Remote-Code-Execution

An integer overflow vulnerability in the GIMP file-pvr plug-in allows heap-based buffer overflow via malicious .pvr files, potentially leading to arbitrary code execution or application crashes.

An authenticated OS command injection vulnerability (CVE-2026-102608) in ZoneMinder versions prior to 1.38.3 allows remote code execution via unsanitized monitor names during event export operations.

Netcore NR256CN routers up to version 1.5.140116 are vulnerable to a pre-authentication stack buffer overflow in the Boa web server's user_ok() function, allowing remote code execution or denial-of-service.

WeRSS version 1.5.3 and earlier contains a remote code execution vulnerability allowing unauthenticated attackers to bypass eval denylists via template parameters.

Google Chrome contains multiple vulnerabilities that can be exploited by a remote, anonymous attacker to achieve arbitrary code execution or cause a denial-of-service condition.

WooCommerce Designer Pro version 1.9.26 and earlier is vulnerable to unauthenticated arbitrary file upload due to insufficient validation in the wcdp_save_canvas_design_ajax function, facilitating remote code execution.

A stack-based buffer overflow in the boa web server component of NEXTU FLATA AX1500 routers allows unauthenticated remote attackers to achieve arbitrary code execution via the hostname parameter.

A heap-based buffer overflow in the api.cgi component of Wavlink WN530HG4B firmware allows unauthenticated remote attackers to execute arbitrary code via malformed input to the api=info&client=app handler.

Multiple vulnerabilities in SonicWall Network Security Manager versions prior to 4.4.0, including CVE-2026-100232 and CVE-2026-96540, allow unauthenticated attackers to achieve remote code execution and bypass security policies.

CVE-2017-11610 is a remote code execution vulnerability in Supervisor versions 3.3.2 and earlier that allows authenticated attackers to execute arbitrary system commands via the XML-RPC interface.

Cisco Secure Email Gateway contains a critical vulnerability in the Advanced Malware Protection (AMP) feature allowing unauthenticated remote code execution with root privileges, which is currently being exploited in the wild.

An unauthenticated remote code execution vulnerability exists in 10Web Booster versions 2.34.10 and earlier due to insecure file handling and nonce leakage.

MoviePilot versions through 3.1.5 are vulnerable to command injection via the ExecuteCommandTool, allowing unauthenticated or low-privileged actors to achieve remote code execution.

An unauthenticated heap-based buffer overflow in the Secure Vector Routing (SVR) component of Juniper Junos OS allows remote attackers to trigger denial-of-service or potentially execute arbitrary code via malformed IPv4 packets.

CVE-2026-15176 is a heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source that allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code by sending crafted HTTP requests.

Beganovich snappdf versions 1.1.0 through 6.0.x are vulnerable to OS command injection via the setUrl() function on Windows, allowing unauthenticated attackers to achieve arbitrary code execution.

Multiple vulnerabilities in Fortinet FortiSIEM allow unauthenticated remote attackers to execute arbitrary code on the affected appliance, risking complete platform compromise.

Radar versions prior to 1.12.2 contain a missing authorization vulnerability allowing attackers to execute commands via the /api/local-terminal WebSocket endpoint.

Mistral Vibe versions before 2.25.4 are susceptible to a command permission gate bypass that enables arbitrary command execution via the bash promptvars feature.

Xen Orchestra versions prior to 6.9.0 are vulnerable to privilege escalation via prototype pollution in ESXi import methods, allowing authenticated users to gain global administrator rights.

An unauthenticated arbitrary shortcode execution vulnerability in Click to Chat for WhatsApp for WordPress allows attackers to trigger malicious shortcodes by manipulating the REQUEST_URI.

A high-severity remote code execution vulnerability (CVE-2026-70197) in .NET allows unauthenticated out-of-bounds writes on Windows when reusing SocketAsyncEventArgs across IPv4 and IPv6 datagram sockets.

Xorbits Xoscar versions 0.11.2 and earlier are vulnerable to unauthenticated remote code execution via insecure deserialization of data sent over the actor-pool TCP channel.

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to unauthenticated remote code execution due to chained SQL injection and configuration file injection.

CVE-2026-84015 is a heap-based buffer overflow vulnerability in the Remote Access PPP EAP-TLS implementation that enables unauthenticated remote code execution via network-based exploitation.

An unauthenticated remote attacker can leverage an integer underflow vulnerability in the DNS Server service to achieve arbitrary code execution via crafted network packets.

An unrestricted file upload vulnerability in the Extension Check component of phpwcms allows remote unauthenticated attackers to upload arbitrary files via the POST_name parameter.

Wazuh versions 3.9.0 through 4.14.7 are vulnerable to an arbitrary file overwrite attack in MasterHandler that allows cluster workers to gain root remote code execution by modifying critical configuration files.

SourceCodester E-Learning System 1.0 contains an unrestricted file upload vulnerability in the save_users function, allowing remote attackers to upload arbitrary files to the server.

SourceCodester Contact Tracing System 1.0 is vulnerable to an unrestricted file upload flaw in the /classes/Users.php component, allowing remote attackers to achieve arbitrary file uploads.

IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 contain a path traversal vulnerability during archive extraction that allows remote authenticated attackers to execute arbitrary code.

Continue CLI versions up to 1.5.47 are vulnerable to a command injection flaw that allows attackers to execute arbitrary commands by chaining them after permitted shell commands.

GPT-SoVITS through 20250606v2pro is vulnerable to unauthenticated OS command injection via the UVR5 WebUI, allowing attackers to execute arbitrary commands by injecting shell metacharacters into output path parameters.

