Remote Code Execution

Privacy Drive 3.17.0 contains an unquoted service path vulnerability in the pdsvc.exe service binary that allows local attackers to escalate privileges by exploiting the service startup process. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Remote attackers can execute arbitrary code on Oinone Pamirs 7.0.0 servers by sending malicious script expressions to the ScriptRunner.run() method, which evaluates untrusted input without sandboxing. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable without authentication against default configurations. No public exploit identified at time of analysis, but SSVC marks this as automatable with partial technical impact. EPSS data unavailable. The vulnerability enables both information disclosure (C:L) and integrity compromise (I:L) according to CVSS, creating a pathway for initial access and potential privilege escalation.

A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.

Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to be run with elevated privileges potentially leading to. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.

Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or write to protected memory potentially resulting in. Rated high severity (CVSS 8.8). No vendor patch available.

Buffer overflow in AMD GPU driver IOCTL handler enables local privilege escalation to root on Linux systems running AMD Instinct or Radeon Pro GPUs. Authenticated local users with low privileges can exploit an out-of-bounds write vulnerability in the AMDGV_CMD_GET_DIAG_DATA IOCTL to achieve arbitrary kernel code execution. EPSS data not available; no public exploit or CISA KEV listing identified at time of analysis, suggesting limited active exploitation despite high CVSS 8.5 severity.

Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code execution. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available.

Local privilege escalation in AMD Platform Management Framework (PMF) allows authenticated attackers with low privileges to execute arbitrary code with elevated system privileges through an out-of-bounds write vulnerability. Affects multiple AMD Ryzen processor series (6000, 7035, 7040, 8040, and Embedded R8000) across mobile and embedded platforms. The CVSS 4.0 score of 8.4 reflects high impact to system integrity and availability with changed scope, indicating the attacker can escape the vulnerable component's security context. No active exploitation confirmed in CISA KEV at time of analysis, and public exploit code availability is not indicated in current intelligence.

Arbitrary code execution and denial of service in AMD Platform Management Framework (PMF) affects Ryzen 7035, 7040, 8040 mobile processors and Ryzen Embedded 8000 series. A local authenticated attacker exploiting an unchecked return value vulnerability can write to arbitrary memory locations, potentially escalating privileges from low to high integrity across system boundaries. The CVSS 4.0 score of 7.1 reflects local attack vector with low complexity but requires specific attack timing conditions (AT:P), though the cross-scope impact (S:H) and high confidentiality/integrity impact to subsequent systems elevate real-world risk for enterprise environments with AMD mobile processors.

Privilege escalation in AMD GPIO controller driver for Windows allows authenticated local users with low privileges to execute arbitrary code with elevated rights via insecure directory permissions. Affects nearly the entire AMD processor portfolio from Ryzen 3000-series through latest EPYC 9005 and Ryzen AI 300. AMD has released patched chipset drivers (version 7.04.09.545 for most desktop/mobile products, 8.03.16.641 for server platforms) addressing the vulnerability. EPSS score and KEV status not provided in source data, but the local attack vector and user interaction requirement limit remote exploitation risk despite the 7.0 CVSS score.

Local privilege escalation in WWW::Mechanize::Cached for Perl (versions before 2.00) allows authenticated local attackers to inject malicious cached HTTP responses and achieve arbitrary code execution. The module creates world-writable cache directories under /tmp/FileCache with 0777 permissions, enabling any local user to replace cached responses that are deserialized via Storable::thaw. EPSS exploitation probability is low (0.05%, 16th percentile) and no active exploitation is confirmed at time of analysis. Vendor-released patch available in version 2.00 with upstream fix confirmed via GitHub commit b821647.

Authenticated remote code execution in ORSEE 3.1.0 allows low-privileged users to execute arbitrary PHP code on the server by submitting participant profile field values prefixed with 'func:', which are passed unsanitized into eval() calls within tagsets/participant.php and tagsets/options.php. Only version 3.1.0 is confirmed affected; ORSEE is a niche academic tool used in economic research labs, limiting broad attack surface but making unpatched deployments attractive targets for insider threat or compromised-credential scenarios. No public exploit identified at time of analysis beyond a published proof-of-concept writeup on Medium, and EPSS sits at 0.06% (18th percentile), reflecting the narrow deployment footprint.

