execution in DeepTutor 1.4.0 lets any network caller who can reach the live tutorbot WebSocket interface drive the agent tool layer into running reviewer-chosen shell commands inside the service environment, yielding full confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). The underlying defect is a CWE-94 code-injection weakness in ExecTool.execute, and successful exploitation depends entirely on the deployment: the tutorbot WebSocket endpoint must be network-reachable rather than localhost-only or firewalled, and the tool-execution path must be enabled so caller-supplied input reaches ExecTool.execute. This is not in CISA KEV and no public exploit code was identified at time of analysis, while EPSS is very low at 0.16% (4th percentile), meaning mass opportunistic scanning is unlikely even though the consequence for an exposed, default-configured instance is maximum-severity remote code execution.

Authenticated code injection in langflow-ai Langflow up to and including v1.9.3 lets any user holding a valid account execute arbitrary Python on the server by POSTing raw source to the /api/v1/validate/code endpoint, which feeds the input straight into a server-side compile/exec validation path without sandboxing or an entitlement check (CWE-94). The supplied CVSS score is 9.8 under a PR:N vector, but the authoritative assessment applies PR:L because exploitation requires a valid Langflow session, making authentication the primary limiting factor; impact on confidentiality, integrity, and availability is rated High across the board. EPSS is only 0.17% (6th percentile), Langflow is not in CISA KEV, and no public exploit code has been identified at time of analysis, so mass opportunistic exploitation is not currently indicated - the realistic risk concentrates on internet-exposed, multi-tenant, or weakly authenticated Langflow deployments.

Authenticated administrators holding a specific queue-management privilege on Kiteworks Email Protection Gateway (versions before 9.5.0) can submit a crafted serialized object to the cluster management interface that is deserialized without sufficient validation, resulting in arbitrary code execution in the context of the gateway service account. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) makes clear this is not reachable by unauthenticated users, standard users, or admins lacking the queue-management entitlement, and no user interaction is required once a suitably privileged account exists. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and vendor-patched versions are available.

Local privilege escalation in Kiteworks Core lets an attacker who already holds code execution as an unprivileged backend service account invoke a privileged routine that mishandles attacker-influenced input, running arbitrary OS commands as root. The flaw requires a prior local foothold on the appliance - the CVSS vector (AV:L, PR:L, UI:N) confirms it cannot be reached directly over the network and demands an existing initial compromise or misconfiguration to obtain the service account. No public exploit code or active exploitation is identified at time of analysis, and the realistic risk is bounded by how easily that initial service-account access can be obtained on a given deployment; the vendor's advisory is GHSA-658c-86vw-g9hf.

Local privilege escalation in Kiteworks Core lets an attacker who already has code execution as an unprivileged backend service account on the appliance obtain root. A privileged, root-owned routine consumes a filesystem path that the lower-privileged service account can influence, so the attacker can steer that root operation into executing arbitrary commands with full privileges (CWE-59 link-following / unsafe path handling). The attack is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and is a second-stage primitive requiring an existing foothold; no public exploit was identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV), though the 7.8 severity and availability of a vendor advisory make prompt patching advisable.

An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.

OS command execution in Kiteworks Core is possible when the remote-support capability is licensed and enabled and an authenticated System Administrator also possesses the key protecting submitted data, allowing that administrator to redirect the outbound support connection to an attacker-chosen destination that can then execute OS commands with local service account privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so exploitation requires high application privileges plus the additional key-possession condition, and deployments without remote support enabled are not exposed; there is no public exploit identified at time of analysis and no CISA KEV indication. The independent assessment rates real-world priority low-to-medium despite the 7.2 High base score.

Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.

Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execution on one node of a clustered deployment to run operating system commands with elevated privileges on other nodes in the same cluster. The vulnerable function is not reachable from outside the cluster, so the attack path is confined to the internal cluster network and requires a pre-existing foothold on a cluster member; single-node deployments are not exposed. Rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with scope change reflecting cross-node impact, and no public exploit identified at time of analysis.

Remote code execution in Kiteworks Email Protection Gateway allows an authenticated administrator to upload a crafted backup file that the product fails to sufficiently validate, then influence how the application loads it so that attacker-supplied code executes under the gateway's underlying service account. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection; exploitation is gated by high-privilege authentication, making it a realistic post-compromise, insider, or credential-chaining vector rather than an unauthenticated internet-wide threat. No public exploit code and no confirmed active exploitation (CISA KEV) were identified for this CVE at time of analysis, and no EPSS score was supplied in the available intelligence.

Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; realistic risk therefore hinges on admin-credential compromise, insider misuse, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.

Deserialization of untrusted data in Kiteworks Core before 9.5.0 can escalate to remote code execution on the appliance, but only as a secondary, chained weakness rather than a standalone attack. The issue is not exploitable in isolation: an attacker must first obtain a way to influence the data that Core deserializes, which in practice means chaining a separate flaw (for example one of the file-write or injection issues in the same CISA CSAF batch, va-26-274-01) or leveraging an existing foothold. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and although the base score is 8.1, the local/config-adjacent reachability (AV:L), high attack complexity (AC:H) and the mandatory data-influence precondition materially lower real-world risk; the CVSS vector indicates no privileges are required (PR:N), but exploitation is not remotely self-contained.

Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.

Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.

Arbitrary file write during plugin installation in ZeroClaw before 0.8.5 (when built with the plugins-wasm feature) lets attackers place files outside the plugins directory by supplying a crafted manifest.toml whose wasm_path field contains '..' or absolute/root/drive-prefix components; overwriting shell startup files or similar executed content yields code execution under the victim's account. The attack is local (AV:L) and unauthenticated per the assessed vector (PR:N), but it requires user interaction (UI:P/UI:R) - the victim must be persuaded to install the attacker-supplied plugin package - and only functions when plugin signature verification is left in its default Disabled mode, making the path check the sole gate. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in v0.8.5.

Arbitrary code execution on OpenClaw Windows Node hosts before version 2026.7.1 is achievable by an attacker who already holds gateway or agent access to a node, because the system.run tool's environment-variable sanitizer maintains an incomplete denylist (CWE-184). The attacker supplies variables such as GIT_CONFIG_*, GIT_PAGER, DOTNET_STARTUP_HOOKS, or JAVA_TOOL_OPTIONS alongside a request that runs an allowlisted tool (git, dotnet, java), causing that otherwise-permitted tool to load and execute attacker-controlled code or commands when it is next invoked; this requires the attacker to pass the tool's own arguments unchanged, which is why the attack-complexity/attack-requirements component is elevated. Exploitation is not remote-unauthenticated-it presumes prior gateway or agent access (PR:L), it is Windows-only, and it depends on at least one of git, dotnet, or java being present and reachable through system.run. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a fixed build.

Authenticated users holding the backend 'manager' role in yii2-starter-kit through 4.2.0 can upload PHP scripts through the backend file-storage upload action and then request them from the web-accessible storage directory, achieving remote code execution as the web server user. The defect is an unrestricted file upload (CWE-434) with a CVSS 4.0 base score of 8.7 (PR:L, fully consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation is gated on manager-level authentication, on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions, which is the default starter-kit layout. No public exploit code identified at time of analysis, and the practical priority is tempered by the authentication prerequisite and the niche footprint of the product, though the impact is total for any live deployment that meets those preconditions.

Session hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legitimate user's active session and escalate to remote code execution running with the privileges of the 'zammad' service account. Exploitation requires passive user interaction (CVSS UI:P) - a logged-in agent or admin must load attacker-influenced content - but no prior credentials or privileges (PR:N), so the practical barrier is the narrow vulnerable version window rather than authentication. The same defect exists in Zammad 7.0.0-7.1.3 but is not exploitable there due to environmental conditions; the reporter's CVSS v4.0 base of 9.4 carries an E:A (Attacked) exploit-maturity metric, though no CISA KEV entry or confirmed public exploit code appears in the supplied data, so no public exploit is confirmed at time of analysis.

Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned, low-privileged attacker to break an internal resource-handling boundary and gain high-integrity impact - code execution, privilege escalation, data tampering, information disclosure, or denial of service on the host running the vGPU Manager. This affects virtualization/vGPU deployments on Linux (the manager component on the hypervisor host), not standard desktop GPU drivers, and the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms the attacker must already hold local low-privileged access to a context served by that manager, such as a guest VM or a local account on the host; there is no network or unauthenticated path. It is a genuine local privilege-escalation class issue rather than a remotely triggerable one, and no public exploit was identified at time of analysis.

An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with low privileges corrupt kernel memory, which the vendor rates as potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, HIGH). The attack is strictly local - vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - so it is not remotely exploitable and requires only an authenticated low-privileged context or a tenant/guest that can reach the host kernel module; the risk is highest in multi-tenant VDI and cloud-GPU deployments where local access is comparatively easy to obtain. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no evidence of confirmed active exploitation.