NetEase Cloud Music versions 3.1.38 and 3.1.39.205426 are vulnerable to remote code execution due to improper validation of URL schemes in the IPC bridge, allowing arbitrary local binary execution via API response forgery.

MONAI versions prior to 1.6.1 are vulnerable to remote code execution due to insecure deserialization of pretrained weights fetched over plaintext HTTP.

FreeRDP versions before 3.0.0 and 3.6.0 before 3.32.0 are vulnerable to heap memory disclosure and denial-of-service attacks triggered by a malicious RDP server sending crafted progressive tile sequences.

An unrestricted file upload vulnerability in Thelia allows authenticated back-office users to achieve remote code execution by bypassing filename sanitization.

Square Squash through commit e73f280 is vulnerable to insecure deserialization via the /api/1.0/symbolication endpoint, allowing unauthenticated attackers to achieve arbitrary Ruby object deserialization and potential remote code execution.

A critical buffer overflow vulnerability in the Edimax BR-6208AC router allows unauthenticated remote code execution via manipulation of the ifname argument in the /goform/formWlSiteSurvey handler.

The user_ok function in the Netcore NR268 CGI execution component contains an authentication bypass vulnerability, CVE-2026-108907, which allows remote attackers to gain unauthorized access.

CVE-2024-21378 is a remote code execution vulnerability in Microsoft Outlook that enables attackers to execute arbitrary code by delivering a malicious email form containing a COM DLL.

LogicalDOC Community Edition versions 9.3 and earlier are vulnerable to authenticated OS command injection via maliciously crafted Velocity templates within the DocumentService.sendAsEmail function.

The Linksys E1700 router (v1.0.0.4.003) is vulnerable to a remote stack-based buffer overflow in the Mac Filter component, allowing for potential unauthenticated remote code execution.

A vulnerability in BusyBox allows an unauthenticated remote attacker to execute arbitrary code and escalate privileges, posing a significant risk to embedded Linux systems.

The agno-agi agno library is vulnerable to a remote authentication bypass in the get_authentication_dependency function, allowing unauthenticated access via crafted security_key arguments.

An unauthenticated remote command injection vulnerability in the web management backend of legacy TRENDnet routers allows arbitrary OS command execution via manipulated arguments to pigwidgeon.cgi.

A SQL injection vulnerability in the jackq XCMS password recovery function allows remote attackers to execute arbitrary database queries via the email parameter.

OpenSpug Spug versions 3.4.0, 4.0.1, and earlier contain a remote OS command injection vulnerability in the File Transfer component, which is currently subject to public exploit availability.

The MAX platform adapter in cc-connect version 1.5.0 and earlier allows unauthenticated attackers to forge webhook updates and execute arbitrary shell commands on the host system.

Spotweb versions 1.5.8 and earlier are vulnerable to remote code execution through the NZB handler, triggered by maliciously crafted Usenet spot titles.

FusionPBX versions up to 5.6.5 contain an unauthenticated OS command injection vulnerability in the call_recordings::download function, allowing arbitrary code execution via crafted Caller-ID fields.

A vulnerability in i-doit Pro (versions 25 and below) allows attackers to perform brute-force attacks on the admin-center, enabling the upload of malicious plugins to achieve remote code execution.

An authenticated user can achieve remote code execution in Nginx-UI by uploading a maliciously crafted backup file that overwrites application configuration settings.

A critical vulnerability in Hazelcast Enterprise and Community Editions allows unauthenticated or low-privileged clients to read arbitrary cluster member memory, potentially enabling remote code execution via memory corruption.

Dromara Skyeye contains a missing authentication vulnerability in its bundled xxl-job-admin JobInfoController, allowing unauthenticated attackers to execute arbitrary shell, Python, or PowerShell jobs on the executor host.

HashiCorp Vault is vulnerable to arbitrary code execution when restoring Raft snapshots containing malicious plugin catalog entries.

The dot-access Node.js library versions 0.0.3 through 1.0.0 are vulnerable to code injection via the get() function, allowing unauthenticated attackers to execute arbitrary system commands.

Handlebars (v4.0.0-4.7.9) is vulnerable to a prototype-access deny list bypass where own property checks permit the retrieval of the Function constructor, enabling remote code execution when allowProtoMethodsByDefault is enabled.

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload via the 'temporaryFileUploads' parameter in versions up to 3.1.8.9, enabling remote code execution.

Openfind SecuShare Pro is vulnerable to an unauthenticated OS command injection flaw (CVE-2026-107459) allowing remote attackers to execute arbitrary commands on the host server.

Hydra-core versions prior to 1.3.6 and 1.4.0.dev9 are vulnerable to arbitrary code execution due to improper validation of logging configuration passed to dictConfig, allowing attackers to invoke arbitrary Python callables.

A critical remote code execution vulnerability (CVE-2026-105857) in @payloadcms/plugin-form-builder allows unauthenticated attackers to execute arbitrary code via crafted form submissions.

D-Tale versions 3.15.1 and earlier are vulnerable to unauthenticated remote code execution due to a hardcoded Flask secret key and unsafe pandas query evaluation.

A local Denial of Service vulnerability exists in the PCRE library due to improper processing of specifically crafted regular expressions that cause application crashes.

An unauthenticated remote attacker can trigger a use-after-free or double-free condition in llama.cpp version b11393 or earlier by sending a malformed POST /completion request to achieve memory corruption.

Authenticated users can execute arbitrary OS commands on Windows nodes in Rundeck versions prior to 6.2.0 by injecting shell metacharacters into job options.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control vulnerability (CVE-2026-104335) that allows an authenticated remote attacker to execute arbitrary code.