Mass assignment vulnerability in Open WebUI v0.9.2 allows authenticated attackers to spoof user identities and manipulate model evaluation data by injecting a `user_id` field into feedback requests. The `POST /api/v1/evaluations/feedback` endpoint fails to properly validate and segregate server-set values from user-supplied input, enabling attackers to create feedback records attributed to arbitrary users and corrupt Elo-based model leaderboard rankings. Patch available in v0.9.5.

Script injection in Google Chrome's SanitizerAPI on Android (versions prior to 148.0.7778.168) enables Universal Cross-Site Scripting (UXSS), allowing unauthenticated remote attackers to bypass same-origin policy protections via a crafted HTML page when visited by a victim. The Sanitizer API - ironically a defensive web platform feature designed to strip dangerous markup - contains a code injection flaw that permits injected scripts or HTML to survive sanitization. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC classifies exploitation as none; however, the UXSS impact class warrants prompt patching given Chrome's ubiquitous deployment footprint.

Remote authenticated actors with S3 write access can achieve code execution in Amazon SageMaker Triton inference containers by replacing model artifacts with malicious pickle payloads that are deserialized without integrity verification. Affected versions are SDK v2 before v2.257.2 and v3 before v3.8.0. The vulnerability requires high-privilege S3 access to the model artifact path but carries severe impact including arbitrary code execution within inference containers. No public exploit code or active exploitation has been identified at time of analysis.

Argument injection in dbt-mcp v1.15.1 through v1.17.0 allows MCP clients to inject arbitrary dbt command-line flags such as --profiles-dir, --project-dir, and --target via unsanitized node_selection and resource_type parameters, enabling attackers to redirect dbt's configuration and database operations to attacker-controlled locations. The vulnerability is exploitable via two independent vectors in the _run_dbt_command() function and has been verified by proof-of-concept code demonstrating arbitrary dbt profile injection. Vendor-released patch available in v1.17.1.

Remote code inclusion in Yordam Library Automation System versions 19.5 through 22.0 allows unauthenticated attackers to execute arbitrary code with high integrity and confidentiality impact via user interaction. The vulnerability was reported by Turkey's National Cyber Security Directorate (USOM), indicating potential targeting of Turkish government or educational institutions using this library management software. With network-accessible attack vector and low complexity (CVSS AV:N/AC:L), this represents a significant risk to organizations running unpatched versions despite requiring user interaction (UI:R).

Remote code execution in Archon 0.1.0 enables attackers to execute arbitrary commands and steal API keys when victims access a malicious HTML page. The attack exploits insufficient input validation (CWE-94) to control the Archon UI, run prompts on behalf of authenticated users, and exfiltrate all information displayed in the interface. With EPSS score of 0.04% (13th percentile) and no confirmed active exploitation, this represents a web-to-client attack requiring social engineering but offering significant post-exploitation capabilities once triggered.

Arbitrary code execution in AMD optional tools occurs through DLL injection during unsafe OpenSSL initialization, allowing local authenticated attackers with low-privilege user access and user interaction to execute malicious code with high impact to confidentiality, integrity, and availability. The vulnerability stems from insecure library loading (CWE-427) where the affected AMD utilities fail to validate DLL search paths during OpenSSL library initialization. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis, though the low attack complexity (AC:L) indicates straightforward exploitation once local access is obtained.

Fleet trusts untrusted client-supplied IP address headers (X-Forwarded-For, X-Real-IP, True-Client-IP) when determining source IP for incoming requests, allowing both authenticated and unauthenticated attackers to spoof their apparent IP address and bypass per-IP rate limiting controls. This enables brute-force and password-spraying attacks against authentication endpoints to scale without triggering rate-limit protections, though the vulnerability does not itself enable authentication bypass, privilege escalation, data exposure, or remote code execution.

Cross-site scripting in GitLab CE/EE 18.11.x (before 18.11.3) enables an authenticated low-privilege attacker to inject unsanitized content that executes arbitrary JavaScript within another user's browser session. The CVSS Scope Changed (S:C) flag reflects the cross-user impact boundary: the vulnerability allows one GitLab principal to affect a distinct security context belonging to a different user, including potentially higher-privileged accounts such as project owners or instance administrators. No public exploit code exists and no active exploitation has been identified - EPSS at 0.02% (5th percentile) and SSVC exploitation status of 'none' both confirm low immediate urgency - though GitLab's wide enterprise deployment makes patching to 18.11.3 advisable.

