Code execution on Gogs servers is possible through improper symbolic-link handling in the repository file editor's PutContents API, which allows an authenticated user holding write/push access to at least one repository to plant a symlink and redirect file writes outside the repository working directory. The issue is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and the EPSS score is 85.20% (100th percentile), placing it among the highest-priority items to patch. Exploitation requires only repository write permission - no victim interaction is needed (CVSS 3.1 vector PR:L, UI:N) - and it is rated CVSS 8.7.
Unauthenticated remote code execution in the Barracuda RMM Service Center component (part of the RMM managed-service-provider solution) affects all versions prior to 2025.1.1 and allows an attacker to achieve arbitrary file write and drop a webshell by supplying a crafted WSDL document whose URL the application loads without validation. Per the CVSS vector (PR:N/UI:N/AT:N), no authentication, no user interaction, and no non-default configuration are required - the only practical precondition is network reachability of the Service Center endpoint. Publicly available exploit code exists (WatchTowr's SOAPwn research and a VulnCheck advisory), and EPSS is elevated at 24.72% (98th percentile), though the flaw is not confirmed actively exploited (CISA KEV); the scoring reflects a genuine high-priority risk rather than a high-CVSS-but-low-real-risk case.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B20230113 by abusing an authorization bypass in the cstecgi.cgi endpoint, and then log in as root using a blank password on factory-reset devices, yielding arbitrary command execution. Publicly available exploit code exists (a detailed write-up is referenced by NVD), and EPSS places this at roughly 11.28% (96th percentile), indicating elevated real-world interest, though there is no CISA KEV confirmation of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the bypass is fully unauthenticated and requires no user interaction; risk is highest where the router's web management interface is reachable from the WAN or an untrusted network.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stems from an undocumented remote access mechanism that lets network-reachable attackers run arbitrary commands without authentication or user interaction. The issue is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though no CISA KEV record is provided confirming active exploitation. EPSS is 0.98% (61st percentile), indicating lower modeled near-term exploitation probability despite the severe impact if reachable.
A critical authentication bypass and path traversal vulnerability in PipesHub AI platform allows unauthenticated remote attackers to upload files with directory traversal sequences, enabling arbitrary file writes anywhere the service account has permissions. This vulnerability affects PipesHub versions prior to 0.1.0-beta and has a publicly available proof-of-concept exploit, making it an immediate priority for organizations using this enterprise search and workflow automation platform. With a CVSS score of 9.8 and the ability to plant malicious code or overwrite critical files, this represents a severe risk to affected systems.
SQL injection in WBCE CMS 1.6.4 and earlier lets an authenticated user who already holds the 'modify users' permission execute arbitrary SQL through the groups[] parameter handled by admin/users/save.php, enabling full database compromise and data exfiltration. Publicly available exploit code exists (detailed in the GitHub security advisory), and EPSS is low at 0.54% (43rd percentile), indicating limited observed exploitation activity. Vendor-released patch: 1.6.5. The assessed severity is high but access-gated, since exploitation requires an elevated administrative-tier account rather than anonymous access.
SQL injection in WeGIA 3.5.4 and earlier allows an authenticated user who holds edit-level permission on the matPat (materials/patrimony) module to execute arbitrary SQL against the backend database via the id_categoria parameter of /html/matPat/editar_categoria.php. Because the endpoint enforces an active session and a resource-22 permission check, exploitation realistically requires a legitimate privileged account or stolen credentials rather than an anonymous remote attacker, although publicly available exploit code exists and the CVSS 4.0 base score of 9.4 reflects full confidentiality, integrity and availability impact on both the vulnerable system and downstream components. The vendor addressed the flaw in WeGIA 3.5.5; EPSS is low at 0.51% (42nd percentile) and there is no indication of confirmed active exploitation in CISA KEV.
