Remote Code Execution

Code execution in camel-ai's CodeExecutionToolkit (versions 0.2.91a1, 0.2.91a2, and 0.2.91a3) lets remote, unauthenticated attackers run arbitrary Python through the SubprocessInterpreter with no approval or confirmation boundary. The attacker must be able to influence the agent's model output - for example via prompt or task injection - so that the LLM emits executable Python, and the host application must have opted into the code-execution toolkit and routed untrusted input to it; exposure is therefore conditional rather than default, which is reflected in the independent assessment's High attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) versus the vendor's 9.8 AV:N/AC:L rating. Risk weighting is tempered by a low EPSS of 0.22% (11th percentile), no CISA KEV listing, and no vendor-released patch identified at time of analysis, though a public GitHub issue and a third-party gist describing the flaw are referenced.

Remote code execution in AgentScope 1.0.18 and 1.0.19 allows remote attackers to execute arbitrary Python in the service environment: when a RealtimeAgent session has execute_python_code registered as an available tool, the agent's _acting path forwards a model-produced tool call straight to Toolkit.call_tool_function with no approval prompt and no sandbox boundary, so a remote WebSocket user who can reach the endpoint and steer the agent can obtain code execution with the service's privileges. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) no authentication is required, and the SSVC assessment records that publicly available exploit code exists (exploitation: poc), so the vulnerability is automatable with total technical impact; EPSS is low at 0.20% (9th percentile), indicating limited observed exploitation activity so far. Exploitation is conditional on the deployment exposing the execute_python_code tool in a RealtimeAgent session and on the WebSocket interface being network-reachable - instances that do not register that tool are not vulnerable via this path.

Authenticated attackers with administrator privileges can exploit a stack-based buffer overflow in the spamBlocker (spamd) service of WatchGuard Fireware OS by sending a specially crafted management request, causing a service crash or potentially achieving arbitrary code execution. The vulnerability requires the spamBlocker feature to be licensed and enabled, and the management plane to be reachable; exploitation is therefore limited to insiders, stolen admin credentials, or post-compromise scenarios. No public exploit code has been identified at the time of analysis.

Arbitrary code execution in WatchGuard Fireware OS is possible through its SAML single sign-on session daemon (samld), which deserializes session files it is asked to load without adequately validating their contents. The attacker must already be authenticated with high privileges (CVSS 4.0 vector PR:H) and must already be able to write files on the appliance, since the vector's AT:P metric and the description both indicate a required prior condition - this is a second-stage, post-foothold vulnerability rather than a standalone remote compromise. Exploitation yields code execution in the security context of the samld service, with high confidentiality, integrity and availability impact to that service but no demonstrated impact on subsequent systems (SC:N/SI:N/SA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis.

Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, allowing whoever controls the remote TLS VPN peer to push malicious configuration data that the connecting Firebox executes with root privileges, compromising the appliance's confidentiality, integrity, and availability (CVSS 3.1 base 9.2, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exposure is conditional rather than blanket internet-facing: the Firebox must be configured as a BOVPN Over TLS client and must actively initiate a session to an attacker-operated or attacker-compromised server, so a successful attack implies a malicious or hijacked peer relationship rather than an opportunistic scan-and-exploit against any Firebox. No credentials on the Firebox are required (PR:N) and no interactive user action is needed once the client connection is made; there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though the confirmed root-level impact on a perimeter security device justifies treating this as a high-priority patch item.

Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. Successful exploitation yields full compromise of the daemon's process context (high confidentiality, integrity, and availability impact per the assessed vector), with the process crash as the minimum outcome; no public exploit code has been identified at time of analysis and the flaw is not reported as confirmed actively exploited (CISA KEV).

Unauthenticated remote code execution affects ModelTC LightLLM through version 1.2.0 when it is run in a multimodal deployment configuration, which starts an embed-cache RPyC service bound to all network interfaces with pickle deserialization enabled. Because the service performs no authentication and accepts attacker-controlled serialized objects through its exposed cache methods, any remote party that can reach the RPyC port can execute arbitrary code with the privileges of the LightLLM service (CVSS 4.0 base score 9.3; AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact). Exposure is configuration-dependent: non-multimodal deployments do not start this service, and instances whose port is bound to loopback or blocked by firewall rules on the host or network are not remotely reachable. No public exploit code has been identified at time of analysis, and the issue has been reported publicly by VulnCheck (also tracked in the project's GitHub issue #1596), so the primary risk is rapid weaponization against internet-facing multimodal inference deployments that have not been patched or isolated.

Remote code execution in LightLLM through 1.2.0 allows unauthenticated attackers to run arbitrary code on the host when the server is launched with the --enable_profiling flag, because that flag starts a router profiler service that exposes an RPyC listener with pickle deserialization enabled and no authentication (CVSS 4.0 base 9.3; CWE-502). The flaw is not reachable in a default deployment since profiling must be explicitly enabled, but once it is on, any network-reachable attacker can push crafted serialized objects onto the profiler command queue and gain high-integrity, high-availability code execution without credentials or user interaction (PR:N/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently driven by the non-default profiling configuration and network reachability of the RPyC port rather than by active exploitation.

Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged software packages as authentic, because the boot-time 'stock done' routine disables OPKG signature verification before restoring optional packages from a writable, unsigned feed, and because the production private key whose public counterpart is trusted by both stable and beta builds ships inside the publicly distributed Lantronix SDK. An attacker who can deliver a malicious package onto the device's update/feed path and get it processed can execute arbitrary code with root privileges at install time, although the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) shows this is gated by attack requirements and passive user interaction rather than a one-shot unauthenticated remote compromise. No public exploit code, PoC, or confirmed in-the-wild exploitation was identified at the time of analysis, but the combination of an exposed trust anchor and a signature-verification bypass makes this a genuine high-impact integrity flaw rather than an inflated score.

Update metadata fetched over plain HTTP by Lantronix G520 series devices (reported against firmware 2.6.0.4R6 stable, covering G526, G526RP, G527 and G528 models) can be tampered with so that a stored value is later served by the management interface as JSON and rendered as raw HTML by the update-information web page, allowing attacker-controlled script to run in an authenticated administrator's browser. Because the same authenticated origin also exposes an interface that executes system-level commands with root privileges, an attacker who can inject metadata can escalate from script execution to arbitrary code execution in the device's administrative context. The vendor-assigned CVSS 4.0 base score is 7.7, but the attack is not opportunistic: it requires an on-path/adversary-in-the-middle position against the unencrypted update channel (AT:P) and an administrator who opens the affected page (UI:P), and no public exploit code or confirmed active exploitation was identified at time of analysis - the issue was reported through CISA's ICS coordination process (ICSA-26-272-01).