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

An integer overflow in libmikmod versions prior to 3.3.14 allows remote attackers to trigger heap buffer overflows via crafted DSM module files, potentially resulting in code execution.

Smarty versions before 4.5.8 and 5.8.5 are susceptible to code injection via template inheritance due to improper management of the nocache_hash variable, enabling unauthenticated remote code execution.

A critical command injection vulnerability in the TOTOLINK X6000R firmware allows unauthenticated remote attackers to execute arbitrary system commands via the /cgi-bin/cstecgi.cgi endpoint.

The Nx build system contains OS command injection vulnerabilities in `nx affected` and `nx import` commands, allowing attackers to execute arbitrary code via malicious git revision strings or remote branch names.

Langflow versions 1.10.0 and earlier use a non-cryptographic PRNG to derive Fernet keys from short SECRET_KEYs, allowing unauthenticated attackers who obtain the secret key file to perform offline decryption of all stored user credentials.

The simple-git library fails to block 'trailer.<token>.cmd' configuration in its unsafe-operation guard, enabling command injection when applications process untrusted user input.

The UNION HospitalManagementSystem is vulnerable to remote SQL injection via the patient_id parameter in patient_info.php, allowing unauthenticated attackers to manipulate database queries.

An authenticated attacker can exploit a vulnerability in SmarterTools SmarterMail to bypass security controls and hijack other user accounts via identity impersonation.

CISA has added CVE-2026-88779, a memory buffer vulnerability in Citrix NetScaler, to the Known Exploited Vulnerabilities (KEV) catalog due to confirmed in-the-wild exploitation.

CVE-2025-10502 is a heap buffer overflow vulnerability in the Chromium ANGLE graphics engine that could allow an attacker to trigger memory corruption or achieve arbitrary code execution via a malicious webpage.

UTMStack versions prior to 11.2.16 are vulnerable to an authenticated SQL injection in the UtmAssetGroupService, allowing attackers to execute arbitrary commands with DBA privileges.

The Dulwich Git library for Python fails to validate DOS drive letter prefixes on Windows, allowing a malicious Git repository to write files to arbitrary locations outside the designated worktree.

A critical buffer overflow vulnerability (CVE-2026-18397) in the Thales SConnect browser extension allows unauthenticated attackers to achieve remote code execution through malicious drive-by web pages.

An authentication bypass vulnerability in the YesWiki triples delete API allows authenticated users to delete arbitrary semantic triples, potentially resulting in site-wide denial of service.

Unauthenticated attackers are actively exploiting a path traversal and NULL byte injection vulnerability (CVE-2026-104286) in FortiMail to write arbitrary files and establish persistence.

A prototype pollution gadget in the Piscina library allows unauthenticated attackers to execute arbitrary code or manipulate worker environments by injecting properties via Object.prototype.

The vm2 sandbox library (v3.11.3-3.11.6) allows attackers to bypass restrictions and execute arbitrary native code in the host process by calling crypto.setEngine() with a path to a malicious dynamic library.

Kiteworks appliances are vulnerable to a suite of critical flaws, including remote code execution, SQL injection, and command injection, allowing for full system compromise, data exfiltration, and administrative account takeover.

Multiple high-severity vulnerabilities in Armatura One, including an Apache ActiveMQ deserialization flaw, expose critical physical access-control infrastructure to remote code execution and credential compromise.

Food-Ordering 1.0 contains a Local File Inclusion (LFI) vulnerability in update_category.php allowing authenticated users to upload and execute arbitrary files via the update_image parameter.

TigerGraph Community Edition 4.2.4 contains a remote code execution chain initiated by hard-coded default credentials, enabling an arbitrary file write that allows for SSH key injection.

Teltonika RutOS 00.07.06.21 is vulnerable to post-authentication command injection via the ipsec.lua and openvpn.lua modules, allowing arbitrary root command execution.

A vulnerability in Ghost versions 5.2.0 through 6.61.9 allows unauthenticated remote attackers to manipulate Stripe Checkout flows to modify member records and inject malicious content into newsletters.

ZeroClaw versions before 0.8.5 are vulnerable to path traversal via the plugins-wasm feature, allowing attackers to overwrite arbitrary files through crafted plugin manifest files.

A vulnerability in Ollama (CVE-2024-37032) allows a remote, unauthenticated attacker to execute arbitrary code via insufficiently validated API requests.

The 'MikroTrick' campaign exploits vulnerabilities in the RouterOS SSH service to achieve unauthenticated remote code execution and administrative account persistence.

Digiwin EasyFlow .NET is vulnerable to an insecure deserialization flaw, enabling unauthenticated remote attackers to achieve arbitrary code execution via crafted serialized input.

CVE-2026-102425 is a critical unauthenticated remote code execution vulnerability in the Joomla Balbooa Forms extension allowing code injection via unsanitized field shortcodes.

HKUDS AnyTool version 0.1.0 is vulnerable to remote OS command injection via the Execute Endpoint component, allowing unauthenticated attackers to execute arbitrary system commands.

An OS command injection vulnerability in the wiki_capture_source MCP tool of zosmaai pi-llm-wiki versions up to 0.11.7 allows remote unauthenticated attackers to execute arbitrary commands via the url argument.

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 are vulnerable to remote code execution due to insecure use of eval() within the AbstractArrayDeclarationSniff::getActualArrayKey() method.

Multiple vulnerabilities in Lantronix G520 Series Cellular Gateway firmware allow remote, unauthenticated attackers to execute arbitrary code with root privileges by manipulating update metadata or injecting unsigned malicious packages.

A heap-based buffer overflow in the RPM Package Manager allows for out-of-bounds writes and potential code execution when processing maliciously crafted RPM files containing specific symlink entries.