HTML and JavaScript injection via email notifications in GitLab CE/EE (versions 15.11 through 18.11.2) allows an authenticated low-privileged user to deliver malicious content to other users' inboxes by embedding unsanitized markup into platform-generated notifications. The attack crosses a scope boundary (S:C in CVSS) because the injected code executes in the recipient's email client or browser context rather than GitLab itself, enabling phishing, credential harvesting, or session theft against targeted users. No public exploit has been identified at time of analysis and SSVC signals no active exploitation, though the broad version range - spanning over three years of releases - expands the exposed population significantly.

Rate limit bypass in Strapi's users-permissions plugin (all versions <=5.44.0) allows unauthenticated remote attackers to conduct unlimited credential brute-force, password-reset code enumeration, and credential-stuffing attacks against /auth/local, /auth/reset-password, and /auth/change-password endpoints. The middleware incorrectly incorporated an attacker-supplied email field into its rate-limit key on routes where email is not a valid request parameter, meaning each request with a distinct email value obtained a fresh throttle window - rendering per-IP throttling entirely ineffective. No public exploit or KEV listing exists at time of analysis, but the SSVC assessment flags this as automatable, lowering the bar for scripted abuse.

Local privilege escalation in Palo Alto Networks Prisma Access Agent (all versions prior to 26.2.1) allows any locally authenticated non-administrative user to elevate to root on macOS and Linux, or NT AUTHORITY\SYSTEM on Windows, by exploiting a flawed privilege management mechanism. Successful exploitation grants full control of the affected endpoint, enabling arbitrary code execution and unauthorized access to data restricted to privileged accounts. No public exploit exists and the vulnerability is absent from CISA KEV; however, SSVC rates technical impact as total, making patching a meaningful priority for multi-user and enterprise endpoint environments.

Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker positioned as a man-in-the-middle to corrupt memory during Portal/Gateway message processing, potentially executing arbitrary code with SYSTEM privileges on affected endpoints. Affected platforms include Windows (including the UWP variant), macOS, and other non-iOS clients; iOS is explicitly excluded by the vendor. No public exploit identified at time of analysis - EPSS stands at 0.01% and SSVC confirms no current exploitation - however the SSVC technical impact rating of 'total' and potential for full SYSTEM-level compromise justify prioritized patching for endpoints connecting from untrusted networks.

Atomic Alarm Clock 6.3 contains a stack overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string to the display name textbox in the Time Zones. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Arbitrary file read in Avada Builder plugin for WordPress versions up to 3.15.2 allows authenticated attackers with Subscriber-level access to read arbitrary files on the server via the 'fusion_get_svg_from_file' function in the 'fusion_section_separator' shortcode. Sensitive information including configuration files, database credentials, and private keys can be exposed. The vulnerability was partially patched in 3.15.2 and fully patched in version 3.15.3.

Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.

Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute arbitrary code on affected devices. Impacting Samsung Mobile Devices running Android 14, 15, and 16 prior to SMR May-2026 Release 1, exploitation is constrained to local privileged actors, substantially limiting real-world attack surface. No public exploit code exists and no confirmed active exploitation has been reported; EPSS places this at the 3rd percentile (0.01%), consistent with the elevated barrier to entry.

Privilege escalation into the AMD Secure Processor affects AMD EPYC 8004/9004/9005 and EPYC Embedded 8004/9004/9005 series processors, where missing lock bit protection on NBIO registers lets a local admin-privileged attacker gain arbitrary System Management Network (SMN) access. This can lead to arbitrary code execution inside the AMD Secure Processor (ASP) and breaks the confidentiality and integrity guarantees SEV-SNP is supposed to provide to confidential-computing guests. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC rates exploitation as none but technical impact as total.

Privilege escalation in the ionic network driver on VMware ESXi 8.x and 9.x hosts equipped with AMD-Pensando DPU hardware allows a low-privileged local attacker to corrupt heap memory and potentially execute arbitrary code with elevated privileges. Reported by AMD (AMD-SB-2001) and tracked as EUVD-2025-209814, the flaw carries a CVSS 4.0 base score of 8.8 with total technical impact but high attack complexity. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with EPSS at just 0.01%, indicating no observed exploitation activity.

Local privilege escalation in the ionic cloud driver used by VMware ESXi 8.x and 9.x hosts running AMD-Pensando DPU products allows a low-privileged local attacker to corrupt heap memory and potentially execute arbitrary code with elevated (host-level) privileges. The flaw was reported by AMD (AMD-SB-2001) and carries a CVSS 4.0 base score of 8.8 with a 'total' technical impact under SSVC. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.