Command injection in the bash, zsh, and fish activation scripts generated by virtualenv releases prior to 21.7.13 lets a crafted virtual environment path or interpreter Tcl/Tk library path execute arbitrary commands with the privileges of any user who sources the activate script. The root cause is double quoting: values already escaped by shlex.quote are embedded inside an additional quoted context, so the surplus quotes terminate the data-only quoted run and leave shell metacharacters parsed as commands - reaching __VIRTUAL_ENV__ in bash/zsh when a relocated environment's recorded directory is absent, and __TCL_LIBRARY__/__TK_LIBRARY__ in fish. Exploitation requires attacker control of the affected path string plus the victim sourcing the script (CVSS 3.1 score 7.8, AV:L/AC:L/PR:N/UI:R, CWE-78 OS command injection); no public exploit identified at time of analysis, and the flaw is fixed in virtualenv 21.7.13 per PyPA advisory GHSA-p58f-9548-mpm2.

Unauthenticated remote code execution affects AltumCode 66Uptime deployments running a version before v54.0.0, and separately the bundled 66Uptime ping-servers plugin before v2.0.0, with the attack surface being the application's index.php entry point. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8 critical) describes a network-reachable flaw requiring no credentials, no user interaction, and no special privileges, and the CISA SSVC assessment rates the technical impact as total while classifying exploitation as proof-of-concept. Publicly available exploit code exists per the SSVC POC rating, though the flaw is not confirmed actively exploited (CISA KEV), and the practical exposure is tempered by the relatively small deployment base of this commercial uptime-monitoring script. A significant caveat applies: the only listed reference (a Glimmernet security advisory) frames the ping-servers plugin issue as server-side request forgery, which if accurate would narrow the impact to SSRF rather than full code execution for that component.

Path traversal in VLC media player's skins2 ThemeLoader (before 3.0.24) allows attackers to write arbitrary files with VLC user privileges by crafting a malicious .vlt skin archive, enabling code execution through Lua script injection. Exploitation requires the victim to run the non-default skins2 interface and open the malicious skin, so local user interaction and social engineering are needed. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score is 8.5 (assessed as CVSS 3.1 7.8 due to local attack vector and user interaction).

Sandbox escape in Google Chrome's WebView component on Android (versions prior to 154.0.8037.92) lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by serving a crafted HTML page to the victim. The flaw is a second-stage, chain-completing bug rather than a standalone remote-compromise vector: it requires an existing renderer-level foothold, high attack complexity, and victim user interaction, which is why CISA's SSVC assessment marks exploitation as 'none', automatability as 'no', and Chromium rates its own security severity as Low despite a 7.5 CVSS base score. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; a vendor patch is available in Chrome 154.0.8037.92.

Arbitrary code execution inside the renderer sandbox can be achieved by a remote attacker who lures a Google Chrome user, on any build prior to 154.0.8037.92, into loading a crafted HTML page that triggers a type confusion in the V8 JavaScript engine. No authentication or special privileges are required, but the victim must actively render attacker-controlled HTML/JavaScript (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), so exploitation is dependent on user interaction. Per the CISA SSVC evaluation exploitation is currently none and no public exploit code has been identified at time of analysis; the risk is driven instead by Chrome's enormous install base, the total technical impact rating, and the fact that any resulting code execution stays confined to the renderer sandbox - full host compromise would require chaining a separate sandbox-escape vulnerability. Google classifies the issue as High severity and a vendor patch is available.

A stack-based buffer overflow (CWE-121) in the V8 JavaScript engine allows remote code execution inside the renderer sandbox of Google Chrome builds prior to 154.0.8037.92 when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the target must open or be navigated to the attacker-controlled page - but no authentication or privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and the default browser configuration is sufficient. No public exploit code or active exploitation has been identified, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no'; the practical ceiling on impact is the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. All signals align on a genuine but not emergency-level browser RCE, and Google has shipped a vendor patch.

Sandbox escape via a use-after-free in Google Chrome's PictureInPicture component affects all versions prior to 154.0.8037.92 and can lead to arbitrary code execution outside the browser sandbox, but only as a second-stage primitive: the attacker must already have compromised Chrome's sandboxed renderer process and must convince a victim to render a crafted HTML page. Scored CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), the High AC:H value reflects that precondition, so this is realistically usable only as one link in an exploit chain rather than a standalone remote compromise. CISA's SSVC assessment records no exploitation activity and no public exploit code has been identified at time of analysis; the Chromium severity is High and a vendor patch is available.

An out-of-bounds write in the GPU process of Google Chrome prior to 154.0.8037.92 allows an attacker to break out of the browser sandbox and potentially execute arbitrary code at the browser's privilege level via a crafted HTML page. The attack is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed exploitation conditions indicate the attacker must have already compromised Chrome's renderer process, and the victim must load attacker-controlled content, making this a sandbox-escape link in a multi-stage exploit chain rather than a directly reachable remote bug. Only Chrome builds below 154.0.8037.92 are affected, and effective exploitation requires overcoming non-trivial memory-corruption and chaining conditions (AC:H); no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Google has released a vendor patch in Chrome 154.0.8037.92.

Use-after-free in Chrome's Views UI framework allows a remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox on any Chrome desktop build prior to 154.0.8037.92. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) confirms remote, unauthenticated attack with no special privileges, but also confirms that user interaction - social engineering to get the victim to load the page - is mandatory, which is the main limiting factor; the scope change (S:C) reflects that impact is not confined to the renderer. No public exploit was identified at the time of analysis and CISA's SSVC assessment rates exploitation as 'none' and not automatable, but a vendor patch is available from Google and the technical impact is total, making prompt updating the priority.

Use-after-free in Google Chrome's FullScreen implementation prior to 154.0.8037.92 allows a remote, unauthenticated attacker to execute arbitrary code outside the browser's renderer sandbox by enticing a victim to load a crafted HTML page. The vulnerability carries a CVSS 3.1 base score of 9.6 with scope change (S:C) and High confidentiality, integrity, and availability impact, reflecting that successful exploitation escapes the sandbox rather than being confined to a compromised renderer. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC Exploitation: none), and the attack is not automatable for mass exploitation because it requires the victim to visit attacker-controlled content (UI:R); Google has released a vendor patch in Chrome 154.0.8037.92.