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows a nearby attacker within BLE radio range to overwrite the device firmware with arbitrary code, achieving remote code execution and causing the owner to lose complete access to the device. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH), reflecting an adjacent, unauthenticated attack with no user interaction. Publicly available exploit code exists, but no CISA KEV confirmation is present; EPSS is 0.56% (44th percentile).
Remote code execution in XWiki Rendering versions prior to 16.10.10, 17.4.3, and 17.6.0-rc-1 allows any authenticated user with edit rights-including the ability to edit their own profile-to inject script macros via insufficiently escaped {{/html}} syntax. Successful exploitation enables arbitrary Groovy or Python macro execution, granting full read/write access to all wiki contents. Public exploit code is available (EPSS 1.02%, 62nd percentile), and though not confirmed actively exploited, the low privilege requirement makes immediate patching critical.
Local privilege escalation in the sd command-line find-and-replace utility (versions 1.0.0 and earlier, by chmln) allows a local attacker to gain root privileges through a crafted command. The flaw stems from incorrect privilege assignment (CWE-266) and is exploitable locally with no authentication indicated by the CVSS vector (PR:N), yielding full confidentiality, integrity, and availability compromise. Publicly available exploit code exists (proof-of-concept gist), though the EPSS score is low at 0.18% (8th percentile), and the CVE is not listed in CISA KEV.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.
Unauthenticated path traversal in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions up to and including 1.7.1) lets remote attackers read arbitrary files from the web server by abusing the plugin's template_redirect() handler, exposing wp-config.php database credentials, API keys, and other sensitive data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote, unauthenticated exploitation with high confidentiality impact but no integrity or availability effect, and the only prerequisite is that the plugin is installed and active on a default WordPress configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though the EPSS score of 2.21% (82nd percentile) indicates a non-trivial and above-average likelihood of exploitation activity in the near term.
Local privilege escalation in Windscribe VPN for Linux Desktop lets a user who is a member of the 'windscribe' group execute arbitrary commands as root by supplying a crafted 'adapterName' value to the privileged helper's 'changeMTU' function. Only Linux builds prior to v2.18.3-alpha and v2.18.8 are affected, and exploitation mandates an existing local account with windscribe-group membership, so it is not remotely reachable. Publicly available exploit code exists (a published write-up), EPSS is modest at 1.25% (68th percentile), there is no KEV listing, and the vendor has shipped a fix.
Command injection in Aqara hub firmware - Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 - lets an attacker who can get the device to process an attacker-controlled domain name/hostname execute arbitrary commands with root privileges. Delivery is gated: the CVSS vector (AV:L/AC:L/PR:L/UI:R) indicates local-network-adjacent access, low-privileged credentials (e.g. a paired companion-app session), and a user-triggered action are required; our own assessment raises the access vector to AV:A (adjacent network) because 'malicious domain names' implies DNS/network-borne delivery rather than physical console access. Publicly available exploit code exists (a detailed GitHub write-up), but the flaw is not in CISA KEV and EPSS is modest at 0.80% (55th percentile), so exploitation in the wild is not confirmed; only the exact firmware builds listed are confirmed affected.
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.
Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).
Remote code execution is possible in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier through a file-upload code path that does not block dangerous file types, letting an uploaded executable payload run on the server and, because the scope is changed, potentially compromify the underlying host rather than just the ColdFusion application. Exploitation is remote (AV:N), low complexity (AC:L), and requires no user interaction, but it does require a high-privileged account as reflected by PR:H in the CVSS vector, which is the primary limiting factor. There is no confirmed in-the-wild exploitation and no public exploit identified at time of analysis, but the EPSS score of 10.56% (96th percentile) marks this as a genuinely high-priority issue that should be patched on an accelerated schedule.
