Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to defeat FortiCloud SSO login by submitting a crafted SAML response, due to improper verification of the response's cryptographic signature. The flaw is confirmed actively exploited (CISA KEV), with Arctic Wolf observing malicious SSO logins in the wild, and EPSS rates it at the 93rd percentile of likelihood. Combined with a 9.8 CVSS score and CWE-347 root cause, this is a top-priority patching target for any organization running affected Fortinet management planes.
OS command injection in OpenMPTCProuter through version 0.64 lets attackers write arbitrary files or execute arbitrary commands via the create_xor_ipad_opad function in the sysupgrade helper (common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c). Publicly available exploit code exists (published as a GitHub gist), and a vendor fix is available as an upstream commit; the flaw is not listed in CISA KEV and carries a modest EPSS of 0.59% (44th percentile), indicating no confirmed active exploitation at time of analysis. The submitted CVSS of 9.8 assumes remote unauthenticated access, but because the vulnerable code path is a firmware-upgrade helper, real-world exploitation likely depends on access to the router's upgrade functionality — verify against your deployment.
Arbitrary code execution in LeptonCMS 7.3.0 lets an authenticated attacker upload a crafted ZIP or PHP file that bypasses the application's missing file-type validation and runs as server-side PHP. Publicly available exploit code (three PoC write-ups) exists, though the flaw is not listed in CISA KEV and EPSS is low (0.66%, 47th percentile), indicating no evidence of widespread active exploitation yet. Exploitation requires a valid low-privilege account (PR:L), placing this in the post-authentication RCE category.
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL queries via the get_dashboard_data endpoint. Unsafe concatenation of user-controlled parameters into dynamic SQL statements enables data exfiltration and database manipulation. Publicly available exploit code exists. With CVSS 8.6 (Network/Low Complexity/Low Privilege Required), this represents a high-severity risk for organizations running the affected version, though no active exploitation (CISA KEV) has been confirmed.
Broken access control in OpenSIS 9.2 and earlier lets an authenticated low-privilege user (e.g. a student account) issue unauthorized database writes against other users' records via Student.php, enabling horizontal privilege escalation and tampering with data they should not control. Publicly available exploit code exists for this issue, though it is not listed in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no confirmed widespread exploitation yet.
OutSystems Platform Server version 11.18.1.37828 is reported to allow denial of service through HTTP request smuggling (CWE-444) by sending a crafted HTTP request where the Content-Length header value does not match the actual body length, disrupting the server's HTTP parser and causing service unavailability. The impact is limited to availability - no confidentiality or integrity exposure is indicated. Critically, the vendor has publicly stated they are unable to reproduce this vulnerability, and the PoC references point exclusively to personal blogs rather than established security research publications, introducing substantial uncertainty about the finding's validity. No public exploit identified at time of analysis has been confirmed by independent researchers or CISA KEV.
Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers to circumvent FortiCloud SSO login by sending a crafted SAML response message. The flaw stems from improper cryptographic signature verification (CWE-347), enabling forgery of authentication assertions. No public exploit identified at time of analysis, EPSS sits at 0.26% (50th percentile), and the issue is not currently listed in CISA KEV, though Fortinet products have historically been high-value targets.
Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).
JIT compiler miscompilation in Mozilla's JavaScript engine allows remote code execution without authentication in Firefox (versions <146, <115.31 ESR, <140.6 ESR) and Thunderbird (versions <146, <140.6 ESR). The CVSS 9.8 critical score reflects network-based exploitation requiring no user interaction. EPSS score of 0.10% (27th percentile) suggests low predicted exploitation probability despite severity. No public exploit identified at time of analysis, and vendor-released patches are available across all affected product lines per Mozilla security advisories MFSA2025-92 through MFSA2025-96.
Just-In-Time (JIT) compilation flaws in Mozilla's JavaScript engine allow unauthenticated remote attackers to achieve arbitrary code execution with high integrity and availability impact across Firefox and Thunderbird. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Despite a critical CVSS 9.8 score, EPSS probability remains low at 0.09% (25th percentile), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Vendor-released patches are available across all affected product lines.
Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.