Type confusion in V8, Chrome's JavaScript engine, allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation requires user interaction (CVSS PR:N/UI:R) - the target must navigate to attacker-controlled or compromised content - and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording Exploitation = none. Because V8 is the always-on JavaScript engine, any HTML/JS-rendering context is a viable trigger with no special configuration needed, but the resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability.

Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 154.0.8037.92 through a use-after-free in the Passwords component, which a remote attacker can trigger by convincing a victim to open a crafted HTML page. Because the CVSS vector is PR:N/UI:R, no authentication or special configuration is required, but the victim must actively navigate to the attacker's content and a successful chain must also defeat the sandbox, leaving full compromise achievable but non-trivial. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, while Google has released a vendor patch in Chrome 154.0.8037.92; the scope-change (S:C) rating reflects that a working exploit would escape the renderer boundary rather than remain confined to a single security context.

A use-after-free in Chrome's Views UI framework allows an unauthenticated remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox in Google Chrome desktop builds prior to 154.0.8037.92. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), no credentials or special browser configuration are required - default installations are affected - but exploitation depends on user interaction with attacker-controlled content and on overcoming the difficulty of turning a use-after-free into a reliable sandbox escape, so a working exploit is not trivial. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; a vendor patch (154.0.8037.92) is available, which makes rapid update the decisive control.

Type confusion in the V8 JavaScript engine in Google Chrome prior to 154.0.8037.92 lets remote attackers execute arbitrary code inside the renderer sandbox by luring a victim into opening a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction - the victim must render the attacker's page - and because V8 runs JavaScript on essentially every page, default desktop configurations are exposed. Impact is scored 8.8 High (C:H/I:H/A:H) with the important caveat that code execution is confined to the sandbox, so full host compromise requires chaining a separate sandbox-escape bug; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available as Chrome 154.0.8037.92.

Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the V8 sandbox when a victim loads a crafted HTML page in any Chrome build prior to 154.0.8037.92. Exploitation requires user interaction (the victim must browse to the malicious or compromised page) but no authentication or special configuration, since default JavaScript execution is sufficient; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google has released a vendor patch in 154.0.8037.92, and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) has been identified. Because the flaw is contained by the V8 sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability.

Remote code execution outside the browser sandbox can potentially be achieved by an unauthenticated attacker in Google Chrome versions prior to 154.0.8037.92 by exploiting a use-after-free in the Bluetooth subsystem. The victim must navigate to a crafted HTML page that exercises the Web Bluetooth code path (UI:R), and successful exploitation can lead to arbitrary code execution with a scope change (S:C), meaning a sandbox escape. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in Chrome 154.0.8037.92.

Type confusion in the V8 JavaScript engine allows remote code execution inside the Chrome renderer sandbox on any unpatched build prior to 154.0.8037.92. Because the flaw is triggered by a crafted HTML page, the attacker needs only to convince a victim to visit it - no credentials or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8, Chromium severity High) - and exploitation works against default configurations with JavaScript enabled. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape bug; exploitability is high but not trivially mass-exploitable. No public exploit was identified at time of analysis, and our assessment rates this as a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. Vendor-released patch: 154.0.8037.92.

Sandbox escape in Google Chrome on Windows prior to 154.0.8037.92 allows a local attacker to execute arbitrary code outside the browser sandbox through improper privilege management in the Mojo IPC layer. Exploitation requires local access to a Windows host and some user interaction (UI:R) but no authentication (PR:N), and it functions as a second-stage capability: an attacker who already holds a sandboxed foothold, such as a compromised renderer, can leverage the flaw to reach the full privileges of the browser process, yielding high confidentiality, integrity, and availability impact with a scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS-style risk signal is low; non-Windows Chrome builds are unaffected because the defect is Windows-specific. A vendor patch is available in Chrome 154.0.8037.92.

Remote code execution is possible in Google Chrome on Android builds prior to 154.0.8037.92, where a heap-based buffer overflow in the ANGLE graphics layer can be triggered when a user renders a crafted HTML page. Successful exploitation corrupts memory out of bounds and, per Google's Critical severity rating and the scope-changed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), can potentially execute arbitrary code outside the browser sandbox. The issue is remotely deliverable without authentication but hinges on user interaction, and no public exploit code or active exploitation has been identified at time of analysis; CISA's SSVC assessment likewise records no observed exploitation and rates the flaw non-automatable, while a vendor patch (154.0.8037.92) is available.

Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be circumvented by an unauthenticated attacker who is adjacent to the device, resulting in a complete bypass of security restrictions and potentially remote code execution with elevated privileges. Exploitation requires only network adjacency - an associated Wi-Fi client, guest-network user, or any host on the same Layer 2 segment - with no credentials, no user interaction, and low attack complexity, which is why the CVSS 3.1 score reaches 9.6. No public exploit code and no confirmed active exploitation were identified at time of analysis, and devices already updated beyond firmware 3.4.1.0 are not affected.

Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can trigger a buffer overflow in an exposed interface and execute arbitrary commands on the device's underlying operating system. Firmware versions at or below 3.4.1.0 are affected, including default configurations, and the CVSS 3.1 base score of 9.6 reflects a scope change (S:C) from the network-facing interface to the AP operating system, with high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) is the primary limiting factor, confining realistic attackers to associated Wi-Fi clients, hosts on the local LAN, or anyone with physical proximity; no public exploit code and no CISA KEV entry were identified in the provided data, and no EPSS score was supplied, so exploitation is not confirmed as active at time of analysis.

Unauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version 3.4.1.0 and earlier, due to uncontrolled format string handling in an exposed interface of the device. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), an attacker who can reach that interface over the network needs no credentials and no user interaction, and successful exploitation can run arbitrary commands on the underlying host, causing denial of service or full compromise. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the low attack complexity and default-configuration reachability make it a genuine high-priority exposure for any Instant On AP whose vulnerable interface is accessible from an untrusted segment.

Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can reach the device's affected network interface to exploit a buffer overflow and execute arbitrary code as a privileged user on the underlying host (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but exploitation requires only network reachability to the exposed interface, so internet-facing or unsegmented Instant On access points and switches carry the greatest exposure. HPE has addressed the flaw in firmware versions above 3.4.1.0.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw in its archive extraction routine that lets a remote attacker with a valid authenticated account write files outside the intended destination directory and ultimately execute arbitrary code with the privileges of the affected service (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). The root cause is CWE-22 improper limitation of a pathname to a restricted directory, commonly known as an archive 'zip-slip' condition, where crafted entries in an uploaded archive escape the extraction root. Authentication is mandatory, so this is not an unauthenticated flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated in enterprise Cloud Pak for Data deployments where the attacker already holds platform credentials or a foothold.