An unauthenticated remote OS command injection vulnerability in the Netcore NAP930 router allows attackers to execute arbitrary system commands via the sid argument in the network_tools CGI component.

A stack-based buffer overflow vulnerability in the _tWlanTask function of the FAST FAC1203R router allows remote code execution via network-based manipulation.

An unauthenticated remote command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 allows attackers to execute arbitrary commands via the USB Device Management API.

A critical stack-based buffer overflow vulnerability (CVE-2026-101081) in the D-Link DI-8400 web administration interface allows remote attackers to trigger memory corruption and achieve remote code execution.

CVE-2026-86330 is an OS command injection vulnerability in the NooBaa cluster_internal_api component of Red Hat OpenShift Data Foundation, allowing authenticated administrative attackers to execute arbitrary system commands.

A critical stack-based buffer overflow vulnerability in the devdiscover service of FAST FAC1200R routers allows unauthenticated remote attackers to achieve code execution via malformed advertisement frames.

An unrestricted file upload vulnerability in Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System allows unauthenticated attackers to execute arbitrary code via web shell deployment.

An unauthenticated remote command injection vulnerability in the aaPanel BaoTa File Merge Handler allows attackers to execute arbitrary system commands via the split_file_path parameter.

An OS command injection vulnerability in the TOTOLINK N150RT web interface allows unauthenticated remote attackers to execute arbitrary commands via the wlanif parameter.

A memory corruption vulnerability in the OpenDKIM dkim_canon_selecthdrs function allows remote attackers to trigger an out-of-bounds write via crafted DKIM signature headers.

MONAI versions through 1.6.0 are vulnerable to remote code execution due to insecure deserialization and evaluation of arbitrary Python callables within bundle configuration files.

A critical out-of-bounds write vulnerability (CVE-2026-100740) in the D-Link DIR-895L L2TP control channel parser allows remote attackers to potentially achieve code execution.

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions 2.9.2 and below, allowing remote attackers to upload executable PHP files.

GestSup versions before 3.2.61 are vulnerable to unauthenticated remote code execution via malicious file attachments in the IMAP connector.

The Cline Hub dashboard fails to validate Origin headers and bypasses authorization when no secret is configured, allowing malicious websites to hijack local WebSocket connections to execute arbitrary code.

PaperCut has released security updates addressing critical vulnerabilities including remote code execution, unauthorized data access, and XSS across PaperCut Hive and PaperCut NG/MF platforms.

A critical unauthenticated RCE vulnerability (CVE-2026-90817) in Vanderbilt REDCap allows attackers to bypass routing restrictions through the '__passthru' parameter, enabling unauthorized access to administrative controllers.

CVE-2022-42889, or Text4Shell, is a critical remote code execution vulnerability in Apache Commons Text versions 1.5-1.9 that allows attackers to execute arbitrary code via malicious string lookups.

CGServiSign by Changing contains an OS command injection vulnerability allowing unauthenticated remote attackers to execute arbitrary code on a victim's host.

A critical stack-based buffer overflow vulnerability in the Device Discovery Service of Fast FAC1203R firmware 2.0.4 allows for unauthenticated remote code execution.

The mcp-atlassian package contains an authentication bypass vulnerability (CVE-2026-77244) that allows unauthenticated network-adjacent attackers to execute tools using the operator's Jira and Confluence credentials.

A critical unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager is currently being exploited in the wild, allowing attackers to gain full system control.

A vulnerability (CVE-2026-95499) in php-file-manager-with-code-editor versions 3.0 and earlier allows remote attackers to perform unrestricted file uploads by manipulating the 'files' argument.

CVE-2026-95271 is an improper authentication vulnerability in dgtlmoon changedetection.io versions up to 0.60.7, allowing remote attackers to bypass security via the check_authentication function.

A vulnerability in X.Org X11 components, identified as CVE-2025-26595, allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution via crafted requests.

An unauthenticated remote command injection vulnerability (CVE-2026-94139) in the Cookie Handler component of Feiyu Star Router allows attackers to execute arbitrary system commands via a manipulated session_id argument.

QCMS versions up to 6.0.6 are vulnerable to remote SQL injection via the ID argument in the self_Tmp function, allowing attackers to execute arbitrary database commands.

Netcore NBR200V2 version 1.3.241127.071246 is vulnerable to remote command injection via the Traceroute Diagnostic Feature, allowing unauthenticated attackers to execute arbitrary commands.

A stack-based buffer overflow vulnerability in the Comfast CF-N1-S Web Management Interface (CVE-2026-94003) allows remote, unauthenticated attackers to execute arbitrary code via a malicious URI request.

A heap-based buffer overflow vulnerability in the Kamailio CDP Diameter Receiver module (CVE-2026-93962) allows unauthenticated remote attackers to achieve potential code execution or denial of service.

A critical remote code execution vulnerability, CVE-2023-41056, in Kaspersky Secure Mail Gateway allows unauthenticated attackers to execute arbitrary code on affected appliances.

An integer overflow vulnerability in IBM MQ's processing of MQINQ requests allows an authenticated attacker to trigger a denial of service or potentially execute arbitrary code.

CVE-2025-1302 is a critical remote code execution vulnerability in the jsonpath-plus library, exploitable via malicious JSONPath expressions injected through query parameters.

IBM MQ is vulnerable to a stack buffer overflow triggered by malicious XA transaction identifiers, allowing an authenticated attacker to cause a denial of service or achieve arbitrary code execution.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain a heap buffer underflow vulnerability in multi-segment message processing that allows authenticated attackers to execute arbitrary code or trigger denial of service.