Arbitrary shortcode execution in the Advanced Custom Fields: Extended WordPress plugin (all versions through 0.9.2.3) enables unauthenticated remote attackers to invoke any shortcode registered in a WordPress installation by submitting crafted input to exposed front-end forms. The flaw exists in two code paths - the form front-end renderer and the email action handler - both of which pass user-controlled values directly to WordPress's do_shortcode() function without validation or allowlisting. No active exploitation has been identified (SSVC: Exploitation none, not in CISA KEV), and EPSS sits at 0.09% (25th percentile), though the attack is flagged as automatable, raising the potential for opportunistic scanning at scale.

Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) can be triggered when the application parses a maliciously crafted VC6 file. The flaw is an out-of-bounds read (CWE-125) reached through the file-import path, giving an attacker who convinces a user to open a booby-trapped file the ability to leak memory or run code in the context of the victim. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the local, user-interaction-dependent attack model reported by CISA ICS-CERT.

Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) is possible when the application parses a specially crafted VC6 file, driven by an out-of-bounds read (CWE-125). An attacker who convinces a user to open a malicious VC6 file can read out-of-bounds memory to leak data or steer execution toward running arbitrary code in the context of the user. There is no public exploit identified at time of analysis, the EPSS score is negligible (0.01%), and CISA's SSVC framework rates exploitation as 'none' but technical impact as 'total'.

Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) occurs when the application parses a maliciously crafted VC6 file, triggering an out-of-bounds write. An attacker must convince a user to open a booby-trapped drawing file, after which code runs in the context of the victim's user account. There is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%), consistent with the CISA/ICS-CERT SSVC assessment of no known exploitation.

Denial of service in protobufjs allows remote attackers to crash runtime code generation by providing crafted protobuf schemas or JSON descriptors containing unescaped control characters in field names. When affected message types perform encode, decode, verify, or conversion operations, the generated JavaScript code fails to compile, rendering those types unusable. This affects applications that load untrusted schemas; those using only application-defined schemas are not impacted. No code execution is known to occur.

Prototype injection in protobufjs generated message constructors allows attackers controlling plain objects passed to message constructors to modify the prototype chain of individual message instances via an enumerable `__proto__` property. Affects protobufjs versions 7.5.5 and earlier, and 8.0.0-8.0.1. This is a per-instance prototype pollution issue (not global) with impact dependent on downstream application behavior such as inherited property reliance or `instanceof` checks. No active exploitation confirmed; no public exploit identified at time of analysis.

Command injection in Siemens RUGGEDCOM ROX industrial network devices enables authenticated remote attackers to execute arbitrary commands with root privileges during feature key installation. The vulnerability affects multiple ROX product lines (MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, RX5000) running firmware versions below V2.17.1. While exploitation requires low-level authentication and higher attack complexity (CVSS 4.0: AV:N/AC:H/PR:L), successful exploitation grants complete control over critical industrial network infrastructure. No public exploit identified at time of analysis, and EPSS data not available for this recently disclosed vulnerability.

Unauthenticated remote code execution in GWD Connect WordPress plugin versions up to 2.9 allows attackers to execute arbitrary PHP code on unregistered installations via the update_agent action in standalone agent endpoints (gwd-backup.php and gwd-logs.php) when the API key is not configured. The vulnerability exploits a missing authorization check that occurs only when the authentication key has not been set up, affecting default installations. No public exploit code or active exploitation has been confirmed at this time.

Improper input validation in an Axis OS configuration file allows authenticated SSH users to execute code and potentially escalate privileges. The vulnerability requires valid SSH credentials but affects all Axis OS versions, making it a significant risk for organizations running Axis network devices with SSH access exposed or shared credentials.

Code injection in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform allows authenticated attackers to execute arbitrary code for subscribed channel users by sending specially crafted inputs. The vulnerability has low integrity impact with no confidentiality or availability consequences. CVSS 4.3 (low severity) reflects the requirement for authenticated access, but the ability to affect other users elevates practical risk in multi-tenant environments.

An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Remote code execution in Kubectl MCP Server v1.1.1 allows unauthenticated network attackers to execute arbitrary commands on systems running the vulnerable server through crafted HTML-based exploitation vectors. Despite a critical 9.8 CVSS score, EPSS rates exploitation likelihood at only 0.02% (4th percentile), suggesting limited real-world targeting thus far. The vulnerability is classified as CWE-94 (Code Injection), affecting an open-source Model Context Protocol (MCP) server implementation for Kubernetes management. No CISA KEV listing indicates absence of confirmed widespread exploitation at time of analysis.