Arbitrary PHP code execution on the scanning host is possible with PHPCSUtils versions 1.0.0-alpha1 through 1.2.2, because the abstract sniff helper AbstractArrayDeclarationSniff::getActualArrayKey() resolves array-key values through eval() instead of a safe parser. Exploitation requires a host to run PHP_CodeSniffer over attacker-supplied PHP source with a sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey() - most notably PHPCSExtra's Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes - which is exactly the situation in CI pipelines that lint untrusted pull requests or on developer machines reviewing third-party code; the crafted key 'system'('id') is evaluated during the scan. The CVSS 3.1 vector scores this 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating no privileges are required but that the vector is local and needs a person or pipeline to actively invoke the scan; no public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.2.3.

Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor submit a crafted public form that results in attacker-controlled PHP being evaluated server-side. The root cause is that the extension substitutes form-field shortcodes with the raw value submitted by the visitor before passing administrator-defined 'PHP after submission' code to eval(), allowing a value to break out of a double-quoted PHP string. Exploitation is conditional, not blanket: it requires an administrator to have enabled the optional PHP-after-submission action and to have interpolated an attacker-controllable field shortcode inside a double-quoted string, a non-default configuration reflected as AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CPE string was supplied; the vendor scores this 9.5 (critical) whereas our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Unauthenticated remote code execution in Open GenAI Stack (ogx-ai, 2026-06-11 build) lets any attacker who can submit a prompt to an affected endpoint execute arbitrary server-side code, because prompt content is rendered as an unsanitized Jinja2 template (CWE-94, classic server-side template injection). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), with no authentication, user-interaction, or non-default-configuration prerequisite, so exploitation reduces to reaching the vulnerable template-rendering path. No public exploit code has been identified at time of analysis, and the widely repeated claim that this stack underpins the Meta AI backend for WhatsApp is unconfirmed by any vendor advisory. Real-world risk is bounded by deployment scope: only systems actually running the vulnerable ogx-ai prompt-to-template path are exposed.

TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.

Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.

Heap-based buffer overflow in CTranslate2 before 4.8.1 allows an attacker to cause a crash or potentially achieve arbitrary code execution by supplying a malicious binary model file (.bin) that is loaded by the victim. The flaw is in the binary model loader, which fails to validate the payload length against the allocated buffer size (CWE-787). Exploitation requires the victim to actively load an untrusted model, making it a local, user-interaction-dependent issue rather than a remotely reachable network threat. No public exploit has been identified at time of analysis. The CVSS score is 8.5.

Remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allows an unauthenticated, remote attacker to execute code or tamper with/disclose information on affected appliances by exploiting a missing integrity check on code the product downloads, affecting versions prior to 5.34.00.16 and prior to 5.36. Realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position or a spoofed/compromised download source - which is why our assessment adjusts the vendor's 9.8 score to AC:H while retaining PR:N and UI:N. A vendor patch is available (5.36.00.16; 5.34.00.16 for the 5.34 branch), and there is no evidence of active exploitation or public exploit code; EPSS is 0.11% (1st percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no'.

Unauthenticated arbitrary file write in the mypresta Google Merchant Center Feed (gmfeed) module for PrestaShop lets remote attackers control the output filename, path, extension, and content written by the feed.php endpoint, enabling them to drop a PHP file and execute it for remote code execution. The flaw carries a CVSS 4.0 base score of 9.3 (independent assessment: CVSS 3.1 9.3, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting no authentication, no user interaction, and full confidentiality, integrity, and availability impact. It affects only PrestaShop stores running this third-party module below version 2.3.9, which is the vendor-fixed release; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, though the trivial unauthenticated exploitation path makes rapid patching advisable.

Local privilege escalation in Ghostscript for Windows (all versions prior to 10.08.0) allows any authenticated local user to plant a malicious PostScript resource file in the predictable C:\gs\ path, which Ghostscript then auto-loads with the privileges of whichever principal next invokes it. The hijack requires no special Ghostscript configuration because it abuses Windows default ACLs that let authenticated users create directories at the root of C:\, and it succeeds only while C:\gs\ is unpopulated - the default state on Windows installations; execution is passive and fires when a user or service subsequently runs Ghostscript, with the payload's privilege gain bounded by that invoking principal (assessed as scope-changed impact). No public exploit code has been identified at time of analysis, and the issue, reported by CERT-PL, is fixed in 10.08.0.

Arbitrary code execution in Das U-Boot allows an unauthenticated attacker on the adjacent network segment to hijack the bootloader by replaying duplicated last-fragment IPv4 packets against stale IP reassembly state. Only builds compiled with the non-default CONFIG_IP_DEFRAG=y option and actively using U-Boot's network stack (for example TFTP or PXE netboot) are exposed, and the attacker must hit the narrow boot-time window while the bootloader is running, so the practical attack surface is narrower than the CVSS 9.0 base score implies. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; the vendor has released a fix in version 2026.07 (commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa).

Path traversal in Wireshark's configuration-profile import handler (CWE-22) allows a maliciously crafted profile to write files outside the intended profile directory, crashing the application and potentially achieving code execution in the user's context. Affected releases are Wireshark 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8; the flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) and requires the victim to manually import the attacker-supplied profile, so exploitation depends on social engineering rather than a network-facing or automatic trigger. Publicly available exploit code exists and the issue is tracked as wnpa-sec-2026-106, but it is not confirmed as actively exploited (CISA KEV) and EPSS is low at 0.19% (7th percentile), making this a moderate-priority issue rather than an emergency; patched releases 4.4.19 and 4.6.9 are available from the vendor.

Authenticated remote code execution in Octopus Server allows any user whose role grants permission to edit an Environment or a Project to store specifically crafted JSON on that object, which the server then deserializes insecurely and executes as arbitrary code inside the Octopus Server process. Exploitation requires a valid account and that specific edit permission but no user interaction and no non-default configuration, and it delivers full loss of confidentiality, integrity, and availability to the deployment platform; the practical threat comes from malicious insiders, over-provisioned users, or attackers who have already compromised an account holding Environment/Project edit rights. No public exploit code has been identified at time of analysis, and the vendor has published advisory SA2026-10 covering the issue.

