Unauthenticated access to live video and device data affects Xiongmai XM530-based IP cameras running firmware V5.00.R02.000807D8.10010.346624.S with ONVIF 21.06, where the ONVIF service fails to enforce authentication on 31 endpoints. Any remote attacker who can reach the camera's ONVIF port can pull sensitive device information and view real-time RTSP/ONVIF video streams without credentials. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and EPSS is modest (0.85%, 54th percentile).
Full administrative takeover of ClipBucket 5.5.2 is possible because the video-sharing platform ships with hardcoded default administrative credentials, letting any unauthenticated remote attacker sign into the admin panel and control the entire application. Publicly available exploit material (a Medium write-up) documents the attack, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N). This is a network-reachable, no-interaction flaw, though EPSS is modest at 0.57% (43rd percentile) and it is not currently listed in CISA KEV.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on it) lets attackers upload a crafted XML/SVG file through the Attachments module that runs attacker-controlled script when a victim views it. Tagged as XSS/RCE/File Upload with a publicly available exploit code, though EPSS remains low at 0.44% (35th percentile) and it is not on CISA KEV. The CVSS 9.6 rating reflects a scope-changing, user-interaction-dependent attack rather than direct server-side compromise.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory on the device by sending a crafted 'page' parameter to the /goform/SafeUrlFilter endpoint, with high impact to confidentiality, integrity and availability per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists, but EPSS estimates only a 1.00% chance of exploitation in the next 30 days (62nd percentile) and no CISA KEV listing indicates confirmed active exploitation. Signals are mixed: the technical severity is high, yet the practical attack surface is limited because the HTTP management interface on default SOHO deployments is LAN-facing, so a real-world attacker generally needs local-network adjacency unless WAN-side remote management has been enabled.
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory and potentially achieve code execution by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' parameter. Per the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials, special configuration, or user interaction are required, and publicly available exploit code exists (a proof-of-concept write-up is published on GitHub), though CISA KEV does not list this issue as actively exploited. EPSS places exploitation likelihood at roughly 1.00% (62nd percentile), reflecting that the practical exposure depends on whether the router's web management interface is reachable by the attacker, since SOHO devices of this class typically restrict administration to the LAN by default.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially achieve arbitrary code execution on the device by sending a crafted HTTP request to the /goform/CheckTools endpoint with an oversized 'ipaddress' argument. The CVSS:4.0 vector (8.9, AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) indicates the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction, so any device with an exposed management interface is directly at risk. Publicly available exploit code exists (a GitHub PoC walkthrough with reproduction steps), while EPSS is modest at 0.97% (61st percentile) and there is no CISA KEV entry, meaning no confirmed active exploitation at time of analysis.
Incorrect access control in youlai-boot 2.21.1 allows an authenticated non-root user to fetch role form data for root-level roles through the SysRoleController.getRoleForm endpoint, which returns the record without any permission check. The assessed impact is read-only disclosure of role configuration (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with no integrity or availability effect, even though the published NVD vector claims PR:N and C:H. No confirmed working exploit code is public - the linked Gitee issue is a PoC reference only, not verified as working exploit code - EPSS is 0.44% (38th percentile), there is no CISA KEV listing, and the vendor has published an upstream fix commit.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify, a TypeScript library for building ActivityPub federated servers, where maliciously crafted HTML responses can cause catastrophic backtracking in the document loader's HTML parsing regex. The vulnerability affects versions prior to 1.6.13, 1.7.14, 1.8.15, and 1.9.2, allowing remote attackers to cause denial of service without authentication. A public proof-of-concept exploit is available, though the EPSS score of 0.13% indicates relatively low exploitation likelihood in the wild.
GetStreamUri ONVIF endpoint in Xiongmai XM530 IP cameras exposes RTSP video streams with hardcoded credentials, allowing remote unauthenticated attackers to view live camera feeds without authentication. Affects firmware version V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. Publicly available exploit code exists demonstrating credential extraction and direct stream access. EPSS data not available, but the combination of network-accessible attack vector (AV:N), no authentication requirement (PR:N), and public POC creates immediate risk for exposed internet-facing cameras.