Authenticated users can exploit a file upload vulnerability in ClipBucket v5 before 5.5.3-#182 to achieve remote code execution by bypassing MIME validation.

Synology DiskStation Manager (DSM) contains an insufficient entropy vulnerability in its login logic that allows remote, unauthenticated attackers to perform arbitrary file read/write operations and trigger a denial-of-service condition.

An unauthenticated remote command injection vulnerability in yt-dlp-web-ui version 4 and earlier allows remote attackers to execute arbitrary system commands via the params argument.

An unauthenticated remote code execution vulnerability in the Chamilo LMS CStudio upload flow allows attackers to gain server-level access by exploiting improper file handling (CVE-2026-45140).

SiYuan versions prior to 3.8.4 contain a cross-site scripting vulnerability in bookmark label rendering that enables remote code execution due to insecure Electron configuration.

An unauthenticated arbitrary file upload vulnerability in the Paid Downloads plugin (<= 3.15) allows remote attackers to execute code by bypassing file type validation via the admin_request_handler function.

A vulnerability in djust caused multi-tenant isolation to fail open on WebSocket and SSE paths, allowing unauthorized cross-tenant data disclosure due to improper tenant context propagation.

A critical remote OS command injection vulnerability in the Ruijie RG-EW3000GX router allows unauthenticated attackers to execute arbitrary commands via the configChange component.

Multiple vulnerabilities in Aruba EdgeConnect allow for privilege escalation, denial of service, information disclosure, file manipulation, cross-site scripting, security bypass, and arbitrary code execution.

Multiple vulnerabilities in Microsoft Edge allow remote attackers to achieve arbitrary code execution and escalate privileges on the host system.

Multiple vulnerabilities, including CVE-2026-77179 and CVE-2026-79994, in Docker Sandboxes versions prior to 0.42.0 could allow remote code execution, data confidentiality breaches, and integrity loss.

A low-privileged remote attacker can exploit a command injection vulnerability at the /index.php/ajax/parameterManage endpoint using valid credentials to gain root-level code execution.

A hard-coded HS256 signing key in the Issabel Framework allows unauthenticated attackers to forge JWTs and execute arbitrary commands via the Asterisk manager originate endpoint.

An unauthenticated SQL injection vulnerability in Yonyou U8 CRM allows attackers to execute arbitrary SQL commands via the fillbacksettingedit.php endpoint, potentially leading to remote code execution on MS SQL Server instances.

Multiple high-severity vulnerabilities in Digital Watchdog VMAX series devices allow unauthenticated remote attackers to bypass authentication, gain root access via hard-coded credentials, and execute arbitrary system commands.

IBM MQ is affected by multiple vulnerabilities, including CVE-2024-49033, CVE-2024-49034, and CVE-2024-49035, which could allow a remote attacker to execute arbitrary code, cause a denial of service, disclose sensitive information, or manipulate data.

Authenticated users can execute arbitrary commands on the Polyaxon scheduler process by injecting malicious Jinja2 payloads into operation specification fields.

A use-after-free vulnerability in the GPAC compositor component (CVE-2026-91087) allows remote attackers to trigger memory corruption via malicious media files.

An unauthenticated remote command injection vulnerability in EFM ipTIME C200E firmware version 1.094 allows remote attackers to execute arbitrary operating system commands via the iux_set.cgi script.

Crawlab versions 0.6.3 and earlier utilize a hard-coded HMAC-SHA256 secret for JWT signing, enabling unauthenticated attackers to forge administrative tokens and achieve remote code execution.

A command injection vulnerability in HexStrike AI allows remote unauthenticated attackers to execute arbitrary OS commands via the Execute Endpoint.

A critical remote command injection vulnerability (CVE-2026-90617) exists in the MCP HTTP Server component of GH05TCREW PentestAgent, allowing unauthenticated attackers to execute arbitrary OS commands via the run_task function.

Anil-matcha Open-Generative-AI is vulnerable to unrestricted file uploads via the /api/upload-binary endpoint, allowing remote attackers to manipulate the x-proxy-target-url argument to upload arbitrary files.

Publicly available proof-of-concept exploits for CVE-2021-38647 allow unauthenticated remote command execution via the OMI framework by omitting the Authorization header.

rustypaste versions prior to 0.18.1 contain a path traversal vulnerability that allows attackers to write files to arbitrary locations by manipulating the custom filename HTTP header.

CVE-2018-1207 allows unauthenticated attackers to achieve root-level remote code execution on Dell iDRAC7 and iDRAC8 firmware versions 2.52.52.52 and below via dynamic linker injection.

A vulnerability in vLLM versions prior to 0.28.0 allows remote code execution by bypassing the trust_remote_code parameter during the loading of malicious LlavaOnevision2 processor classes.

The yayson library (<= 4.2.0) is vulnerable to prototype pollution when deserializing malicious JSON:API documents, allowing unauthenticated attackers to corrupt the global Object.prototype and potentially achieve RCE via gadget chains.

GitLab has released security patches addressing a large set of vulnerabilities across Community and Enterprise editions, including flaws leading to remote code execution and data confidentiality compromises.

WAVLINK WN535M1 and WN535M3 routers are vulnerable to unauthenticated arbitrary file writes via the sync_server daemon, enabling attackers to gain root-level persistence.

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 are vulnerable to a stack-based buffer overflow via malicious DRDA server responses, potentially leading to arbitrary command execution on clients.

A critical unauthenticated stack-based buffer overflow vulnerability, tracked as CVE-2025-32756, affects multiple Fortinet products and can be triggered via a crafted 'enc' parameter in the 'AuthHash' cookie.