Authenticated code injection in Dassault Systèmes GEOVIA Geospatial Data Manager allows a low-privilege user with a valid session to execute arbitrary code on the server, and the changed-scope metric means the compromised component can be leveraged to affect other parts of the hosting 3DEXPERIENCE environment. The flaw carries a 9.9 CVSS score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects GEOVIA Geospatial Data Manager deployed on 3DEXPERIENCE R2024x through R2026x up to the listed FP.CFA build levels; no user interaction is required beyond the attacker's own authenticated access. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical exposure is gated by the requirement for a valid low-privilege account and by the product's narrow mining and geospatial deployment footprint.

Unauthenticated remote code execution affects metatool-ai MetaMCP through version 2.4.22 via the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio, where request-controlled input reaches process spawning in the STDIO branch of createTransport (routers/mcp-proxy/server.ts). The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, unauthenticated attacker can achieve total confidentiality, integrity, and availability impact with no user interaction, and CISA's SSVC assessment rates the flaw automatable with total technical impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the practical risk depends primarily on whether the inspector proxy endpoint is exposed beyond localhost in a given deployment.

Unauthenticated local privilege abuse in the Kilo Code CLI (versions before v7.4.1) lets any local process or user that can reach the daemon/TUI loopback HTTP listener toggle the '/permission/allow-everything' permission mode and then drive the agent into executing arbitrary code on the host. The issue combines two weaknesses: the daemon shipped a hardcoded default Basic-auth password of 'kilo', and the permission-toggle route was exempted from authentication whenever global auth was optional, so no credentials were required at all (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4, CWE-280). Exploitation is not network-remote: it requires the daemon/TUI HTTP server to be running and the attacker to already have local reach to its loopback port, so it is access-gated rather than an internet-facing crisis; no public exploit code was identified at time of analysis, CISA SSVC records Exploitation as 'none' with Automatable 'no', and no EPSS score was supplied.

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.

Authenticated remote code execution in the FreePBX Superfecta module (FreePBX prior to 16.0.40 and 17.0.7) allows a user holding valid credentials with a known username to make the module's AJAX handler dynamically include attacker-influenced PHP files from its sources/ directory, executing arbitrary PHP with the privileges of the web server user. Exploitation is remote and low-complexity from the attacker's side (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, score 8.6), but our assessment notes the inclusion flaw alone is not sufficient: per the GitHub advisory (GHSA-j53p-5m8r-j3p6) the attacker must chain it with arbitrary directory creation via the backup module and a path-revealing file upload via the soundlang module, so the Superfecta, backup, and soundlang modules must all be present and a valid login is mandatory (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor-released patches are available in versions 16.0.40 and 17.0.7, making this a high-priority fix rather than an internet-facing emergency, particularly for systems with the affected modules exposed to untrusted users.

Authenticated users holding backup or restore privileges on affected FreePBX deployments can achieve remote code execution through the backup Module on versions prior to 16.0.72 and 17.0.7. Improper path sanitization during backup restore lets a crafted archive place attacker-controlled PHP files directly into the web root, where the FreePBX web server will execute them, giving the attacker full control of the host and, by extension, the underlying Asterisk telephony platform (CVSS:4.0 8.6; independent assessment scores CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact). Exploitation is not pre-authentication: it requires a valid account with sufficient access permissions and/or write access to backup files plus network reachability of the FreePBX administration interface, and no public exploit code has been identified at time of analysis. This is a high-priority issue for internet-exposed or broadly permissioned FreePBX instances rather than a drop-everything emergency, since the primary attack surface is a privileged administrative workflow.

Authenticated remote code execution in FreePBX (versions prior to 16.0.10 and 17.0.5) lets an attacker who possesses a valid, known username abuse the sound-language upload and conversion workflow to write arbitrary files, including malicious PHP, into the web server's document root. The root cause is a path-traversal weakness (CWE-22) in the conversion step where path sanitization is insufficient, and successful exploitation gives full confidentiality, integrity and availability impact on the PBX host (vendor CVSS v4.0 8.7; independent assessment CVSS v3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so authentication - not user interaction - is the gate). No CISA KEV entry and no public exploit code were identified at time of analysis, meaning this is a high-severity, patch-now issue for PBX administrators rather than a mass-exploitation emergency; practical risk concentrates where FreePBX administrative panels are internet-facing or protected by weak or default operator credentials, and is reduced where the panel is network-segmented.

Authorization bypass in Apache Karaf before 4.4.12 allows an authenticated JMX client holding any role - including the least-privileged 'viewer' - to evade RBAC and achieve remote code execution inside the Karaf JVM. Karaf's MBeanServer guard never checks the lifecycle operations createMBean, registerMBean and unregisterMBean, so a caller can instantiate and register the standard javax.management.loading.MLet class and then invoke its getMBeansFromURL operation, which the shipped default 'get* = viewer' ACL wildcard inadvertently authorizes, causing attacker-hosted classes to be fetched and loaded as new MBeans. Exploitation requires network reachability to the default-enabled remote JMX RMI connector on ports 1099/44444, a valid JMX credential of any role, and outbound network access to the attacker's .mlet host; no public exploit code and no active exploitation were identified at time of analysis, and the issue is rated important by the vendor while the independent assessment places it at high impact across confidentiality, integrity and availability.

Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to resolve file writes outside the intended output directory, because the default decompress(input, output) API relies on lexical path containment checks that the kernel's symlink resolution can bypass. This affects @xhmikosr/decompress before 10.2.2 and before 11.1.4, and the separately maintained but unmaintained kevva/decompress package through 4.2.1, which remains unpatched. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) indicates unauthenticated remote triggering with high confidentiality and integrity impact; writing outside output can overwrite startup scripts or configuration and escalate to remote code execution, and the flaw is a bypass of the incomplete hardening previously applied for CVE-2026-53486. Exploitation requires the consuming application to extract an attacker-influenced archive on a non-Windows platform (Windows emulates symlinks via hardlinks and does not follow the affected path), and no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that documents the escape technique.

Arbitrary code execution on an operator's workstation is achievable through kube-compare when it processes a 'container://' reference path pointing at an untrusted container image, because the tool launches that image's entrypoint instead of only reading data out of a stopped container. Exploitation is locally scoped and gated: per the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, an unauthenticated (PR:N) attacker must convince the operator to invoke the tool against the malicious reference (UI:R), so the victim's own action is the trigger. This is a genuine but conditionally-gated risk - escalation to full root-mediated impact occurs only where the local Docker daemon runs with elevated privileges - and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; EPSS data was not supplied. The tool is distributed in Red Hat OpenShift Container Platform 4 and the 'Pen Drive Powered by Red Hat Lightspeed' offering.