Out-of-bounds write in Apple iOS/iPadOS and macOS allows a malicious app to execute arbitrary code with kernel privileges, representing a local privilege escalation to the highest system level. Affected platforms include iOS and iPadOS prior to 18.7.9, macOS Sonoma prior to 14.8.7, macOS Sequoia prior to 15.7.7, and macOS Tahoe prior to 26.5. No public exploit code has been identified and CISA has not listed this in KEV, but kernel-level code execution represents severe potential impact if triggered.

CSS scoping bypass in Mermaid's default configuration allows injected styles to escape the diagram SVG container and apply globally to the host page via the `fontFamily`, `themeCSS`, and `altFontFamily` initialization options. Affected are npm/mermaid versions up to 10.9.5 and 11.0.0-alpha.1 through 11.14.0 when rendered with default settings - covering any web application that renders user-supplied diagram definitions, such as wikis and documentation platforms. An attacker who can influence diagram initialization parameters can achieve page defacement and DOM attribute exfiltration via CSS `:has()` selectors; a public proof-of-concept demo exists on mermaid.live, though no CISA KEV listing or widespread exploitation is recorded, and the EPSS of 0.05% (15th percentile) confirms low current exploitation activity.

HTML injection in Mermaid's state diagram `classDef` parser allows escape from the SVG rendering context into the parent document DOM, affecting npm/mermaid through v11.14.0 and through v10.9.5 under the default `securityLevel` configuration. By embedding SVG/style-closing sequences inside CSS property values, an attacker can inject arbitrary HTML and CSS that overlays the full browser viewport - enabling UI redressing and phishing-style attacks on any platform that renders user-supplied diagrams. A public proof-of-concept is available per SSVC assessment; however, `<script>` tag stripping is confirmed to prevent classic XSS, and no CISA KEV active exploitation has been recorded.

CSS injection in Mermaid's diagram rendering engine (npm/mermaid v11.14.0 and earlier, v10.9.5 and earlier) allows attackers who can supply diagram input to inject arbitrary CSS rules into the host page. The flaw exists because `classDef` style strings are captured by an unrestricted Jison regex and written unsanitized to `style.innerHTML`, enabling page defacement, user tracking via CSS `url()` callbacks, and DOM attribute exfiltration via CSS `:has()` selectors. A public proof-of-concept with a live demo is confirmed in the GHSA advisory; no CISA KEV listing at time of analysis.

CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to inject semicolons, commas, CR, LF, or TAB characters into a serialized Cookie: request header, enabling cookie smuggling and HTTP request header splitting against downstream proxies or servers. Affected applications are those built on cowlib 2.9.0 and later that pass externally-influenced data directly to this function without prior sanitization - notably Cowboy-based Erlang web services acting as reverse proxies or API gateways. No public exploit has been identified and no active exploitation is confirmed; EPSS stands at 0.02% (6th percentile) and CISA KEV status is absent, consistent with SSVC exploitation: none.

Remote code execution in OpenClaw npm package versions before 2026.4.20 allows local authenticated users to inject malicious code through MCP stdio server environment variables. Attackers craft workspace configurations containing dangerous environment variables (NODE_OPTIONS, LD_PRELOAD, BASH_ENV) that execute arbitrary code when operators start sessions using those MCP servers. Vendor-released patch available (version 2026.4.20). No public exploit code or active exploitation confirmed at time of analysis, though VulnCheck published detailed technical advisory. CVSS 7.3 reflects local attack vector requiring user interaction, limiting widespread exploitation risk despite high technical impact.

Insecure deserialization in CosyVoice's model loading pipeline permits arbitrary code execution on any system that loads a maliciously crafted model directory via the Web UI. The framework invokes torch.load() on model weight files (llm.pt, flow.pt, hift.pt) without the weights_only=True safety parameter, allowing Python's pickle module to deserialize and execute arbitrary objects embedded in those files. An attacker who can persuade a victim to point the CosyVoice Web UI at an attacker-controlled model directory - whether via a trojanized download, a shared malicious repository, or direct filesystem access - achieves code execution on the victim's machine at the moment of model loading. No public exploit code or CISA KEV listing is recorded at time of analysis; EPSS is 0.02% (5th percentile) and SSVC assesses exploitation as none, consistent with the social-engineering precondition required.