Arbitrary command execution with root privileges is possible on Aqara Camera Hub G3 devices running firmware 4.1.9_0027 when the hub scans a maliciously crafted QR code during initial device setup or a factory reset. Because the attack vector is physical (CVSS AV:P) and requires a user or operator to perform the scan action (UI:R), exploitation is limited to those provisioning windows and is not possible against an already-configured hub in normal operation; the CVSS 3.1 base score is 6.6. Publicly available exploit code exists (a detailed PoC write-up is published), but the vulnerability is not confirmed as actively exploited (not in CISA KEV), and EPSS is low at 1.11% (64th percentile).
Reflected cross-site scripting in XWiki Platform's Flamingo Skin Resources and Web Templates lets an attacker craft a URL whose xredirect parameter is rendered unsafely into a deletion-confirmation message, executing attacker-controlled script when the victim clicks the "No" button. All instances of both packages from 6.2-milestone-1 through 16.10.9, and from 17.0.0-rc-1 through 17.4.1, are affected; the flaw no longer exists on 16.10.10, 17.4.2, or 17.5.0+. No attacker authentication is required (PR:N) but exploitation is interaction-dependent (UI:R), and while the base impact on a low-privileged victim is limited, a victim holding admin or programming rights can be leveraged to perform arbitrary actions, including remote code execution. Publicly available exploit code exists and EPSS estimates a low 0.51% probability (41st percentile), with no confirmed active exploitation in CISA KEV.
Malformed JSON delivered to Aqara Hub M2 (4.3.6_0027), Hub M3 (4.3.6_0025), and Camera Hub G3 (4.1.9_0027) firmware crashes the JSON-processing routine through a NULL-pointer dereference, causing a denial of service on the affected hub. The vulnerability is only reachable by an attacker positioned on the same adjacent/local network as the device (AV:A, PR:N, UI:N), so it is not exploitable directly from the internet, and impact is limited to availability - no confidentiality or integrity loss is assessed. Publicly available exploit code exists (a GitHub write-up demonstrating the malformed-JSON trigger), but there is no CISA KEV confirmation of active exploitation, and EPSS is low at 0.28% (19th percentile), reflecting the adjacent-network prerequisite; overall this is a genuine but low-priority issue.
Unauthenticated Bluetooth Low Energy (BLE) command execution against the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows any proximity attacker to issue shutdown, restart, or factory-reset commands without credentials, resulting in a denial of service. The clear-config command is particularly disruptive: it dissociates the device from its owner account, severing the connection to the Meatmeet cloud backend and requiring full device re-provisioning before temperature data can be received again. A public proof-of-concept is available via a GitHub gist, though EPSS sits at 0.27% (19th percentile), reflecting the niche consumer IoT footprint rather than low technical reproducibility.
Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier can occur when a high-privileged attacker supplies maliciously crafted serialized data and induces user interaction to trigger deserialization. The flaw is network-reachable and, if exploited, can change scope and fully compromise confidentiality, integrity, and availability, but it requires an authenticated high-privilege (PR:H) account plus a user action (UI:R), so it is not remotely unauthenticated. No public exploit identified at time of analysis; no CISA KEV status is provided, EPSS is 9.54% (95th percentile), and Adobe has published advisory APSB25-105 for patching.
Open redirect in Taguette 1.5.1 and earlier lets a remote attacker send an authenticated or about-to-authenticate user to an arbitrary external website by appending a crafted 'next' parameter to the legitimate instance's /login or /cookies URL, which the application passes unvalidated into its HTTP redirect. Per the supplied CVSS vector the attacker needs no privileges (PR:N) but the victim must be lured into clicking the link and completing login or accepting the cookie prompt (UI:R), and the impact is limited to browser-level redirection for phishing, credential harvesting, or malware delivery rather than server compromise. Exploit code is publicly available in the GHSA-5923-r76v-mprm advisory, no CISA KEV entry indicates active exploitation, and EPSS is low at 0.26% (17th percentile); this is a genuine but moderate-priority issue, not a critical one.