Privilege escalation to remote code execution in Apache Karaf before 4.4.12 lets any authenticated shell session - including one holding only the viewer role - execute every jdbc:* and jms:* command, because the command guard (SecuredSessionFactoryImpl) treats commands with no matching ACL rule as permitted and the jdbc/jms ACL configuration files are never shipped. An attacker can use jdbc:ds-create to store a fully controlled JDBC URL into a pax-jdbc-config factory Configuration that is reactively turned into a live DataSource; drivers that act on URL parameters at connect time (for example H2 with INIT=RUNSCRIPT) then execute attacker code, bypassing the admin-role gate that protects shell:exec. No public exploit code identified at time of analysis, EPSS is low at 0.19% (8th percentile), and no CISA KEV listing applies; vendor-released patch: 4.4.12.

Unauthenticated remote code execution affects all versions of SailPoint IdentityIQ through improper input validation in its web service API. Attackers on an adjacent network segment can submit crafted content to the API to execute arbitrary code on the server without authentication or user interaction. The vendor rates this as critical (CVSS 9.6); no public exploit code has been identified as of this analysis.

Loading a malicious model into Unsloth Zoo 2025.9.9 through 2026.8.13 (as shipped in Unsloth 2025.9.9 through 2026.8.19) lets that model's config.json run arbitrary Python in the loading user's process, because a nested model_type value containing a newline escapes into an exec()-generated import statement. Exploitation requires the victim to load an attacker-controlled model for training or inference - a user-interaction gate, but no authentication on the attacker side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; vendor score 8.6). No public exploit code has been identified at time of analysis, and the practical exposure is concentrated in pipelines that automatically ingest third-party or user-supplied models from public hubs rather than those loading only vetted first-party checkpoints.

Missing authorization in WarehousePG (WHPG) 7.x before 7.6.0-WHPG lets any authenticated database role - with no superuser rights, no GRANT, and no special role membership - call the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink and pg_logdir_ls, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived _v1_1 implementations during the merge onto a PostgreSQL 12 base. An attacker holding ordinary database credentials can therefore create, append to, overwrite, rename and delete files under the data and log directories and enumerate log file names, and by appending directives such as shared_preload_libraries or archive_command to postgresql.auto.conf can achieve arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected because its equivalent functions enforce an internal superuser check, and no public exploit code has been identified at time of analysis (no CISA KEV entry).

Code injection in Innotim Logsign SIEM versions 6.4.101 through 6.4.117 exposes network-reachable deployments to full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 8.8 and the CVE's CWE-94 classification. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation requires a valid low-privilege authenticated account on the SIEM instance, needs no user interaction, and can be carried out with low complexity - an anonymous attacker cannot trigger it without first obtaining credentials, and the risk is confined to the stated version window. No public exploit code or confirmed active exploitation was identified at time of analysis, and the specific vulnerable feature or endpoint is not disclosed in the available advisory data.

Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.

Arbitrary code execution in Google Cloud Application Integration (versions prior to 2026-06-28) allows an authenticated user holding only standard permissions to run code on shared, multi-tenant production servers by crafting a JavaScript Task script that bypasses the platform's built-in parameter guards and reaches an unsafe deserialization path. The CVSS 4.0 base score is 9.4, and because the flaw breaches the tenant trust boundary the subsequent-system metrics are also High, meaning other customers on the same shared infrastructure are exposed rather than just the attacker's own tenant. Authentication is required (CVSS vector PR:L), there is no public exploit identified at time of analysis, and Google remediated the issue entirely server-side on 28 June 2026, so no customer action is needed and the vulnerability is no longer exploitable against the managed service.

Authenticated PowerShell command injection in ManageEngine DDI Central (versions below 6201) allows a low-privileged user to achieve remote code execution by embedding malicious content in DNS SPF/TXT records that the product pushes to a managed Windows DNS server. The flaw is network-reachable and low-complexity (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring only a valid low-privilege account and an active Windows DNS integration; no user interaction is needed once the poisoned record is pushed. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.

Command injection in the Windows DNS Query Resolution Policy name field of ManageEngine DDI Central versions below 6201 enables an authenticated high-privilege administrator to run arbitrary operating-system commands, resulting in remote code execution on the DDI Central host. The CVSS 3.1 vector (7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity attack that nonetheless requires privileged console access and the ability to create or edit a Windows DNS Query Resolution Policy, and no public exploit has been identified at time of analysis. The vulnerability is fixed in version 6201, so affected deployments that manage Windows DNS should be prioritized for upgrade, especially since a successful exploit yields full confidentiality, integrity, and availability impact on the compromised server.

Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) can be driven by an unauthenticated remote attacker to achieve remote code execution or cause a denial-of-service condition. Per the available CVSS 4.0 vector the attack is network-reachable with no privileges or user interaction required, but Attack Complexity is High, meaning the attacker must first satisfy a specific, non-default precondition or timing/state condition rather than issuing a single trivial request. The vendor assigns a 9.5 base score with high impact to both the vulnerable appliance and subsequent systems; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the underlying weakness class was not disclosed (CWE: N/A).

Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding FIPS and NDcPP builds) and NetScaler Gateway (before 14.1-73.37 and before 13.1-64.23) lets a network-reachable attacker with no credentials and no user interaction run arbitrary commands on the appliance. Both our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and the vendor's CVSS 4.0 score of 9.5 agree on high confidentiality, integrity, and availability impact, with the CVSS 4.0 AT:P flag indicating that a specific attack precondition must hold before the flawed input-validation path is reachable. No public exploit code has been identified at time of analysis, but this is a genuine top-priority vulnerability rather than a high-CVSS/low-real-risk case, because the only other barrier is having a vulnerable, network-exposed ADC or Gateway instance, and exposure is highest where the management or VPN virtual server is internet-facing.

Malcure Malware Shield (Removal, Repair, Monitor) before 19.9.7 fails to enforce an authorization check on an AJAX action, allowing an authenticated subsite administrator on a WordPress multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution. The vulnerability requires a multisite installation and an existing privileged account (CVSS PR:H); it is not exploitable on single-site installs or by unauthenticated users, and SSVC records Automatable:no. Publicly available exploit code exists, but no active exploitation is confirmed (CISA KEV absent; SSVC Exploitation:none), and EPSS is low at 0.18% (7th percentile).

