HIGH 9.8 GitHub
CVE-2026-27975
Ajenti has potential Remote Code Execution
### Impact
An unauthenticated user could gain access to a server to execute arbitrary code on this server.
### Patches
This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.
Affected Products
- pip/aj < 2.2.13
References
- https://github.com/advisories/GHSA-vcw3-r3fx-j444
- https://github.com/ajenti/ajenti/security/advisories/GHSA-vcw3-r3fx-j444
- https://nvd.nist.gov/vuln/detail/CVE-2026-27975
- https://github.com/ajenti/ajenti/releases/tag/v2.2.13
This high severity vulnerability with a CVSS score of 9.8 was published on 2026-10-27 via GitHub. Affected: pip/aj < 2.2.13.
Risk Timeline
CVE Disclosed2026-10-27 · -1 days ago
Remediation Resources
NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2026-27975Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2026-35002 | Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall` | CRITICAL | 9.8 |
| CVE-2026-48705 | MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydic | CRITICAL | 9.3 |
| CVE-2026-112398 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execu | CRITICAL | — |
| CVE-2026-112393 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO | CRITICAL | — |
| CVE-2026-112900 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE | CRITICAL | — |
| CVE-2026-49272 | OAuthLib: Bearer token can be retrieved as long as client knows a valid client I | HIGH | 8.5 |
vulnfeed aggregates 18707 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.