Remote code execution in Mozilla Firefox and Thunderbird (pre-146) allows unauthenticated network attackers to execute arbitrary code via a use-after-free flaw in the GMP (Gecko Media Plugin) audio/video component. Despite a critical CVSS 9.8 rating, EPSS probability remains low (0.08%, 23rd percentile), and no public exploit identified at time of analysis. Mozilla patched both products in version 146, with vendor advisories and technical details available via Bugzilla.
Unauthenticated SQL injection in Talent Software UNIS versions prior to 42321 allows remote attackers to manipulate backend database queries over the network without any authentication or user interaction. The vulnerability carries a CVSS 9.8 rating reflecting full compromise potential across confidentiality, integrity, and availability, and was reported by Turkey's national CSIRT (USOM), though no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in Panilux versions before 0.10.0 can be chained to command injection, allowing remote attackers to execute arbitrary operating system commands when an authenticated user is tricked into visiting a malicious page. The CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C) reflects scope change and full CIA impact, though exploitation requires user interaction and the affected vendor has denied ownership of the product, complicating disclosure. EPSS is very low at 0.04% (11th percentile) and no public exploit is identified at time of analysis.
SQL injection in itsourcecode Student Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the grade parameter in /new_grade.php. Publicly available exploit code exists, but the EPSS score is low (0.05%) and no active exploitation has been reported via CISA KEV, suggesting limited interest or targeting.
SQL injection in itsourcecode Student Management System 1.0's promote.php endpoint allows remote attackers to manipulate the 'sy' parameter to execute arbitrary SQL queries, leading to potential data exposure or modification. A public proof-of-concept exploit exists, but there is no indication of active exploitation. The EPSS score
SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the Name parameter in /new_adviser.php to execute arbitrary SQL commands. An exploit is publicly available, though no active exploitation is confirmed (not in CISA KEV); EPSS score is low (0.05%).
SQL injection vulnerability in code-projects Employee Profile Management System 1.0 allows remote attackers to modify or retrieve database contents via the per_id parameter in edit_personnel.php. Exploit code is publicly available, but no active exploitation has been confirmed.
The Highlight and Share WordPress plugin up to version 5.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass access controls. Exploitation requires user interaction and can lead to unauthorized modification of plugin settings or limited information disclosure. Publicly available exploit code exists, but the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.
Local file inclusion in Wilmër WordPress theme versions before 3.5 allows authenticated attackers to include arbitrary local files, leading to sensitive information disclosure and potential remote code execution. No public exploit or active exploitation has been reported at time of analysis; EPSS score is low (0.22%).
Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.
Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).
Privilege escalation in Mozilla Firefox and Thunderbird's DOM Notifications component enables unauthenticated remote attackers to achieve high-severity impacts (confidentiality, integrity, availability) via user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and <140.6. EPSS exploitation probability is low (0.08%, 23rd percentile), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Vendor-released patches are available across all affected product lines.
Privilege escalation in Mozilla Firefox and Thunderbird Netmonitor component allows remote attackers to execute arbitrary code with elevated privileges when users interact with malicious content. Affects Firefox versions prior to 146, Firefox ESR prior to 140.6, Thunderbird prior to 146, and Thunderbird ESR prior to 140.6. Mozilla released patches in January 2025 across all product lines. EPSS score of 0.07% (22nd percentile) indicates low current exploitation probability, with no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. CVSS 8.8 reflects the high impact potential despite requiring user interaction.
Privilege escalation in Mozilla Firefox and Thunderbird's Netmonitor component allows unauthenticated remote attackers to gain elevated privileges via user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. With an 8.8 CVSS score but only 0.07% EPSS (22nd percentile), no public exploit identified at time of analysis, and vendor-released patches available. Not listed in CISA KEV, indicating no confirmed active exploitation.
Blind SQL injection in LambertGroup Accordion Slider PRO WordPress plugin versions through 1.2 allows authenticated attackers to exfiltrate sensitive database information. An attacker with low-privilege access (such as a subscriber) can execute arbitrary SQL queries via vulnerable plugin parameters, potentially accessing all database contents. No public exploit code or active exploitation has been reported, though the vulnerability carries a high confidentiality impact.