Local privilege escalation in NetBT Consulting Services e-Fatura versions prior to 1.2.15 allows authenticated low-privileged users to leverage an unquoted Windows service path to execute arbitrary code with elevated privileges. Publicly available exploit code exists (Exploit-DB 52509), though EPSS scoring (0.20%, 42nd percentile) suggests limited widespread exploitation, and the issue is not currently listed in CISA KEV.
Stored cross-site scripting in Piranha CMS v12.1 allows an attacker who can submit content to the Media module to persist malicious JavaScript in the Name field, which then executes in victims' browsers when the Media section is viewed. A publicly available proof-of-concept exploit exists on GitHub, meaningfully lowering the barrier to exploitation. Despite the network-accessible attack vector and cross-context scope change (S:C), EPSS sits at 0.18% (8th percentile) with no CISA KEV listing, indicating limited real-world exploitation of this niche platform at time of analysis.
Stored cross-site scripting in Piranha CMS v12.1 allows script injection via the Excerpt field in the Page Settings module, executing arbitrary JavaScript in the browsers of users who subsequently view the affected page. The vulnerability carries a publicly available proof-of-concept exploit hosted on GitHub, though EPSS remains very low at 0.18% (8th percentile), indicating limited observed exploitation activity. No KEV listing exists, and no patch has been confirmed from available data at time of analysis.
Arbitrary code execution in Umbraco CMS 16.3.3 is claimed via upload of a crafted PDF file that abuses insufficient file-type validation (CWE-434), potentially leading to server-side code execution. The finding is explicitly DISPUTED by Umbraco, which states that enforcing upload validation is the deploying administrator's responsibility per documentation, mirroring the earlier CVE-2023-49279. No public exploit is confirmed and EPSS is low (0.50%, 39th percentile), so despite the nominal CVSS 10.0 this reflects a contested, configuration-dependent condition rather than a proven turnkey RCE.
Denial of service in the Linux kernel's jbd2 (JBD2 journaling layer) used by ext4 allows a local attacker to crash the system by mounting a specially crafted or corrupted ext4 image; when journal metadata is inconsistent (e.g. a block bitmap does not reflect an in-use block), jbd2_journal_get_create_access() hits a J_ASSERT/BUG_ON at fs/jbd2/transaction.c:1289 and panics the machine. Affected products span multiple stable kernel branches, with the fix converting the fatal BUG_ON into a JBD2 abort. No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a locally-triggered availability-only issue rather than a remotely weaponizable flaw.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to achieve limited confidentiality, integrity, and availability impacts via the /goform/L7Port endpoint. Public exploit code is available (EPSS 0.11%), but no active exploitation has been reported. The vulnerability, though network-accessible without authentication, is constrained in its real-world impact.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.
SQL injection in Simple Stock System 1.0 allows remote attackers to manipulate the uname parameter in /logout.php, potentially bypassing authentication or altering backend data. Public exploit code is available, though no active exploitation has been reported.
Ragic Enterprise Cloud Database ships with a hard-coded cryptographic key (CWE-321), and because that key is fixed across deployments an unauthenticated remote attacker who obtains it can forge the platform's verification information and authenticate as any user, including administrative accounts. No prior login, user interaction, or non-default configuration is required - the only real precondition is network reachability of the affected service, making this a broad, high-severity authentication bypass against default installations. At the time of analysis there is no evidence of confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, and the EPSS score remains low at 0.53% (43rd percentile); however, the flaw was publicly documented by TWCERT/CC, so the fixed key should be treated as effectively public and the low EPSS should not be read as low risk.
Unauthenticated network attackers can access the Sharp MP-01 digital signage media player’s web interface and alter settings or deliver content without credentials. The flaw (CWE-306, CVSS 4.0 base 9.2) affects all firmware versions; exploitation requires a network path to the device, and the vendor’s AC:H/AT:P vector indicates an additional unspecified precondition for reliable exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.32% (24th percentile).
