Reinforcement Coordination Engine

SGLang has two unauthenticated RCE issues and one unauthenticated path traversal tied to specific configs and endpoints.

CrewAI has vulnerabilities enabling RCE, arbitrary file read, and SSRF, with multiple CVEs tied to Code Interpreter and Docker fallback.

CISA details unsafe pickle deserialization in SGLang that can allow remote code execution via the ZMQ broker or replay_request_dump.py

Genshi template engine contains an SSTI that can allow arbitrary code execution on affected servers.

Livewire Filemanager flaw allows unauthenticated uploaded PHP files to execute on Laravel web servers.

Draytek Vigor routers with DrayOS firmware have a remote code execution flaw in EasyVPN and LAN interfaces enabling attacker control.