We need to produce a comprehensive analysis for CVE-2025-67517. Let's digest the data: - CVE ID: CVE-2025-67517 - Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Blind SQL Injection. Affected: ArtPlacer Widget: from n/a through <= 2.22.9.2. - CVSS Score: 8.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - CWE: CWE-89 (SQL Injection) - EPSS: 0.06% (percentile 19%) - very low. - Tags: SQLi - References: patchstack link only (no NVD entry? None). Description says "n/a" for NVD? Actually, references show [nvd] (None) and then a patchstack URL. So likely only Patchstack advisory, no CVE number on NVD yet? But the CVE is assigned. Patchstack is a WordPress vulnerability database. The reference is https://patchstack.com/database/Wordpress/Plugin/artplacer-widget/vulnerability/wordpress-artplacer-widget-plugin-2-22-9-2-sql-injection-vulnerability?_s_id=cve. Let's check: That URL leads to Patchstack's database. From the description, it's a Blind SQL Injection in the artplacer-widget WordPress plugin. Versions: up to 2.22.9.2. Patch? Not stated explicitly, but we can see if there's any info. No KEV status mentioned (presumably not in KEV). POC? Not given. So we'll base on CVSS vector and description. We need to output JSON with all fields. Many fields require synthesis. Let's break down: - product_name: "ArtPlacer Widget" (exact). So "ArtPlacer Widget". - summary: Original synthesis. Must not copy description. Need to say: "Blind SQL injection in ArtPlacer Widget up to 2.22.9.2 allows authenticated attackers with subscriber-level access (PR:L) to extract sensitive data from the database, with no user interaction required." Something like that. Start with impact verb: "Blind SQL injection vulnerability in ArtPlacer Widget plugin for WordPress (versions ≤ 2.22.9.2) enables authenticated users...". Include EPSS low, no KEV, no known active exploitation. Mention PR:L from CVSS. - technical_context: Underlying technology: WordPress plugin, SQL injection via improper neutralization (CWE-89). It's a blind SQLi, meaning attacker infers data based on application responses (time-based, boolean, etc.). CPE? None given, but we can infer WordPress plugin. The plugin likely constructs SQL queries without proper sanitization. So explain that. - risk_assessment: CVSS 8.5, AV:N, low complexity, PR:L, no user interaction, scope changed (C:H, I:N, A:L). EPSS 0.06% extremely low. Not in KEV. No POC info. So real-world risk: despite high CVSS, exploitation requires authenticated access (Subscriber role maybe) and EPSS suggests low likelihood of widespread exploitation. SSVC: Automatable? Possibly low complexity, but PR:L reduces automatable? According to SSVC, exploitation requires authenticated credentials, which might not be automatable without stolen credentials. However, the vector suggests AC:L, so once authenticated, it's easy. Technical impact total: confidentiality high, availability low. So SQLi can exfiltrate data. No KEV, no POC, so risk is moderate to low. Compare: Low exploitation probability, but high impact if exploited. Need to note missing info: Patch version not disclosed, vendor advisory unknown. So assessment: This is a blind SQLi that requires authentication, limiting risk. EPSS low; not actively exploited. Prioritize patching if it's widely used but prevalence is low. - affected_products: "ArtPlacer Widget plugin for WordPress up to and including version 2.22.9.2. No vendor advisory with patched version available in provided data; refer to Patchstack advisory link." Might need to include that. The description says "from n/a through <= 2.22.9.2", so all versions up to that are vulnerable. The patchstack link may have a fix version? We don't have that info. So we say "versions <= 2.22.9.2 are affected; a patched version may exist beyond 2.22.9.2, but not confirmed." - remediation: No explicit patch version. Patchstack advisory likely recommends updating to a later version. But we don't have that. So we'll say: "Upgrade the ArtPlacer Widget plugin to the latest available version. If no patch exists, consider disabling the plugin or restricting database access. As a workaround, implement Web Application Firewall rules to block SQL injection attempts." But we need specific. The data given has no fixed version. So "No vendor-released patch version identified at time of analysis; the Patchstack advisory does not list a fixed version. Users should monitor vendor updates. Temporary mitigation: disable the plugin if not critical, or apply WAF rules for SQLi." Should we say "Upgrade beyond 2.22.9.2"? That would be an assumption if a later version exists. Could say "upgrade to a version later than 2.22.9.2 if available". According to Patchstack, the vulnerability was reported by