Unauthenticated remote file disclosure in Ragic Enterprise Cloud Database allows attackers to abuse relative path traversal in the file-download/retrieval functionality to read arbitrary system files. The CVSS 8.7 rating reflects high confidentiality impact with no integrity or availability effect; EPSS is low at 0.61% (48th percentile), and no public exploit or CISA KEV entry was identified at time of analysis.
Denial-of-service in Dire Wolf through version 1.8 occurs when a crafted KISS frame reaches the MAX_KISS_LEN limit, causing kiss_rec_byte() to append a terminating FEND byte without reserving stack space; the resulting out-of-bounds write and subsequent out-of-bounds read in kiss_unwrap() can crash the application. The issue is unauthenticated and remote only when a KISS-over-TCP interface is reachable from an untrusted network, since local serial or RF KISS links are not remotely accessible. No public exploit was identified at time of analysis, EPSS is low at 0.51%, and the assessed impact is availability-only with no confidentiality or integrity loss.
Denial of service in Dire Wolf through 1.8 and before commit 3658a87 allows a remote, unauthenticated attacker to terminate the decoding process by delivering a malformed AX.25/APRS MIC-E frame whose comment field is empty or truncated, such as one containing an embedded NUL byte near the end of the packet. The flaw is a reachable assertion in aprs_mic_e() in src/decode_aprs.c (CWE-617) that aborts when the decoded comment string is not non-empty. No public exploit identified at time of analysis, and impact is availability-only: no code execution or data exposure results. The NVD CVSS 4.0 vector scores 8.7 with VA:H, while the independent assessment rates availability-only impact with no authentication or user interaction required.
Improper authentication enforcement in the Mattermost Jira plugin lets an unauthenticated attacker who knows a valid Mattermost user ID send crafted plugin payloads that spoof that user and inject arbitrary Jira issue-key paths, causing the plugin to issue authenticated GET and POST requests to the connected Jira server. The flaw affects Mattermost Server 11.1.x through 11.1.0, 11.0.x through 11.0.5, 10.12.x through 10.12.3, and 10.11.x through 10.11.7, but only when the Jira plugin (versions <= 4.4.0) is installed, enabled, and connected to Jira; default installations without the Jira integration are not exposed. Per the CVSS vector the attack is unauthenticated and needs no user interaction, and the decisive practical barrier is that the attacker must possess or guess a usable Mattermost user ID. No confirmed active exploitation has been reported (not in CISA KEV) and no public exploit code has been identified; EPSS is low at 0.26% (17th percentile), so this is a mid-tier priority rather than an emergency. Mattermost Advisory ID: MMSA-2025-00555.
Arbitrary file read in KEDA (Kubernetes Event Driven Autoscaling) affects operator versions prior to 2.17.3 and 2.18.0 through 2.18.2 (fixed in 2.17.3, 2.18.3 and 2.19.0+), allowing an authenticated attacker who holds Kubernetes RBAC permission to create or modify a TriggerAuthentication resource to direct the content of any file on the KEDA pod's node - such as service account tokens, secrets, or /etc/passwd - to an attacker-controlled HashiCorp Vault endpoint during the Vault authentication handshake. This is an access-gated confidentiality issue rather than a broadly exploitable flaw: the PR:H prerequisite (write access to TriggerAuthentication) is the main limiting factor, and the advisory's only effective workaround is strict RBAC restriction on that resource. No public exploit code has been identified at time of analysis, and EPSS is low at 0.55% (44th percentile), with no CISA KEV listing.
Broken per-object access control in the GT Edge AI Platform Community edition before v2.0.10 allows remote attackers to read other users' uploaded files through the /api/v1/conversations/*/files API. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) and EPSS 0.29% (21st percentile); it is not listed in CISA KEV, and the supplied public research references are not confirmed as working exploit code. NVD scores PR:N, but the evidence notes that the per-conversation endpoint may in practice require a session or account, and that authentication requirement is not confirmed from the available data.
