CVE-2026-73034

DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 5.7% KEV · Not listed

Vendors

Dbgpt Eosphoros-ai

Products

Db-gpt Db-gpt

CVE-2026-70554

MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

CVSS 4.0 · 9.3 Critical EPSS 1.2% KEV · Not listed

Vendors

Max-3000 Maxsite

Products

Maxsite Cms Maxsite Cms

CVE-2026-70553

MaxSite CMS Unauthenticated RCE via Install Endpoint

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.

CVSS 4.0 · 9.3 Critical EPSS 1.3% KEV · Not listed

Vendors

Max-3000 Maxsite

Products

Maxsite Cms Maxsite Cms

CVE-2026-69100

LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed

Vendors

Dromara Tangyh

Products

Lamp-cloud Lamp-cloud

CVE-2026-69097

GitPython before 3.1.53 Config Injection via Submodule Names

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython

CVE-2026-68772

ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zenml

Products

Zenml

CVE-2026-67326

GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project Redhat

Products

Gitpython Gitpython Hummingbird

CVE-2026-67206

Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.

CVSS 4.0 · 8.7 High EPSS 2.1% KEV · Not listed

Vendors

Wolfcms

Products

Wolf Cms Wolfcms

CVE-2026-67192

Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.

CVSS 4.0 · 9.2 Critical EPSS 1.0% KEV · Not listed

Vendors

Xlightftpd

Products

Xlight Ftp Server

CVE-2026-66748

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-63720

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Koxudaxi

Products

Datamodel-code-generator

CVE-2026-61524

WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.

CVSS 4.0 · 8.6 High EPSS 1.0% KEV · Not listed

Vendors

Websitebaker

Products

Websitebaker

CVE-2026-61523

WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

CVSS 4.0 · 8.6 High EPSS 1.2% KEV · Not listed

Vendors

Websitebaker

Products

Websitebaker

CVE-2026-5857

Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments

Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Contiki-ng

Products

Contiki-ng

CVE-2026-54368

CentreStack < 17.4 SQL Injection via x-glad-filter Header

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gladinet

Products

Centrestack

CVE-2026-54363

CentreStack < 17.5 Hardcoded Key Token Forgery RCE

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gladinet

Products

Centrestack

CVE-2026-49143

BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Browserstack

Products

Browserstack-local Browserstack-runner

CVE-2026-48554

Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Nagios

Products

Nagios Core Nagios Xi

CVE-2026-48553

Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Nagios

Products

Nagios Core Nagios Xi

CVE-2026-43631

llama.cpp b7492–b9060 Use-After-Free RCE via llama-server

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Ggml Ggml-org

Products

Llama.cpp Llama.cpp