Stored cross-site scripting in iotgateway v.3.0.1 allows remote unauthenticated attackers to inject malicious JavaScript through the Log Record Function, which then executes in the browser of any user who views the affected log entries. The CVSS scope change (S:C) confirms the injected script breaks out of the application's security context to operate within the victim's browser session, enabling session hijacking or credential theft. No active exploitation is confirmed by CISA KEV; however, SSVC intelligence indicates a proof-of-concept exists, and EPSS stands at a low 0.05%, suggesting targeted rather than widespread opportunistic exploitation.

Command injection in GPT-Pilot's Executor.run() method enables arbitrary shell command execution through the interactive command confirmation workflow, affecting all versions through commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03). An actor with access to the confirmation prompt - locally or via a network-exposed deployment - can substitute malicious shell commands that are passed unsanitized to asyncio.create_subprocess_shell(), executing with the full privileges of the GPT-Pilot process. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.14% (33rd percentile) reflects low current exploitation activity, though the RCE impact class warrants attention in multi-user or network-exposed deployments.

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injecting PHP code into. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by injecting malicious code. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading malicious theme files. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Ultimate Product Catalog 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WordPress 3dady real-time web stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by exploiting unsanitized input. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Code injection in codelibs Fess up to 15.5.1 allows remote attackers with high privileges to execute arbitrary code via manipulation of the content argument in the AdminDesignAction.java JSP file handler. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure notification.

SSE field injection in eventsource-encoder below 1.0.2 allows an attacker who controls the `event` or `id` field values to inject line terminators into the serialized Server-Sent Events stream, forging additional SSE fields or entirely synthetic browser events. A working proof of concept is publicly documented in the GitHub Security Advisory GHSA-m9g3-3g99-mhpx, demonstrating that a crafted `event` value can cause the browser to receive a forged `admin`-typed event with attacker-chosen payload. No public exploit infrastructure has been identified and EPSS sits at the 1st percentile, reflecting the narrow application pattern required for exploitation.

Stored cross-site scripting in Grav admin panel allows authenticated attackers to inject malicious JavaScript into page titles via the data[header][title] parameter, which is then executed when other administrators access the affected page or its move function. The vulnerability requires admin authentication to inject the payload but affects all subsequent viewers, enabling session hijacking, credential theft, and administrative impersonation. Publicly available exploit code exists with working proof-of-concept screenshots.

n8n-MCP prior to version 2.47.13 logs sensitive credential material from authenticated MCP tool-call requests when running in HTTP transport mode, allowing disclosure of bearer tokens, OAuth credentials, API keys, and webhook authentication headers to any system with access to server logs. The vulnerability requires valid authentication (AUTH_TOKEN) and affects deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary; no public exploit code has been identified.

Arbitrary Perl code execution in cPanel and WP Squared via insufficient validation of the plugin parameter in the create_user plugin, allowing any authenticated user to execute arbitrary Perl code as their underlying system user account. Vendor-supplied CVSS 4.0 rates this Medium (5.3) with PR:L confirming authentication is required, while SSVC simultaneously rates Technical Impact as total - a notable discrepancy defenders should note. No public exploit has been identified and CISA has not added it to KEV; WebPros released patches across all affected branches on May 8, 2026.

Injection of arbitrary XML/HTML content in fast-xml-builder versions up to 1.1.5 allows unauthenticated remote attackers to break out of XML comments via three consecutive dashes (---), bypassing the regex-based sanitization fix for CVE-GHSA-gh4j-gqv2-49f6. Applications with the comment property enabled are at risk of XSS or malicious code injection in generated XML/HTML output when processing untrusted input. CVSS 6.1 with user interaction required; publicly available advisory but no confirmed POC.

Remote code execution in Dolibarr ERP/CRM versions ≤22.0.2 allows authenticated administrators to execute arbitrary PHP code by injecting malicious payloads into the 'computed value' field of user extrafields, which are passed unsanitized to PHP's eval() function. No vendor patch exists at time of analysis (zero-day status), but exploitation requires high-privilege administrator access, limiting immediate risk to environments with compromised admin accounts or malicious insiders. EPSS data unavailable; not listed in CISA KEV, indicating no confirmed widespread exploitation despite public technical disclosure.

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required.