audit@patchstack.com, maybe they coordinated with vendor. The reference link might contain fix version. I'll assume the advisory might say "fixed in 2.22.9.3" or something, but we don't have that data. So safest: "No specific patched version provided in the available data; monitor the Patchstack entry for updates. As a short-term measure, deactivate the plugin or enforce strict input validation via a WAF." That's acceptable. We'll mention Patchstack URL. - exploit_scenario: An authenticated attacker with at least subscriber-level privileges on a WordPress site sends a crafted request to a vulnerable endpoint (likely a widget AJAX action) containing SQL injection payload. The application returns differing responses (or time-based delays) enabling extraction of sensitive data like user credentials or database contents. Mention POC unknown. - exploitation_conditions: Need specific conditions from description. The description only says "in artplacer-widget allows Blind SQL Injection", no specifics about configuration. But CVSS says PR:L, so requires low-privilege authentication. So: "Exploitation requires an authenticated user account on the WordPress site with minimal privileges (Subscriber or above). No special plugin configuration or feature enablement is needed — the vulnerable SQL query is reachable by authenticated users." That's specific. No mention of non-default settings, so default installation is vulnerable if authenticated. - attack_chain: 3-7 steps. Using kill chain: "Recon → Delivery → Exploit → Install → C2 → Execute → Impact"? For SQLi, probably: "Access WordPress site as subscriber → Send crafted SQL payload in widget request → Blind SQL injection extracts data → Exfiltrate sensitive database content". 4 steps. Action: "Obtain subscriber credentials (or register) → Interact with vulnerable widget endpoint → Inject SQL payload → Read database via blind inference". So: "Authenticate as low-privilege user → Send malicious SQL query via widget AJAX call → Observe application response differences → Extract sensitive database records". That's four. We'll format with arrows. - confidence_notes: What is confirmed? Vulnerability confirmed by Patchstack. Affected versions up to 2.22.9.2. CVSS vector provided. No vendor advisory outside Patchstack. POC and fix version unknown. Not in KEV. So: "Vulnerability confirmed by Patchstack with CWE-89 and CVSS vector. No vendor advisory or fix version confirmation available. Exploitation status unknown (no KEV, no POC reported)." - prevalence: ArtPlacer Widget is a WordPress plugin, likely for displaying art. How widely used? Not in the WordPress.org plugin directory? Could be a premium/commercial plugin. Prevalence likely low or rare. The term "artplacer" might be a niche plugin for art galleries. Probably low. So "low". Basis: "niche WordPress plugin for art galleries". So prevalence_basis: "niche WordPress plugin with limited deployment". - assessed_cvss_vector: We'll reassess based on the same information. The given CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. That seems appropriate: Blind SQLi, network, low complexity, PR:L (authenticated), no UI, scope changed (SQL injection can affect database outside plugin scope), confidentiality high, integrity none, availability low. So we can keep that vector, but it's our own independent assessment. I'd say it's accurate, so same vector. However, the instruction says "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." But I can still output the same one if I independently agree. The given score is from Patchstack, so it's theirs. I'll adopt it and justify it. So vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. I must confirm PR:L reflects that attacker must be authenticated as a low-privileged user. That's correct. The availability impact is low (A:L), perhaps causing some disruption? But blind SQLi usually doesn't affect availability; maybe via information leakage? Actually, A:L could be from potential DoS or data exfiltration that slightly degrades? But I'd set A:N unless there's a reason. However, the given says A:L, I'll accept that because blind SQLi could cause resource consumption or database locking? I'm not sure, but I'll keep as is. Maybe it's because scope changed, and the impacted component (database) has low availability impact. I'll just go with it. assessed_cvss_rationale: "Network-exploitable blind SQLi requiring low-privilege authentication; high confidentiality impact from data exfiltration, limited availability impact." That's within 25 words. - assessed_cvss40_vector: Map from CVSS 3.1. CVSS 4.0 base: AV:N (Network), AC:L (Low), AT:N (no attack requirements), PR:L (Low), UI:N (None), VC:H (confidentiality high), VI:N (integrity none), VA:L (availability