CVE-2026-45247

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

CVSS 4.0 · 9.3 Critical EPSS 26.2% KEV · Listed

Vendors

Mirasvit

Products

Full Page Cache Warmer Full Page Cache Warmer For Magento 2

CVE-2018-25412

Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php

Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for remote code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Deltasql Deltasql Project

Products

Delta Sql Deltasql

CVE-2026-44477

CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cloudnative-pg Linuxfoundation

Products

Cloudnative-pg Cloudnativepg

CVE-2026-45353

electerm: Local code through electerm's single-instance socket

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Electerm Electerm Project

Products

Electerm Electerm

CVE-2026-42074

OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gitlawb

Products

Openclaude

CVE-2024-1100

SQLi in Vadi Corporate Information Systems' DIGIKENT GIS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection. This issue affects DIGIKENT GIS: through 2.23.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Vadi

Products

Digikent Gis

CVE-2024-0851

SQLi in Grup Arge Energy and Control Systems's Smartpower

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems Smartpower allows SQL Injection. This issue affects Smartpower: through V24.05.27.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Gruparge

Products

Smartpower

CVE-2024-0336

Improper Access Control in EMTA Grups PDKS

Missing Authentication for Critical Function vulnerability in EMTA Grup PDKS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDKS: from V3.04 before 20240603. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Emta Grup

Products

Pdks

CVE-2026-33728

dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK >= 8u121 < JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Datadog

Products

Dd-trace-java

CVE-2024-1744

IDOR in Ariva Computer's Accord ORS

Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data. This issue affects Accord ORS: before 7.3.2.1.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Accordors Ariva Computer

Products

Accord Ors Accord Ors

CVE-2024-3373

SQLi in RSM Design's Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Rsm Design

Products

Web Template

CVE-2024-4657

Strored XSS in Talent Software's BAP Automation

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS. This issue affects BAP Automation: before 30840.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Talentsoftware

Products

Bap Automation

CVE-2024-5958

SQLi in Eliz Software's Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection. This issue affects Panel: before v2.3.24.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Eliz Software Elizsoftware

Products

Panel Panel

CVE-2024-5959

Stored XSS in Eliz Software's Panel

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS. This issue affects Panel: before v2.3.24.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Elizsoftware

Products

Panel

CVE-2024-6401

SQLi in SFS Consulting's InsureE GL

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection. This issue affects InsureE GL: before 4.6.2.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Sfs Sfs Consulting

Products

Insuree Gl Insuree Gl

CVE-2024-6445

Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This issue affects DataDiodeX: from v3.0.0 before v3.1.7.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Dataflowx

Products

Datadiodex

CVE-2024-6684

Authentication Bypass in GST Electronics' inohom Nova Panel N7

Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass. This issue affects inohom Nova Panel N7: through 1.9.9.6. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVSS 4.0 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Gstelectronics

Products

Inohom Nova Panel N7

CVE-2024-6877

Reflected XSS in Eliz Software's Panel

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS. This issue affects Panel: before v2.3.24.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Eliz Software Elizsoftware

Products

Panel Panel

CVE-2024-6878

Directory Browsing in Eliz Software's Panel

Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations. This issue affects Panel: before v2.3.24.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Eliz Software

Products

Panel

CVE-2024-6917

RCE in Veribilim Software's Veribase Order Management

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection. This issue affects Veribase Order Management: before v4.010.2.

CVSS 4.0 · 10 Critical EPSS 1.3% KEV · Not listed

Vendors

Veribase

Products

Order Management Veribase Order Management