The @yeger/turbo-graph package exposes an unauthenticated HTTP endpoint (/api/run) that binds to all network interfaces, allowing adjacent attackers to execute arbitrary Turborepo tasks defined in the victim repository.

Joker versions before 1.8.2 are vulnerable to arbitrary code execution because the linter automatically traverses directory structures to execute project-local 'linter.*' files, allowing execution of attacker-supplied code within untrusted repositories.

The set_functype_version MCP tool in functype-mcp-server allows unauthenticated attackers to execute arbitrary code by passing a malicious package alias to pnpm, which the server subsequently executes via dynamic import.

An auth bypass in the ESPHome Home Assistant add-on allows unauthenticated LAN access to the dashboard due to improper interface binding, enabling remote code execution on the host.

An authenticated administrator can exploit CVE-2026-26212 in the Rara One Click Demo Import plugin to achieve remote code execution by bypassing file type validation during the upload process.

A 32-bit integer overflow in VLC media player's picture buffer calculation allows remote attackers to trigger a heap-based buffer overflow via crafted PNG files.

Multiple vulnerabilities in Ivanti Neurons for ITSM (CVE-2024-7569, CVE-2024-7570, CVE-2024-7571) allow a remote unauthenticated attacker to achieve remote code execution.

The bestzip package version 2.2.6 and 3.0.2 is vulnerable to argument injection in the nativeZip function, allowing unauthenticated attackers to execute arbitrary commands via malicious input.

A high-severity remote code execution vulnerability (CVE-2026-50646) in .NET WPF allows arbitrary code execution via maliciously crafted XAML input.

An unauthenticated RCE vulnerability in winml-cli (CVE-2026-84452) allows remote attackers to execute arbitrary code via a malicious website sending cross-origin requests to the local API server.

An authenticated user with Manager or Owner privileges can achieve remote code execution on the Semaphore server by injecting malicious arguments into the git_url field.

CVE-2026-69431 is a critical heap-based buffer overflow vulnerability in the Telnet Client that allows an unauthenticated, remote attacker to achieve arbitrary code execution over a network connection.

Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.

An unauthenticated path traversal vulnerability in knowns versions prior to 0.30.0 allows attackers to overwrite arbitrary files on the server by supplying malicious traversal sequences in the import route name parameter.

CVE-2026-7861 is a critical deserialization of untrusted data vulnerability in Next4Biz CSM that permits unauthenticated remote code execution via malicious object injection.

An unrestricted file upload vulnerability in U+Smart Enjoyment WebSite version 18.6001.1096.1000 allows unauthenticated remote attackers to execute arbitrary code via the /Report/Upload/UploadFormImg.ashx endpoint.

MediaWiki is vulnerable to remote code execution (CVE-2026-58025) via insecure PHP deserialization within the LogEntryBase::extractParams method, allowing authenticated sysop users to execute arbitrary code through malicious XML imports.

An unauthenticated or low-privilege attacker can achieve remote code execution in Microsoft Web Deploy versions prior to 10.0.2001 by exploiting insecure deserialization of the 'MSDeploy.SyncOptions' HTTP header.

An unauthenticated remote command injection vulnerability in Tenda CP3 firmware version 27.5.57.101 allows attackers to execute arbitrary system commands via the AlarmVoiceURL argument.

Lara Dashboard versions prior to 1.3.0 are vulnerable to an authentication bypass in the screenshot-login route that permits unauthenticated access to any user account when APP_ENV is not set to production.

Axolotl versions through 0.18.0 contain a remote code execution vulnerability where an insecure default configuration allows attackers to bypass security guards and execute arbitrary Python code.

Cua computer-server versions prior to 0.3.42 contain an authentication bypass vulnerability triggered when the CONTAINER_NAME environment variable is unset, allowing unauthenticated remote command execution on TCP port 8000.

CVE-2023-34051 is an authentication bypass in VMware vRealize Log Insight that allows unauthenticated arbitrary file write and remote code execution via chained exploitation of Thrift RPC endpoints.

Versions of ntop nDPI before 6.0 are vulnerable to a heap-based buffer overflow in the ndpi_json_string_escape function, allowing attackers to trigger memory corruption via crafted network traffic.

Nango versions prior to 0.71.6 contain an authentication bypass vulnerability allowing unauthenticated attackers to achieve remote code execution via the tRPC runner server.

SonicWall Network Security Manager (NSM) versions prior to 4.3.1-R4 contain multiple vulnerabilities, including CVE-2026-78327, CVE-2026-78328, and CVE-2026-81939, that allow for remote code execution, privilege escalation, and security policy bypass.

LaVague version 0.2.35 contains a remote code execution vulnerability in the PythonFromMarkdownExtractor.extract_as_object function, allowing attackers to execute arbitrary code via indirect prompt injection.

The aider CLI tool is vulnerable to arbitrary command execution because it automatically executes shell commands defined in a .aider.conf.yml file located in the root of a Git repository upon startup.

The goose utility version 1.37.0 contains a vulnerability where insecure handling of recipe stdio extensions and retry.checks permits unvalidated arbitrary shell command execution.

Openpanel versions before 2.3.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) flaw in the /tools/site-checker endpoint that allows internal network probing and cloud metadata access.

Grav versions 2.0.17 and earlier contain a remote code execution vulnerability in the Twig sort filter that allows authenticated users with page-write permissions to execute arbitrary PHP code.

CVE-2026-6471, dubbed PostGREShell, allows attackers with Replication privileges to achieve remote code execution and escalate to superuser by abusing the logical decoding plugin loader.

An unauthenticated OS command injection vulnerability in the Claude Code Studio HTTP server allows remote attackers to execute arbitrary code via drive-by web requests or local network access.