Denial of service in Delta Electronics DVP15MC11T controllers can be triggered by malformed Modbus/TCP packets sent to the controller's unauthenticated port 502, causing availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely reachable without authentication or user interaction, while confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and EPSS is low at 0.22%, but exposure is highest where Modbus/TCP is reachable from untrusted networks rather than segmented OT networks.
Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
SQL injection in the Centreon Open Tickets module enables authenticated users with elevated (administrative) privileges to execute arbitrary SQL through notification-rule configuration parameters and Open Tickets module inputs. The flaw affects Open Tickets 24.10.0-24.10.4, 24.04.0-24.04.4, and 23.10.0-23.10.3 when the module is installed. Vendor patches are available in 24.10.5, 24.04.5, and 23.10.4; EPSS is low (0.31%) and no public exploit has been identified at the time of analysis, making this a genuine but bounded risk.
Weak pseudo-random number generation in Johnson Controls PowerG encrypted wireless communications allows an unauthenticated attacker within RF range to predict cryptographic material and read or inject PowerG packets, as assessed with high integrity impact (VI:H). The flaw is proximity-bound (CVSS AV:A) and cannot be exploited over the internet, affecting any PowerG-enabled alarm system by default. EPSS is low at 0.19% and no public exploit or CISA KEV entry is identified at time of analysis, but the cryptographic weakness undermines the confidentiality and integrity of alarm signaling.
Nonce reuse in Johnson Controls ICS encrypted communications lets unauthenticated attackers on an adjacent network replay captured packets or decrypt intercepted traffic, with high integrity impact and limited confidentiality and availability impact. The supplied data does not name the exact affected device models or firmware versions, so scope must be confirmed against the Johnson Controls advisory and CISA ICSA-25-350-02. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.19%.
Packet-source validation failure in Johnson Controls ICS devices on an adjacent network segment allows unauthenticated attackers to spoof traffic, potentially modifying device configuration or causing denial of service. The flaw is CWE-346 (origin validation error), requires Layer-2 adjacency (AV:A), and needs no user interaction. No public exploit code was identified at time of analysis; EPSS is 0.13% (3rd percentile), and KEV status is not indicated.
Startup denial of service affects applications that statically link ODA Drawings SDK multithreaded ('mt') builds before 2026.12 and instantiate the global COdaMfcAppApp theApp object. The static initialization order fiasco causes OdString::kEmpty to be accessed before initialization, deterministically crashing the process at launch. Exploitation requires local access to run or influence the vulnerable application; no public exploit code is identified at time of analysis, EPSS is 0.15% (4th percentile), and any memory-corruption or code-execution escalation remains undefined-behavior-dependent and unproven.
CouchCMS versions up to 2.4 use hard-coded cryptographic keys in the reCAPTCHA handler configuration, allowing remote attackers with high complexity to conduct information disclosure attacks against the reCAPTCHA mechanism. The vulnerability stems from improper handling of K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY parameters in couch/config.example.php, and publicly available exploit code exists, though real-world exploitation probability remains low (EPSS 0.06%).
Logged-in customers on WooCommerce stores running versions 8.1 through 10.4.2 can read order data belonging to guest customers when the site is set up in a specific configuration described only in the vendor advisory. The flaw is an information-disclosure issue (CWE-200) requiring an authenticated low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), so any registered shopper - not an anonymous visitor - can reach data they should not own, with high confidentiality impact but no integrity or availability effect. Exploitation is not reported as active (no CISA KEV listing and no public exploit code identified at time of analysis), and EPSS is low at roughly 0.33% (25th percentile), which fits a moderate, configuration-dependent disclosure rather than an urgent mass-exploitation threat. Vendor-released patch: 10.4.3, with backports to 8.1.3 in the 8.1 branch; WooCommerce 8.0 and earlier are unaffected.