low?), SC:N (no subsequent system? For scope changed in 3.1, in 4.0 we separate vulnerable system and subsequent system. The vulnerability is in the plugin (vulnerable system) but impacts the database (subsequent system). In 4.0, we need to set VC/VI/VA for the vulnerable system (the plugin) and SC/SI/SA for the subsequent system (the database). The description says Blind SQL Injection; the plugin is the vulnerable component, but the impact is on the database (confidentiality high, availability low). So vulnerable system itself might have limited impact? Typically, SQLi leads to data exfiltration from the database, which is a different security scope. So we set VC:N, VI:N, VA:N for the plugin? Actually, the vulnerable system is the ArtPlacer Widget, which processes the query. The impact is on the database system (subsequent). So in 4.0: VC:N (confidentiality impact on vulnerable system is none, because the data is accessed from the database), VI:N, VA:N (but maybe the plugin's availability is affected? Probably not). Then SC:H (subsequent confidentiality high), SI:N (no integrity impact on database), SA:L (low availability impact on database). So vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L. Check: The standard mapping from CVSS 3.1 when scope changed is: VC = same as vulnerable component impact, VI, VA usually N, and SC/SI/SA = subsequent impacts. In 3.1, C:H, I:N, A:L, and scope changed. So vulnerable component (plugin) had no confidentiality impact? But the C:H was the overall confidentiality impact, which in 3.1 with scope changed is the impact on the impacted component (database). So actually in 3.1, for scope changed, the base score uses the impact sub-score based on the impacted component (database) confidentiality, integrity, availability. The vulnerable component's own CIA are typically considered none. So for the new vector, I'll set VC:N, VI:N, VA:N, and SC:H, SI:N, SA:L. So vector: CVSS:4.0/AV:N
Blind SQL injection in Agile Logix Store Locator WordPress plugin version 1.6.2 and below allows authenticated low-privileged users (e.g., subscriber) to extract sensitive data from the WordPress database
SQL injection in the WordPress plugin Image&Video FullScreen Background through version 1.6.7 allows authenticated attackers with low privileges to extract sensitive information from the database. The vulnerability has a high confidentiality impact but does not permit data modification. No public exploit or active exploitation has been reported, and the EPSS score of 0.05% indicates a low probability of real-world attacks.
Local code execution in Microsoft Office (365 Apps, Office 2016/2019, and Office LTSC 2021 across Windows, macOS, and Android) stems from a use-after-free memory corruption flaw tracked as CVE-2025-62557. An attacker who entices a user to open a crafted document can achieve arbitrary code execution with the privileges of the current user, with no public exploit identified at time of analysis. The CVSS 8.4 rating reflects high impact across confidentiality, integrity, and availability despite the local attack vector.
Local code execution in Microsoft Office (365 Apps, Office 2016/2019, Office LTSC 2021, and Office for Android/macOS) stems from a type confusion flaw (CWE-843) that lets an attacker run arbitrary code in the context of the current user. Despite PR:N/UI:N in the CVSS vector, the AV:L attack vector means the attacker must deliver a malicious document to be opened on the target host. No public exploit has been identified at time of analysis and the CVE is not on the CISA KEV list.
Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).
Multiple memory corruption flaws in Firefox and Thunderbird enable remote code execution via network-accessible attack vectors. Mozilla Firefox ESR 140.5, Firefox 145, Thunderbird ESR 140.5, and Thunderbird 145 contain memory safety bugs with evidence of corruption that Mozilla presumes exploitable for arbitrary code execution. Authentication requirements not confirmed from available data (CVSS vector shows PR:N). Vendor-released patches available: Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6. EPSS probability is low (0.09%, 25th percentile), and no public exploit identified at time of analysis.
Sandbox escape in Mozilla Firefox and Thunderbird's CanvasWebGL component allows remote attackers to bypass security boundaries via crafted web content with user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and Thunderbird ESR <140.6. EPSS probability is low (0.06%, 20th percentile), and no public exploit identified at time of analysis. The CVSS score of 8.0 reflects high confidentiality and integrity impact with scope change, though attack complexity is high and requires user interaction.