The ui-moos component is vulnerable to a buffer overflow in ScopeTabPane.cpp and ScopeGrid.cpp, potentially allowing arbitrary code execution when processing crafted MOOS identifiers.

The pAntler component in essential-moos versions 10.0.1 and earlier allows unauthenticated attackers to achieve remote code execution by publishing a crafted MISSION_FILE message to the MOOSDB.

Multiple buffer overflow vulnerabilities in MOOS-IvP versions up to 24.8.1 allow for remote code execution via malformed IvP function strings.

The pShare component in MOOS essential-moos versions up to 10.0.1 is vulnerable to unauthenticated UDP message injection and denial-of-service.

A critical buffer overflow vulnerability (CVE-2026-85031) in the TOTOLINK CP450 web interface allows remote, unauthenticated attackers to execute arbitrary code via the 'topicurl' argument.

A critical unauthenticated stack buffer overflow in Ivanti Connect Secure, Policy Secure, and Neurons for Zero-trust Access (version 22.7) allows remote attackers to execute arbitrary code and create unauthorized administrative accounts.

Authenticated users can trigger OS command injection in OpenChoreo workflow templates by supplying crafted parameters that are insecurely interpolated into shell execution scripts.

Submariner in cert-auth mode is vulnerable to command injection via improper input validation in the CableName field, allowing unauthenticated remote code execution as root.

An authentication bypass vulnerability in GNU Inetutils telnetd (CVE-2026-24061) allows unauthenticated remote attackers to gain root access via a malicious USER parameter.

Coolify versions before 4.2.0 are vulnerable to command injection via environment variable keys, allowing authenticated attackers to execute arbitrary commands on the underlying host server.

An integer overflow in the nanoid library allows unauthenticated attackers to permanently corrupt the process-wide CSPRNG pool, forcing all subsequent ID generation to output a deterministic string and enabling mass authentication bypass.

ModelScope insecurely utilizes the unsafe yaml.Loader to parse model configuration files, allowing an attacker to achieve arbitrary code execution by supplying a poisoned repository containing malicious Python object construction tags.

An unauthenticated remote command injection vulnerability in the ArmAngstromInstructionSet function of ICP DAS UA-2200 and UA-5200 devices allows remote attackers to execute arbitrary code via the ParameterArray argument.

VMware Aria Operations for Networks versions 6.0 to 6.10 contain a vulnerability involving static SSH keys that allow unauthorized remote access and root-level privilege escalation.

An unauthenticated arbitrary file deletion vulnerability in the Frontend Admin plugin for WordPress allows attackers to delete critical server files, potentially leading to remote code execution.

An unauthenticated remote command injection vulnerability in the mail-report.sh script of Cobham SATCOM VSAT7090 devices allows attackers to execute arbitrary system commands via crafted JSON input.

The WPLP Cookie Consent WordPress plugin is vulnerable to unauthenticated arbitrary file upload due to improper authorization and missing file type validation, enabling remote code execution.

ShopEx ECShop versions up to 2.5.1 contain an unrestricted file upload vulnerability in the check_img_type function that allows unauthenticated remote attackers to upload malicious files via the pack_img argument.

QVidium Opera11 version 3.3.2a26-Ax4x-opera11 is vulnerable to unauthenticated remote command injection via the ipaddr parameter in the /cgi-bin/net_tr.cgi script, which lacks security updates due to the vendor ceasing operations.

A critical out-of-bounds write vulnerability in the D-Link DSM-G600 multipart handler allows remote attackers to compromise the device via the /load_file.cgi endpoint, with public exploit code currently available.

D-Link DNS-340L and DNS-345 network storage devices are susceptible to remote OS command injection via the /cgi-bin/virtual_vol.cgi component, enabling unauthenticated remote code execution.

The TOTOLINK NR1800X router is vulnerable to remote command injection via the setUssd function in cgi-bin/cstecgi.cgi, enabling unauthenticated attackers to execute arbitrary system commands.

A critical stack-based buffer overflow vulnerability in D-Link DIR-825M firmware allows unauthenticated remote attackers to achieve code execution via the /boafrm/formDiskFormat endpoint.

CVE-2026-82478 is a stack-based buffer overflow in the NASA Trick simulation environment (version 19.6.0) that enables remote attackers to trigger memory corruption via the TCP Socket Handler.

The argocd-mcp component version 0.8.0 insecurely binds its HTTP transport to all network interfaces and lacks authentication for MCP sessions when an API token is present, allowing remote attackers to perform unauthorized Argo CD resource modifications.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an unauthenticated remote code execution vulnerability in the A2A public endpoint.

Synk Sweater Comb before version 3.8.8 contains a command injection vulnerability in the expectGitBranch() function, allowing arbitrary OS command execution via crafted .vervet.yaml configuration files.

Redpanda versions 26.2.2 and earlier insecurely expose the Admin API on port 9644 by default without authentication enabled, allowing remote attackers to perform superuser actions.

A vulnerability in n8n allows a remote, unauthenticated attacker to manipulate files and disclose sensitive information on the platform, identified as CVE-2024-51746.

NUMail contains an unauthenticated OS command injection vulnerability allowing remote attackers to execute arbitrary system-level commands on affected servers.

CVE-2026-23489 is a blind remote code execution vulnerability in the GLPI Fields plugin (<= 1.23.2) that allows authenticated attackers to execute arbitrary PHP code via the dropdown-generation feature.

Adobe Campaign Classic is affected by three critical vulnerabilities, including SSRF and OS Command Injection, which allow unauthenticated remote attackers to achieve full system compromise.