Unauthenticated remote code execution affects the Barracuda Service Center component of Barracuda RMM in all versions prior to 2025.1.1, where a .NET Remoting endpoint deserializes attacker-supplied type data without adequate restrictions. Per the NVD-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impact metrics High, base score 10.0) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), any default installation whose Remoting port is reachable from an untrusted network can be compromised without credentials or user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is 0.71% (52nd percentile), indicating below-median near-term exploitation likelihood, though the trivial attack prerequisites make the practical risk highly dependent on network exposure of the Service Center endpoint.
Remote code execution in Barracuda RMM's Service Center component (versions prior to 2025.1.1) allows unauthenticated network attackers to run arbitrary code on the server by supplying a malicious WSDL whose service name is not properly validated, enabling insecure reflection into arbitrary method calls or deserialization of untrusted types. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 10.0, matching our independent CVSS 3.1 assessment of 10.0, meaning remote, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact on both the vulnerable host and subsequent systems. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is only 0.71% (52nd percentile), so severity is maximum but observed exploitation activity remains low; the primary practical limiter is network reachability of the Service Center endpoint, typically the central management server rather than the managed agents.
Authentication bypass in the Elated Membership plugin for WordPress (all versions up to and including 1.2) allows unauthenticated remote attackers to log in as an administrative user, giving them full control of the site. The flaw sits in the plugin's Facebook/social-login handlers (eltdf_membership_check_facebook_user and eltdf_membership_login_user_from_social_network), which verify a user's identity and then fail to actually bind the resulting session to that verified identity, instead trusting an email value to select the account. Exploitation is authenticated-bypass in nature but not opportunistic: the attacker must already hold some account on the target site (trivially obtained because the plugin's temp-user functionality creates accounts by default) and must know or have access to the targeted administrator's email address, which is the primary limiting factor; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS remains low at 0.48% (40th percentile) despite the 9.8 CVSS rating.
Hardcoded Wi-Fi credentials embedded in Meatmeet Pro WiFi & Bluetooth meat thermometer firmware version 1.0.34.4 (CWE-798) can be recovered by anyone who obtains and reverse-engineers the firmware image, after which an attacker could join the vendor's internal test network if they also independently locate that physical network, or-if they are within close physical proximity during the device's first setup-stand up a rogue access point using the recovered SSID and password so the thermometer auto-connects to attacker-controlled infrastructure. The device is not exploitable over the public internet: our assessment rates the flaw CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (~4.2 Medium), so the published 9.8 CRITICAL score is grossly overstated relative to the described attack paths. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.43% (35th percentile), indicating low practical exploitation likelihood.
Unauthenticated remote attackers can exploit a stack-based buffer overflow in the check_account() function of WAGO 852-1328 and 852-1322 industrial switch firmware, leading to full device compromise. The flaw arises from unsafe sscanf calls that write arbitrary data into fixed-size stack buffers without bounds checking. With a CVSS score of 9.8, the vulnerability is critical, though EPSS indicates low exploitation likelihood (0.43%); no public exploit identified at time of analysis. Affected devices are typically deployed on segmented OT networks, limiting exposure to attackers with network access to the management interface.
Unauthenticated remote stack compromise affects WAGO 0852-1328 and 0852-1322 industrial Ethernet switch firmware, where unsafe sscanf parsing inside the check_cookie() function writes attacker-controlled data into fixed-size stack buffers, yielding a full device compromise at CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with no credentials, no user interaction, and default configuration. The practical barrier is exposure rather than exploitation difficulty: these are OT/ICS switches normally deployed on segmented plant networks, so reachability usually presumes an attacker already positioned on the operational network or a management interface improperly exposed via firewall or VPN misconfiguration. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EPSS is low at 0.43% (35th percentile), but the outcome of full device compromise means any internet- or VPN-reachable unit should be patched or isolated promptly.
Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVariant parser by supplying maliciously crafted serialized/text input, resulting in denial of service and potentially arbitrary code execution. Any application linking GLib that deserializes untrusted GVariant data is exposed, which spans broad swaths of the Linux desktop and system stack across Red Hat Enterprise Linux 7-10 and SUSE. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.26%, 49th percentile) despite the 9.8 CVSS, indicating the headline severity is not yet matched by observed exploitation interest.
Arbitrary SQL execution in Neuron AI 2.8.11 and earlier lets a remote, unauthenticated party who can influence an agent's input run destructive statements - DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related commands - through the optional MySQLWriteTool, bounded only by the privileges of the MySQL account the tool connects with. The root cause is that the tool hands caller-supplied SQL directly to PDO::prepare() and execute() with no semantic restrictions, an instance of CWE-250 (Execution with Unnecessary Privileges). Practical exploitation requires three conditions to co-occur: MySQLWriteTool explicitly enabled, the agent exposed to untrusted input for direct or indirect prompt injection, and a broadly privileged DB user, so the published 9.4 (AC:L) score overstates real reach; EPSS is 0.41% (32nd percentile) and no public exploit has been identified at time of analysis. The vendor fixed the issue in 2.8.12.
Unauthenticated access to a specific URL on affected D-Link cameras returns device configuration data, including account credentials, to any party that can reach the camera's web service - no login, no user interaction, and no special client state required (CVSS 4.0 base 9.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N). CISA's ICS team published the finding as ICSA-25-343-03 alongside D-Link's own security announcement SAP10462, but the exact affected model(s) and firmware versions are not enumerated in the available data and must be confirmed against those advisories. No public exploit code or in-the-wild exploitation has been identified at time of analysis (no CISA KEV listing; EPSS 0.78%, 55th percentile), so the immediate risk is driven less by exploit chatter than by whether a given camera's web interface is reachable from an untrusted network.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets remote attackers execute attacker-controlled script in the origin of the AEM instance once a victim loads a crafted page or follows a crafted link, enabling session takeover of authenticated users and browser-context code execution. No attacker credentials are required (PR:N) but the issue is gated by mandatory victim interaction (UI:R), and the scope change (S:C) in the CVSS vector reflects the injected script crossing out of the untrusted page into the AEM trust boundary; default configurations of 6.5.23 and earlier, AEM Cloud Service, and 6.5 LTS are reported as affected per the CPE data. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.74% (53rd percentile), consistent with a high-severity but interaction-dependent client-side flaw rather than a wormable one.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, the AEM Cloud Service, and the AEM 6.5 LTS release lets unauthenticated remote attackers run arbitrary script in the context of a victim's browser, which can lead to session takeover and high confidentiality and integrity impact. The only gating factor is user interaction (CVSS UI:R): a victim - realistically an authenticated AEM author or admin holding a valuable session - must load an attacker-crafted page or link that feeds attacker-controlled input into a vulnerable client-side DOM sink. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is 0.64% (48th percentile), indicating low near-term exploitation probability by mass scanning, though the 9.3 base score and AEM's role as an enterprise content platform keep it a priority patching target.
Authentication bypass in the GTT Tax Information System allows an attacker who can reach or impersonate the local WebSocket that brokers Active Directory (LDAP) logins to authenticate as any user in the domain without valid credentials. Our independent assessment rates this CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is exploitable without authentication and without user interaction, but the attacker must already have access to the machine running the application or a position on the internal network from which the local WebSocket can be spoofed - it is not reachable from the open internet, even though the vendor's CVSS:4.0 vector (9.3) uses AV:N. EPSS is 0.57% (46th percentile) and there is no public exploit identified at time of analysis; successful exploitation fully compromises the confidentiality, integrity and availability of the application and its data.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets an unauthenticated remote attacker execute arbitrary JavaScript in the browser of a victim who visits a crafted page or clicks a crafted link while holding an active AEM session (author or publish), enabling session takeover and theft or manipulation of data in the victim's context. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3), so the high confidentiality and integrity impact is entirely gated on user interaction; the flaw yields browser-context script execution, not server or OS-level code execution. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS is a low 0.48% (39th percentile), consistent with a real but interaction-gated web vulnerability rather than a drive-by critical.
Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier is reachable by an attacker who already holds high privileges on the affected server, and requires no user interaction once that precondition is met. Adobe's advisory APSB25-105 documents the underlying improper input validation flaw, and the high-privilege prerequisite keeps this a privilege-to-code-execution escalation rather than an unauthenticated remote breach. There is no public exploit code identified at time of analysis, but the EPSS score of 4.71% (91st percentile) signals elevated predicted exploitation pressure relative to the broader CVE population.
Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22, and earlier requires an attacker who already holds high privileges on the instance, who can exploit a path traversal and improper access control flaw to bypass security measures and run code in the context of the current user. The issue is network-accessible, low-complexity, and needs no user interaction, with a CVSS 3.1 base score of 9.1; however, PR:H is the key limiter because administrative or equivalent access must be obtained first. No public exploit identified at time of analysis, and EPSS is 1.20% (67th percentile).
Wireless network compromise of EZCast Pro II dongles before version 1.17478.177 occurs because the device's Access Point mode uses a predictable default Wi-Fi password derived from observable identifiers, allowing any attacker within radio range to compute the credential and join the dongle's network. CVSS 4.0 score 9.3 reflects adjacent-network attack vector with no authentication required, and no public exploit identified at time of analysis, though the algorithm is reportedly reversible from broadcast data.
Authorization bypass in EZCast Pro II wireless presentation devices before firmware 1.17478.177 allows adjacent-network attackers to obtain full administrative control of the device Admin UI by leveraging hard-coded cryptographic keys (CWE-798). The flaw was reported through Switzerland's NCSC coordinated vulnerability disclosure programme and carries a CVSS v4.0 base score of 9.3 with automatable exploitation flagged in the vector. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Security feature bypass in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows remote unauthenticated attackers to gain unauthorized read and write access without user interaction. This is a high-priority issue based on CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); the vulnerability stems from improper input validation, and there is no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, with an EPSS score of 0.66% (50th percentile). Affected organizations should prioritize patching internet-reachable ColdFusion instances using Adobe advisory APSB25-105.
Cross-site request forgery in the Video Merchant WordPress plugin through version 5.0.4 lets an attacker upload arbitrary files and reach remote code execution on a victim site by tricking a logged-in administrator into clicking a crafted link. The missing nonce check on video_merchant_add_video_file() is what allows the forged upload request to be accepted without the administrator's intent, and whether code actually runs depends on the server executing the uploaded file type. No public exploit identified at time of analysis and no indication of confirmed active exploitation; EPSS is low at 0.45% (roughly the 37th percentile), so real-world risk is dominated by the required administrator interaction, the plugin's limited deployment, and server-side file-execution behavior rather than by the 8.8 base score alone.
Unauthenticated remote attackers can read arbitrary files from Barracuda RMM versions prior to 2025.1.1 by invoking a path-traversal-vulnerable method in the exposed Service Center .NET Remoting service. The assessed impact is high confidentiality loss, with no integrity or availability impact in the independent CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); escalation to remote code execution is possible only if the attacker can retrieve .NET machine keys and use them to forge trusted payloads, so environments with rotated or protected keys and deployments that do not expose the remoting endpoint are at reduced risk. No public exploit has been identified at time of analysis, and EPSS is 0.75% (54th percentile), indicating low predicted near-term exploitation, making the overall urgency elevated rather than critical.
Bitdefender Total Security, Antivirus, Internet Security, and Endpoint Security Tools prior to version 27.0.47.241 allow local attackers with low privileges to execute arbitrary code as SYSTEM through a complex attack chain. The bdservicehost.exe service deletes files from C:\ProgramData\Atc\Feedback without validating symbolic links (CWE-59), enabling arbitrary file deletion that attackers chain with network-triggered file copy operations and filter driver bypass via DLL injection to achieve full privilege escalation. EPSS indicates 0.02% exploitation probability (6th percentile), and no public exploit code or active exploitation has been identified at time of analysis. Vendor has released patches addressing this multi-stage local escalation vector.