Stored code injection in the Ad Inserter WordPress plugin before 2.8.19 allows an authenticated user with a role as low as subscriber to save content that the plugin then executes as PHP or serves unescaped to site visitors, because one of the plugin's settings pages is not access-restricted and the data written there is not filtered. Exploitation is conditional rather than trivial: the threat actor needs a low-privileged account (easy on sites with open registration) and the site must be running a configuration in which the plugin's own settings make that page reachable by every logged-in user, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with total technical impact. Publicly available exploit code exists, but the EPSS score is only 0.15% (4th percentile), there is no CISA KEV listing, and independent review characterises this as a real-but-conditional priority rather than an emergency.

Python eval()-based remote code execution in Heym (heymrun/heym) before 0.0.53 lets an authenticated user who can edit a workflow branch or condition node - or a victim who imports a workflow template containing a malicious condition node - run arbitrary Python as the backend process user whenever the workflow executes. The same release bundles four further flaws: fail-open Slack and Telegram webhook verification that allows unauthenticated workflow triggering with the owner's credentials when a trigger node has no credentialId or an empty signing secret, an OAuth redirect_uri scheme-validation gap that permits javascript:/data: URIs and script execution in the Heym origin, and plaintext storage of WorkflowExecutionToken, PortalSession, HITLRequest.public_token and OAuthAuthorizationCode values. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the 0.0.x pre-release product has a very small deployment base.

Sandbox escape in the heym workflow platform before 0.0.91 allows an authenticated user who can author or edit workflow expressions to execute arbitrary Python and run operating-system commands as the backend process. The flaw lives in the expression engine's DotList map/filter item expressions and its fallback resolver, which fail to block dunder attribute traversal, letting an attacker chain attributes to reach functions such as os.system. Exploitation requires a valid account with workflow-authoring rights (PR:L) but no user interaction, making this a network-reachable, low-complexity compromise of confidentiality, integrity, and availability; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.

Authenticated code injection in AzuraCast 0.23.3 and earlier lets a user holding StationPermissions::Media or StationPermissions::Profile plant Liquidsoap interpolation sequences (#{...}) into playlist remote URLs or station metadata fields, which the ConfigWriter::cleanUpString() helper writes unsanitized into the generated .liq configuration. When the affected station's Liquidsoap backend is next restarted and re-parses that config, the embedded #{process.run(...)} expression is evaluated and executes arbitrary shell commands as the azuracast service user. Exploitation is not confirmed in the wild (no CISA KEV listing), but the vendor advisory publishes proof-of-concept payloads for both the Media-permission and Profile-permission paths; the trigger is delayed and interaction-dependent, requiring a station restart after the malicious value is saved.

Code injection in AzuraCast through 0.23.5 lets an authenticated user holding the RemoteRelays station permission inject nested Liquidsoap interpolation syntax (for example #{#{EXPR}}) into the remote relay password field, achieving arbitrary code execution inside the Liquidsoap process, disclosing internal API keys, or disrupting station operation. The root cause is an incomplete migration in ConfigWriter.php from the vulnerable cleanUpString() sanitizer to the safe toRawString() helper; a prior commit (ff49ef4) migrated host, username, mount, name, description, genre, and URL fields but left the password field behind. No public exploit identified at time of analysis, and exploitation is gated by the RemoteRelays privilege (PR:L) and by the station's Liquidsoap configuration being regenerated and loaded.

Deserialization of untrusted data in MONAI's auto3dseg utility (monai/auto3dseg/utils.py) allows arbitrary code execution when algo_from_pickle() is called on an attacker-supplied .pkl file: the function reads the raw file bytes and hands them to pickle.loads() without any source or content validation, so any object defining __reduce__ runs in the victim application's context. Exploitation is conditional rather than remote-against-a-service: an attacker must first deliver a malicious pickle (model exchange, shared storage, or a pipeline input) and the victim's code must invoke this specific function, and per the authoritative assessment the vector is local with user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rather than unauthenticated network exploitation. A working proof-of-concept is documented in the upstream GitHub advisory GHSA-89gg-p5r5-q6r4 (publicly available exploit code exists), but there is no confirmed active exploitation (CISA KEV).

Arbitrary code execution in MONAI versions prior to 1.6.0 occurs when a crafted .npy or .npz file is loaded through the NumpyReader class, which hardcodes numpy.load with allow_pickle=True. An unauthenticated attacker who can place a malicious file on a path the victim opens can trigger pickle deserialization, leading to full compromise of confidentiality, integrity, and availability. Exploitation requires user interaction (the victim must load the file) and the attack vector is local; no public exploit code has been identified at time of analysis.

Deserialization of attacker-controlled pickle data in MONAI's Auto3DSeg module (monai/auto3dseg/utils.py) lets code run inside any process that calls algo_from_pickle() on a file the attacker can supply or substitute, with full read/write/execute impact on that process and its data. Versions before 1.6.0 are affected (pip package monai < 1.6.0, CPE cpe:2.3:a:project-monai:monai); the vulnerable pickle.loads() at line 321 fires before any isinstance or key checks, so no special configuration flag is needed to reach the sink. The exposure is conditional rather than remote: the vector is local (AV:L) with passive user interaction (UI:P) - a victim, typically a medical-imaging or ML pipeline exchanging algorithm bundles or model checkpoints, must load the crafted .pkl file, and no authentication is required on the loading side (PR:N) - scored 8.5. There is no evidence of confirmed active exploitation (no CISA KEV entry), but publicly available exploit code exists: the upstream advisory ships a working proof-of-concept, and users who upgraded to v1.5.2 believing GHSA-89gg-p5r5-q6r4 fixed this remain fully vulnerable because that earlier patch was never actually implemented in the code.

MONAI through 1.6.0 lets a user who can supply or tamper with a bundle's metadata achieve code execution by abusing an eval()-based sandbox in _get_fake_spatial_shape() (monai/bundle/scripts.py). The vulnerable function screens shape expressions with a helper that walks the AST and only rejects ast.Name nodes outside the 'p'/'n' allowlist, so payloads assembled purely from constants and attribute, subscript, or call nodes - such as "(1).__class__.__bases__[0].__subclasses__()" - pass validation and then reach eval(), enabling object-introspection chains that escape to arbitrary code execution. The path is reachable through the non-default bundle 'verify_net_in_out' CLI verification flow (_get_real_input_data / verify_net_in_out), so exploitation is limited to authenticated local users (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, CVA:H) who run that verification on an untrusted or modified bundle; default MONAI workflows that never verify untrusted bundles are not exposed, and no public exploit code was identified at time of analysis.