Code injection in 1C-Bitrix (Bitrix Site Manager) through 25.100.500 lets an actor holding SOURCE/WRITE permissions on the Translate Module upload a PHP file together with a .htaccess file and have it executed by the web server, yielding arbitrary code execution on the host. Publicly available exploit code exists (karmainsecurity PoC), but there is no public exploit identified as actively used in attacks, and EPSS is very low at 0.02%. Notably, the vendor disputes this as a vulnerability, calling it intended behavior for high-privileged users who legitimately upload translated pages.

Authenticated PHP code execution in Netgate pfSense CE 2.7.2 arises when the module installer processes a backup file containing a serialized PHP object whose post_reboot_commands property is unserialized (CWE-502), causing attacker-defined commands to run after reboot. Exploitation requires an authenticated administrator (PR:H), and the vendor disputes the report because the installer is an admin-only feature that is intentionally permitted to execute PHP. Publicly available exploit code exists (SSVC exploitation: poc) via a Full Disclosure post, but there is no active-exploitation evidence and EPSS is negligible at 0.01%.

Authenticated code execution in Netgate pfSense CE 2.8.0 is claimed via the XMLRPC API method pfsense.exec_php, which runs attacker-supplied PHP on the firewall. Netgate publicly disputes this as a vulnerability because pfsense.exec_php is restricted to administrators, who are by design permitted to execute PHP, meaning the CVSS 9.9 rating reflects an intended admin capability rather than a privilege boundary being crossed. Publicly available exploit code exists (SSVC PoC), but EPSS is 0.01% and it is not in CISA KEV, indicating no observed active exploitation.

Remote code execution in Bitrix24 through version 25.100.300 allows authenticated users with SOURCE/WRITE permissions on the Translate Module to execute arbitrary PHP code by uploading malicious PHP and .htaccess files. The vulnerability exploits unrestricted file upload capability in a high-privilege context; while the vendor disputes this as intended behavior for administrative users, the low EPSS score (0.02%) and lack of evidence of active exploitation suggest this poses minimal real-world risk despite the moderate CVSS rating.

The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.

In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Remote code execution in FacturaScripts through authenticated file upload allows attackers with valid credentials to bypass MIME type validation by prepending GIF89a magic bytes to PHP files, resulting in executable files stored in a web-accessible directory. An attacker can upload a malicious PHP file disguised as a GIF image via the product image upload functionality, then directly execute arbitrary commands on the server. The vulnerability affects versions 2025.81 and earlier; publicly available proof-of-concept code exists demonstrating end-to-end exploitation.

Remote code execution in Hitachi Virtual Storage Platform G, F, E, and One Block series allows unauthenticated network attackers to execute arbitrary code on storage controllers and maintenance consoles with low impact across confidentiality, integrity, and availability due to changed scope (CVSS 8.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C). The vulnerability affects the Storage Navigator interface and maintenance console across multiple VSP product lines spanning enterprise and mid-range storage arrays. EPSS data not available; no evidence of active exploitation or public POC at time of analysis. Vendor-released patches available with specific firmware versions required for each product family.

DLL hijacking in ZTE Cloud PC client uSmartView allows unauthenticated local attackers to achieve arbitrary code execution and privilege escalation by planting a malicious DLL that is loaded by uSmartViewServiceAgent.exe running with SYSTEM privileges. The vulnerability requires local access but no authentication and affects multiple ZXCloud IRAI product versions. No public exploit code or active exploitation has been confirmed at this time.

ZTE Cloud PC client uSmartview contains an OpenSSL configuration file privilege escalation vulnerability (CVE-2026-40004) that allows authenticated local attackers with user-level privileges to execute arbitrary code and escalate to higher privilege levels through a malicious openssl.cnf file. This requires physical access or local system access combined with user interaction, and affects ZTE's virtualized desktop infrastructure product. The CVSS score of 5.5 reflects the physical attack vector and additional user interaction requirement, despite the severity of code execution and cross-system scope impact.

Denial of service in go-ipld-prime's DAG-CBOR and DAG-JSON decoders via unbounded recursion depth allows remote attackers to exhaust goroutine stack memory by sending deeply nested collection payloads, causing the Go runtime to terminate with a fatal stack overflow. A ~2 MB DAG-CBOR payload with 2 million nested arrays reliably triggers the condition. Affected versions before 0.23.0 have no depth limit; the existing allocation budget cannot prevent stack exhaustion because each nested header consumes only a few budget units.