Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Salesforce Tableau Server on Windows and Linux allows authenticated attackers with low privileges to conduct Server-Side Request Forgery attacks through the Amazon S3 Connector module, enabling resource location spoofing that could result in unauthorized access to internal systems and data exfiltration. Versions before 2025.1.3, 2024.2.12, and 2023.3.19 are affected. EPSS score of 0.04% (12th percentile) indicates minimal observed exploitation activity, and no public exploit has been identified at time of analysis.
A null pointer dereference vulnerability exists in the AMD display driver within the Linux kernel, where the dce_hwseq structure is accessed without proper null checking in the dce110_blank_stream function. The vulnerability affects Linux kernel versions up to 6.16-rc2 and could allow a local attacker with low privileges to cause a system crash or potentially execute arbitrary code with kernel privileges. With an EPSS score of only 0.02% and no known active exploitation, this represents a low real-world risk despite the high CVSS score.
Out-of-bounds shift in the Linux kernel Squashfs filesystem allows a local attacker to trigger memory corruption by racing a LOOP_SET_BLOCK_SIZE ioctl against a concurrent Squashfs mount on the same loop device, causing sb_min_blocksize() to return 0 and the code in squashfs_fill_super() to compute a shift exponent of 64. The affected subsystem is the kernel Squashfs driver (fs/squashfs/block.c) on Linux and downstream distributions such as Debian 11. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.