Local code execution in MONAI 1.6.0 and all released versions allows an authenticated low-privileged local attacker to run arbitrary code as another user by writing a malicious pickle file to a shared or world-writable MONAI cache directory (e.g., /tmp/monai_cache, HPC scratch, ~/.cache/monai). The victim must subsequently run a PersistentDataset pipeline that caches MetaTensors (the default in MONAI >= 1.0), which forces torch.load(weights_only=False) and pickle.loads on the poisoned file. No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis.

MONAI through 1.6.0 will execute arbitrary code in the victim's process when it loads an attacker-supplied bundle, because the bundle configuration engine resolves '_target_' values to any importable callable without an allow list and passes '$' expressions straight to Python's eval(). An attacker who publishes or shares a crafted bundle achieves code execution as soon as an operator calls monai.bundle.load() or monai.bundle.run() on it; no credentials are required against the victim (PR:N), but the attack does depend on user interaction (UI:R) since the operator must obtain and load an untrusted bundle, and the payload runs with the privileges of the loading process. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the primary exposure is to environments that pull third-party or community-contributed MONAI bundles rather than first-party trusted ones.

Host-controlled AML injection in Edgeless Systems' Contrast confidential-computing runtime before 1.18.0 lets an adversary who controls the QEMU host achieve arbitrary code execution inside AMD SEV-SNP guest VMs, including reads and writes to private memory pages that the confidential-computing model is supposed to shield. Only the Metal-QEMU-SNP and Metal-QEMU-SNP-GPU platforms are affected; Metal-QEMU-TDX is not, because OVMF measures ACPI table contents into RTMR 0 on Intel TDX. The flaw is rated CVSS 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) via the host-to-guest trust boundary, carries no CISA KEV status and no public exploit code identified at time of analysis, and is fixed in Contrast 1.18.0, which sandboxes the kernel AML interpreter; the underlying BadAML technique is publicly documented in academic and Black Hat EU 2024 research, and the weakness is generic to Confidential Computing deployments that expose the ACPI interface to the host.

Sandbox escape leading to arbitrary host code execution in vm2 (the npm sandbox library, CPE cpe:2.3:a:patriksimek:vm2) affects all versions before 3.12.2 when NodeVM is configured with a custom `require.external` resolver and `context: 'host'`. Because the resolver records the allowed module directory as an unanchored prefix pattern, untrusted guest code can require an allowlisted package (e.g. `foo`) and then require a non-allowlisted sibling sharing that prefix (e.g. `node_modules/foo2/index.js`), whose top-level code is loaded via `hostRequire` in the host process before `vm.readonly` wrapping, yielding code execution outside the sandbox. Exploitation requires the non-default host-passthrough external-resolver deployment plus a prefix-sharing sibling package, but needs no authentication or user interaction (CVSS:4.0 9.5, AT:P/PR:N/UI:N; assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); no public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though the vendor has published patched commits and version 3.12.2.

Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.

Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a high-privilege administrator to execute arbitrary PHP code and system commands on the underlying server. The flaw requires a valid Joomla administrator account (PR:H) and is remotely exploitable without user interaction, but no public exploit code or active exploitation has been identified at time of analysis. Because the plugin is a narrowly deployed third-party extension and no vendor patch is available, the real-world priority is low despite the critical CVSS score (9.4), with mitigation limited to removing the plugin or tightly restricting administrative access.

Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.

Remote code execution via arbitrary file write affects Budibase Server versions before 3.45.0. An authenticated attacker holding the BUILDER role can upload a crafted ZIP to the PWA icon upload endpoint that exploits missing symlink validation during extraction, using leaf symlink entries followed by duplicate file entries to overwrite arbitrary files as root. This allows root-level code execution; no public exploit code has been identified at time of analysis, and the vulnerability is not reported as actively exploited.

SiYuan versions up to and including 3.8.3 contain an authentication bypass allowing a remote attacker to execute arbitrary script in the SiYuan origin and invoke administrator APIs by tricking a victim into visiting a malicious web page. The vulnerability is unauthenticated (CVSS PR:N) but requires user interaction (UI:P); password-protected instances are only affected if the victim has a live session. No public exploit code was identified at the time of analysis, and the issue is fixed in version 3.8.4.

Stored cross-site scripting in SiYuan Note before v3.8.4 lets attacker-supplied flashcard block content run script inside the desktop client's privileged Electron renderer, which is created with nodeIntegration enabled and contextIsolation disabled, escalating the XSS to arbitrary code execution on the host. Per the independent assessment, exploitation is meaningfully gated: it requires the SiYuan desktop Electron client, an authenticated administrator account (the /api/riff/getRiffCards endpoint keeps its auth and admin-role checks), attacker-controlled flashcard content already planted in the workspace via import, contribution, or shared/synced documents, and the administrator actively opening the card manager view - so this is a targeted, condition-gated RCE risk rather than a broadly exploitable one, despite the 8.6 CVSS-4.0 headline. No public exploit code was identified at time of analysis and active exploitation is not confirmed; vendor fixes are available in v3.8.4.

SiYuan versions before 3.8.4 contain a cross-site scripting (XSS) flaw that allows attribute injection into gutter-button markup when a victim pastes attacker-controlled plain-text Markdown containing a Kramdown inline attribute list (IAL); on the Electron desktop build with Node integration enabled and context isolation disabled, this escalates to remote code execution with renderer Node.js privileges. Exploitation is unauthenticated (PR:N) but requires user interaction-the victim must paste the crafted Markdown and then focus the affected gutter control. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.4.

Decompiling a maliciously crafted binary with Ghidra through 12.1.4 can drive a stack-based out-of-bounds write inside the decompiler's leftshift128 routine, letting the sample corrupt process memory and potentially achieve code execution in the analyst's Ghidra session. The flaw is triggered when a specific instruction sequence lowers to p-code containing a negative shift amount that reaches the RuleDivOpt/RuleDivTermAdd divisor-optimization path; no privileges are required (PR:N in both the reported CVSS 4.0 vector and the independent CVSS 3.1 assessment), but exploitation is gated on the victim loading and decompiling the attacker-supplied file (UI:P/UI:R), making this a targeted threat against reverse engineers rather than a remote one. At the time of analysis, no public exploit code has been identified for this issue and there is no confirmed active exploitation (CISA KEV status is not present).

Authenticated code injection in Horilla HR (horilla-hr) before 2.0.0 lets any user with access to the HorillaListView export functionality run arbitrary operating-system commands with the privileges of the application process - root, in the project's shipped horilla/horilla-hr Docker image. The issue is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitable remotely over the network with low privileges, requiring only a valid account able to reach the list/export endpoint, with no user interaction and no non-default configuration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor released a fix in version 2.0.0.