This vulnerability in the Signal Level Attenuation Characterization (SLAC) protocol allows attackers to conduct man-in-the-middle attacks against electric vehicles and ISO 15118-2 compliant chargers by injecting spoofed signal level measurements. An attacker within close electromagnetic proximity can intercept and manipulate the wireless communication between EVs and chargers, potentially compromising the confidentiality and integrity of charging transactions. While the CVSS score of 6.3 indicates medium severity with low complexity exploitation, the EPSS score of 0.03% (6th percentile) suggests minimal real-world exploitation likelihood despite the critical nature of EV charging infrastructure.
Stack-based buffer overflow in QEMU's e1000 network device emulation allows local guest users to crash the QEMU process via crafted short frames in loopback mode, causing denial of service on the host. The vulnerability exists in the e1000_receive_iov() function where frame padding logic was removed from the device layer but loopback mode still processes short frames unsafely. No public exploit code or active exploitation in KEV has been reported at time of analysis.
Cross-site request forgery in the Bard WordPress theme by Qode Interactive allows attackers to trick logged-in administrators into performing unintended actions on behalf of the attacker. The vulnerability affects Bard versions up to and including 1.6. The flaw has a medium severity score, very low exploitation probability, and no reports of active exploitation or publicly available exploit code.
Broken access control in WebToffee's Smart Coupons for WooCommerce plugin (versions through 2.2.3) permits authenticated low-privileged users - such as subscribers or customers - to access coupon-related resources or functionality restricted to higher-privileged roles. The flaw stems from missing server-side authorization checks (CWE-862), allowing an attacker with any valid WordPress account to exploit incorrectly configured access control levels. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), indicating very low real-world exploitation probability at time of analysis.
Cross-Site Request Forgery in the Advanced Database Cleaner WordPress plugin (versions through 3.1.6) enables unauthenticated remote attackers to trigger unauthorized database operations on behalf of authenticated administrators. The attack requires social engineering - a logged-in WordPress admin must visit an attacker-controlled page or follow a crafted link - limiting scalable exploitation. No public exploit code has been identified at time of analysis, and EPSS places this in the 5th percentile (0.02%), reflecting very low real-world exploitation probability.