Remote code execution in Google Cloud Data Fusion (built on the CDAP platform) allows an authenticated principal who holds artifact-upload permissions on an instance to execute arbitrary code inside the core AppFabric component through unsafe deserialization of a crafted artifact. Successful exploitation gives the attacker control of the Data Fusion instance, enabling unauthorized access to sensitive data, tampering with data pipelines, and reconnaissance of the underlying infrastructure. No public exploit code has been identified at time of analysis, the EPSS score is low (0.44%, 36th percentile), and the issue is not listed in CISA KEV, so it is a credible but non-emergency authenticated RCE that still warrants prompt patching. Vendor-released fixes are available in CDAP 6.10.6+ and 6.11.1+.
Unauthenticated remote attackers can degrade or render XWiki's REST API unavailable by requesting unbounded result sets from endpoints such as /rest/wikis/xwiki/spaces, which by default returns every space (effectively every page) in the wiki. Affected releases are 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0; the impact is availability-only (CVSS 4.0 8.7, assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), scaling with wiki size and JVM memory configuration so large installations suffer the most. No public exploit code has been identified at time of analysis and EPSS is low (0.40%, 32nd percentile), but the flaw is trivially reachable without authentication on default configurations, and vendor patches are available in 16.10.11, 17.4.4 and 17.7.0-rc-1.
Privilege escalation in Google Cloud Dialogflow CX lets an authenticated agent developer who holds the Webhook editor permission configure a webhook that authenticates using the Dialogflow service agent access token, elevating their access from agent scope to project scope and enabling unauthorized management of resources in services bound to the project - with resulting unexpected costs and resource depletion for the producer project. The vulnerability is a CWE-269 improper privilege management flaw; per the CVSS 3.1 vector (PR:L) it requires an existing authenticated agent-level identity and is not remotely unauthenticated, so the realistic threat model is a malicious or compromised agent developer rather than an anonymous internet attacker. Google applied a server-side fix in February 2025 and no customer action is required; no public exploit code has been identified at time of analysis, and EPSS is low at 0.37% (30th percentile).
Local DLL hijacking in MailEnable (mail server for Windows) lets an attacker who can write to the installation directory plant a malicious MEAISP.DLL that the administrative executable loads on start, yielding code execution with the process's privileges. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms this requires authenticated local access and write permission to the install path - there is no remote vector - and the victim must subsequently launch the affected executable. All builds prior to 10.54 are affected; EPSS is low at 0.20% (9th percentile) and no public exploit has been identified at time of analysis.
DLL hijacking in MailEnable Standard versions prior to 10.54 allows local attackers with write access to the installation directory to execute arbitrary code with the privileges of the administrative executable. The vulnerability requires the attacker to plant a malicious MEAIPC.DLL and then wait for the administrative process to be executed, making exploitation local-only and dependent on existing low-level privileges. No public exploit code is identified at time of analysis, and the EPSS score is low at 0.17%; the vendor has released a fix in version 10.54.
Local arbitrary code execution in MailEnable versions prior to 10.54, where the administrative executable loads MEAIAM.DLL from its installation directory without integrity validation or a secure search order, letting an attacker who can already write to that directory plant a malicious DLL that runs with the privileges of the MailEnable process. Exploitation requires local access and low privileges (CVSS PR:L) plus a subsequent execution of the affected executable, and is not remotely reachable or user-interactive; EPSS is 0.17% (6th percentile), no public exploit was identified at time of analysis, and there is no CISA KEV listing. Impact is high for confidentiality, integrity and availability within the loading process's privilege context, but is bounded by those privileges and by whether default directory ACLs actually permit an attacker to write there.