Local privilege-relevant out-of-bounds kernel write in the Linux kernel's SCTP subsystem lets an unprivileged local user corrupt kernel heap memory by exploiting a time-of-check/time-of-use (TOCTOU) gap in the SCTP diagnostic dump path (sctp_diag_dump → sctp_for_each_endpoint → sctp_ep_dump), which runs without holding the socket lock. Because the address list can grow between buffer allocation and the subsequent write, an attacker who races the dump against concurrent address additions can force a write past the allocated bounds, yielding potential memory corruption (CVSS 7.8, C/I/A High). There is no public exploit identified at time of analysis and EPSS is low (0.21%, 12th percentile), consistent with a race-dependent local flaw rather than a mass-exploited network bug.
A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.
Arbitrary code execution in Adobe Acrobat Reader DC and Acrobat DC (all editions through versions 25.001.20982, 24.001.30273, and 20.005.30803) occurs when malicious files manipulate the application's DLL search path. Attackers achieve full code execution with current user privileges through local attack requiring social engineering to open a crafted PDF or related file. Adobe confirms the vulnerability in security bulletin APSB25-119 with patches released for all affected product lines. EPSS data not provided, but the local vector with required user interaction (AV:L/UI:R) and lack of CISA KEV listing suggest lower probability of widespread automated exploitation compared to remote vulnerabilities, though targeted attacks via phishing remain viable.
Authenticated SQL injection in the Media Library Tools WordPress plugin (≤1.6.15) allows high-privilege attackers to extract sensitive database information, with CVSS 7.6 signaling high confidentiality impact but limited integrity impact; no active exploitation or public exploit code is known, and EPSS indicates very low exploitation probability (0.06%).
SQL injection in the Ninja Tables WordPress plugin (≤5.2.3) enables authenticated administrators to extract sensitive database contents. The flaw allows high-privileged users to perform unauthorized SQL queries, compromising confidentiality with limited availability impact. No active exploitation or public PoC has been reported, and EPSS indicates very low exploitation probability.
Local file inclusion in the Hara WordPress theme (versions <= 1.2.17) allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure, code execution via PHP file inclusion chains, or full site takeover. The attack requires high complexity, and no exploit code or active exploitation has been publicly identified at the time of analysis.
Local File Inclusion vulnerability in the Turitor WordPress theme before version 1.5.3 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to information disclosure, code execution, or denial of service. No public exploit or active exploitation known at this time.
Local file inclusion vulnerability in thembay's Besa WordPress theme (versions <=2.3.15) allows authenticated users with low privileges to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The CVSS 3.1 base score of 7.5 reflects high impact but requires authentication and high attack complexity. No active exploitation or public exploit code is known at the time of analysis.
Authenticated local file inclusion in the Fashion WordPress theme versions below 5.3.0 allows low-privilege attackers to read arbitrary files and potentially execute code through path traversal in include/require statements. No active exploitation or public proof of concept is known at this time; EPSS probability of exploitation is low (0.22%).
Local File Inclusion in the Digiqole WordPress theme allows authenticated users to include arbitrary local files, leading to potential full system compromise. Versions prior to 2.2.7 are affected. The vulnerability has a high CVSS score but low EPSS exploitation probability and no known public exploit or active exploitation.
Local file inclusion in the ThimPress Sailing WordPress theme before version 4.4.6 allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving remote code execution. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) with a low EPSS probability (0.22%), indicating no active exploitation or publicly available exploit code at this time.
Authenticated local file inclusion in the ekommart WordPress theme before version 4.3.1 allows low-privileged users to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability stems from improper validation of user-supplied input used in PHP include statements.
Local file inclusion in Jobmonster Elementor Addon up to 1.1.4 allows authenticated attackers with low privileges to include arbitrary local files. Successful exploitation can lead to high confidentiality, integrity, and availability impacts. No active exploitation or public exploit code is currently known; EPSS score is low.
Local File Inclusion in the Exhibz WordPress theme (version ≤ 3.0.9) allows authenticated attackers with low privileges to include arbitrary local files on the server, potentially leading to sensitive data exposure or-when combined with file upload-remote code execution. Exploitation requires high attack complexity and no user interaction; there is no evidence of active exploitation or public exploit code as of this analysis.