Know which CVEs
actually matter.

Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.

Arbitrary file write in pnpm package manager versions before 10.34.5 and 11.0.0-11.11.0 allows an attacker who can supply a crafted `pnpm-lock.yaml` to escape the `node_modules` directory boundary and place package contents at attacker-controlled filesystem paths when a developer runs `pnpm install`. Even `--ignore-scripts` does not prevent the file-write primitive; when the project additionally enables `dangerouslyAllowAllBuilds` or a matching `allowBuilds` configuration entry, the escaped package's lifecycle scripts execute with the victim user's OS-level privileges. Vendor-released patches are available as pnpm 10.34.5 and 11.11.0; no public exploit has been identified at time of analysis.

Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis.

Command injection in RedPort Optimizer wXa-203, wXa-213, and wXa-223 devices (firmware through 20260704) allows low-privileged remote attackers to execute arbitrary OS commands via the System Clock management endpoint. The vulnerable `exec()` call in `/xgatev1/system/datetime.php` accepts unsanitized user input, enabling shell metacharacter injection. A public proof-of-concept exploit has been disclosed via Feishu, the vendor did not respond to responsible disclosure, and no patch has been released, leaving operators without an official remediation path.

Server-side request forgery in Hyperledger Firefly up to 1.4.0 allows unauthenticated remote attackers to manipulate the webhook subscription URL parameter, causing the Firefly server to issue arbitrary HTTP requests to internal or otherwise inaccessible network resources. The vulnerability resides in the ValidateOptions function within the webhook subsystem (internal/events/webhooks/webhooks.go) and is exploitable without authentication or user interaction per the CVSS 4.0 AV:N/PR:N/UI:N vector. A public proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch or response has been identified at time of analysis.

Command injection in QVidium Opera11 (firmware 3.3.2a26-Ax4x-opera11) lets remote attackers run arbitrary OS commands by manipulating the ipaddr argument of the /cgi-bin/net_tr.cgi CGI script. The flaw is remotely reachable without authentication and publicly available exploit code exists, but it is not listed in CISA KEV. Because QVidium has ceased operations, no fix will ever be issued, making every deployed unit permanently vulnerable.

Path traversal in Dokploy's Traefik configuration handler exposes all versions through 0.29.7 to arbitrary file read and write by low-privileged authenticated remote users. The vulnerable function `writeTraefikConfigInPath` in the Settings component fails to sanitize the `path` argument before writing Traefik proxy configuration, enabling attackers to escape the intended directory and interact with sensitive files on the host filesystem. A public exploit is available and the vendor did not respond to responsible disclosure, leaving no official patch in place.

Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.

Unauthenticated SQL injection in ShopEx ECShop up to version 2.5.1 exposes e-commerce installations to remote database compromise via the cart update endpoint. The vulnerable parameter rec_id in /flow.php?step=update_cart is passed to the flow_update_cart function without sanitization, allowing remote attackers to execute arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed and no vendor patch is available, as the vendor did not respond to the disclosure.

Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sending a single POST request with millions of separator-delimited fields in an application/x-www-form-urlencoded body. Because Tornado's RequestHandler parses the body synchronously before handler dispatch using urllib.parse.parse_qs without a max_num_fields limit, a request body up to the 100 MB default max_buffer_size can consume all CPU on the single-threaded event loop and delay every concurrent connection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AV:N/AC:L/PR:N/UI:N) makes this trivially automatable against any exposed Tornado endpoint.

Stored XSS in Sulu CMS prior to versions 2.6.25 and 3.0.8 allows an authenticated attacker with media upload permissions to execute attacker-controlled JavaScript in a victim's browser on the Sulu origin. By uploading an HTML, XHTML, or XML file and crafting a download URL with the inline=1 query parameter, the attacker bypasses the expected Content-Disposition: attachment behavior, causing the browser to render the document instead of downloading it. When an authenticated victim opens the crafted link, the attacker's JavaScript executes with full access to the victim's Sulu-origin session and can read sensitive data or perform privileged actions on the victim's behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0.

Server-side request forgery in Wallos (versions 2.0.0 through 4.x) lets any authenticated user force the application server to open arbitrary outbound TCP connections to attacker-chosen hosts, including internal and link-local addresses. The per-user SMTP notification settings endpoint stores a user-supplied host without validation, and the notification cron job passes it directly to PHPMailer - no admin rights are required to abuse this path. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patched this in version 5.0.0.