A publicly disclosed path traversal vulnerability (CVE-2026-81491) in boxpositron with-context-mcp versions 3.0.7 and earlier allows remote attackers to manipulate file paths via specific ingested note functions.

An unauthenticated remote code execution vulnerability in senaite.core allows attackers to execute arbitrary Python code via a two-request chain leveraging missing authorization and unsafe eval() usage in the JSON API.

CVE-2022-34721 is a critical remote code execution vulnerability in the Windows Internet Key Exchange (IKE) extension, which is being actively exploited in the wild to gain unauthorized code execution.

ClipBucket V5 versions 5.5.1 through 5.5.3-#153 contain an OS command injection vulnerability in the web installer, allowing unauthenticated remote code execution via the php_cli_filepath parameter.

The qwed package (version 5.1.1) fails to sanitize input in math verification endpoints, allowing authenticated attackers to achieve remote code execution via unsafe SymPy expression evaluation.

The genieacs-mcp package fails to validate Host and Origin headers on loopback listeners, allowing unauthorized web pages to perform DNS rebinding and invoke administrative GenieACS tools via an unauthenticated MCP interface.

The qwed-mcp library v0.2.0 is vulnerable to arbitrary remote code execution because it passes unsanitized input to SymPy's parse_expr function, allowing attackers to execute arbitrary system commands via Python code injection.

SEPPmail Secure E-Mail Gateway contains multiple vulnerabilities that an attacker can exploit to bypass security controls and achieve remote code execution on the appliance.

The CM Map Locations WordPress plugin is vulnerable to remote code execution due to insufficient file validation in the uploadMedia function, allowing subscriber-level authenticated users to upload arbitrary executable files.

Autodesk 3ds Max contains an out-of-bounds write vulnerability triggered by parsing maliciously crafted Alembic (.abc) files, potentially allowing arbitrary code execution upon user interaction.

Authenticated attackers can exploit a command injection flaw in the DrayTek VigorSwitch commandTable function to achieve root-level remote code execution.

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability (CVE-2026-71921) in the setget.cgi interface that allows unauthenticated remote attackers to execute arbitrary commands as root.

CVE-2026-71366 allows authenticated AWX notification administrators to perform SSRF and exfiltrate credentials by leveraging insufficient validation of notification template targets.

A stack-based buffer overflow in the Netis NC63 login handler allows unauthenticated remote attackers to achieve root-level code execution.

Xinference versions prior to 2.12.0 are vulnerable to remote code execution because they unconditionally enable 'trust_remote_code=True' when loading models, allowing attackers to execute arbitrary Python code via crafted model configurations.

An unauthenticated remote code execution vulnerability (CVE-2026-78245) exists in itsourcecode Online Pharmacy System 1.0 due to improper file validation within the user registration process.

The itsourcecode Real Estate Management System 1.0 contains an SQL injection vulnerability in search.php that allows unauthenticated remote attackers to execute arbitrary database queries.

An out-of-bounds write vulnerability in the libwebsockets LECP CBOR recording function (CVE-2026-78161) allows remote attackers to trigger memory corruption via crafted CBOR data.

Tenda CH22 router firmware version 1.0.0.1 is vulnerable to unauthenticated remote command injection via the /goform/editFileName endpoint, allowing potential full system compromise.

The JSONata library contains a critical vulnerability (CVE-2026-77415) allowing unauthenticated attackers to achieve arbitrary code execution via maliciously crafted JSONata expressions.

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands.

An authenticated admin can achieve remote code execution in NocoBase prior to v2.1.5 by chaining arbitrary file uploads via storage root manipulation with a local file inclusion vulnerability in the plugin manager.

Elementor Pro versions 4.2.1 and below contain a critical file upload vulnerability (CVE-2026-32475) that allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.

An unauthenticated remote code injection vulnerability in the Authenticate function of chenhg5 cc-connect (up to 1.4.1) allows attackers to execute arbitrary code via the exec parameter.

A privilege escalation vulnerability in Splunk AI Toolkit versions prior to 6.0.0 allows non-privileged users to execute searches with system-level permissions by exploiting an insecure session token replacement mechanism in the Agent Run History handler.

A critical stack-based buffer overflow vulnerability in the /sbin/mycli binary of TRENDnet TEW-755AP access points allows remote unauthenticated attackers to execute arbitrary code via the 'ssid' argument.

IBM Power Systems Firmware contains a stack-based buffer overflow in the ASMI web interface, allowing an unauthenticated attacker to achieve arbitrary code execution on the Flexible Service Processor.

IBM App Connect Enterprise contains a vulnerability, identified as CVE-2024-44280, that allows a remote, anonymous attacker to execute Cross-Site Scripting (XSS) attacks within the context of the affected application.

A stack-based buffer overflow vulnerability in the UTT HiPER 1200GW router allows remote attackers to trigger memory corruption via a malicious 'timestart' parameter, with proof-of-concept exploits publicly available.

The mtdowling/jmespath.php library contains a critical code injection vulnerability, CVE-2026-54133, allowing attackers to execute arbitrary PHP code when untrusted JMESPath expressions are processed by the CompilerRuntime.

A threat actor exploited SQL injection in a public-facing application to achieve OS-level remote code execution by abusing Oracle Java Source to deploy the custom 'khunt' post-exploitation toolkit.

CodeWhale versions before 0.8.64 contain a time-of-check-time-of-use vulnerability in DNS pinning logic, allowing attackers to bypass SSRF mitigations and access internal resources.

An argument injection vulnerability (CVE-2026-75913) in the CodeWhale git_show tool allows attackers to perform arbitrary file writes under the user's privilege level by manipulating the 'rev' parameter.