CVE-2026-73625

GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython

CVE-2026-72778

Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as behavior/event configuration during FieldLayout object creation. An attacker with an authenticated control panel session (and a valid CSRF token) can exploit this to execute operating system commands as the PHP/web user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Craft Cms

CVE-2026-73034

DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 5.7% KEV · Not listed

Vendors

Dbgpt Eosphoros-ai

Products

Db-gpt Db-gpt

CVE-2026-70554

MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

CVSS 4.0 · 9.3 Critical EPSS 1.2% KEV · Not listed

Vendors

Max-3000 Maxsite

Products

Maxsite Cms Maxsite Cms

CVE-2026-70553

MaxSite CMS Unauthenticated RCE via Install Endpoint

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.

CVSS 4.0 · 9.3 Critical EPSS 1.3% KEV · Not listed

Vendors

Max-3000 Maxsite

Products

Maxsite Cms Maxsite Cms

CVE-2026-69100

LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed

Vendors

Dromara Tangyh

Products

Lamp-cloud Lamp-cloud

CVE-2026-69097

GitPython before 3.1.53 Config Injection via Submodule Names

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython

CVE-2026-68772

ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zenml

Products

Zenml

CVE-2026-67326

GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project Redhat

Products

Gitpython Gitpython Hummingbird

CVE-2026-67206

Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.

CVSS 4.0 · 8.7 High EPSS 2.1% KEV · Not listed

Vendors

Wolfcms

Products

Wolf Cms Wolfcms

CVE-2026-67192

Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.

CVSS 4.0 · 9.2 Critical EPSS 1.0% KEV · Not listed

Vendors

Xlightftpd

Products

Xlight Ftp Server

CVE-2026-66748

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Owen2345 Tuzitio

Products

Camaleon Cms Camaleon Cms

CVE-2026-63720

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Koxudaxi

Products

Datamodel-code-generator

CVE-2026-61524

WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.

CVSS 4.0 · 8.6 High EPSS 1.0% KEV · Not listed

Vendors

Websitebaker

Products

Websitebaker

CVE-2026-61523

WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

CVSS 4.0 · 8.6 High EPSS 1.2% KEV · Not listed

Vendors

Websitebaker

Products

Websitebaker

CVE-2026-5857

Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments

Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Contiki-ng

Products

Contiki-ng

CVE-2026-54368

CentreStack < 17.4 SQL Injection via x-glad-filter Header

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gladinet

Products

Centrestack

CVE-2026-54363

CentreStack < 17.5 Hardcoded Key Token Forgery RCE

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gladinet

Products

Centrestack

CVE-2026-49143

BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Browserstack

Products

Browserstack-local Browserstack-runner

CVE-2026-48554

Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Nagios

Products

Nagios Core Nagios Xi