Information disclosure in Check Point Identity Agent for Terminal Services allows an authenticated local user with read access to debug files to obtain sensitive identity data in plaintext and potentially claim another user's security policy rules. Exploitation is local, requires valid credentials and the presence of debug output, making it primarily an insider or post-compromise issue; EPSS is 0.12% (2nd percentile) and no public exploit identified at time of analysis. This is a moderate-risk, low-priority confidentiality issue rather than an urgent threat.
Cross-user security-policy data disclosure in CheckPoint Identity Agent on Windows Terminal Servers is a moderate, not high-urgency, issue: an authenticated local user with an interactive session can read sensitive identity and policy information from the agent's registry keys and may be able to claim another user's security policy rules. The CVSS 3.1 vector (AV:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms local access is required and that only confidentiality is directly impacted, with scope change reflecting cross-user impact on a shared Terminal Server. EPSS is 0.12% (2nd percentile), no KEV designation is present in the provided intelligence, and no public exploit identified at time of analysis; meaningful exploitation also requires another user's policy data to be present on the same Terminal Server.
Stored cross-site scripting (XSS) in Void Elementor WHMCS Elements for Elementor Page Builder through version 2.0.1.2 allows authenticated attackers to inject malicious scripts into web pages generated by the plugin, potentially compromising site visitors and administrators. The vulnerability stems from improper input sanitization in page generation functions. No public exploit code or active exploitation has been identified, but the low EPSS score (0.04%) reflects limited real-world attack probability despite the high-impact nature of XSS vulnerabilities.
Stored cross-site scripting in Schlix CMS before v2.2.9-5 lets unauthenticated attackers inject JavaScript through failed login attempts; the payload is written to login-attempt logs and executes in an administrator's authenticated browser session when those logs are viewed in the admin panel (CVSS 6.1, UI:R). Instances at v2.2.9-5 or later are not affected. EPSS is 0.19% (8th percentile), CISA KEV is not listed, and no public exploit was identified at time of analysis; the vuln.today decision label is this_month, consistent with a routine scheduled patch rather than an emergency.
ChestnutCMS up to version 1.5.8 allows authenticated remote attackers to upload arbitrary files by manipulating the File argument in the FilenameUtils.getExtension function of the /dev-api/common/upload endpoint. The vulnerability bypasses filename extension validation in the Filename Handler component, enabling unrestricted file uploads with low integrity and confidentiality impact. Publicly available exploit code exists; however, the low EPSS score (0.06%) and requirement for prior authentication significantly limit real-world exploitation risk compared to the CVSS base score.
SQL injection in DedeCMS up to version 5.7.118 via the orderby parameter in /freelist_main.php allows authenticated remote attackers to execute arbitrary SQL queries with low impact on confidentiality, integrity, and availability. Publicly available exploit code exists and the vulnerability requires valid user authentication (PR:L) to exploit, significantly limiting real-world risk despite network accessibility.
SQL injection in SeaCMS up to version 13.3 via the e_id parameter in admin_video.php allows authenticated high-privilege attackers to execute arbitrary SQL queries and manipulate database content. The vulnerability requires administrative credentials, limiting real-world impact despite public exploit availability. EPSS score of 0.05% reflects the high privilege requirement needed for exploitation.
Denial of service in the Linux kernel's sched_ext scheduler can occur on PREEMPT_RT builds when deferred_irq_workfn() races with a hardware interrupt and reacquires rq->__lock, hanging the affected CPU. Exposure is limited to Linux 6.18-rc1 through 6.18-rc6 configured with CONFIG_PREEMPT_RT=y and sched_ext; stable kernels and non-RT builds are not affected, and the race is non-deterministic, requiring local access and some scheduling privilege. This is a low-priority hardening fix rather than an attacker-driven vulnerability, and no public exploit has been identified at time of analysis.
Denial of service in the Marshmallow Python serialization library affects versions 3.0.0rc1 through 3.26.1 and 4.0.0 through 4.1.1 when an application calls Schema.load(data, many=True) on untrusted input; a moderately sized list of invalid records consumes a disproportionate amount of CPU time because the error-merging routine repeatedly rebuilds result collections. Remote attackers who can reach an endpoint that performs bulk deserialization and returns validation errors can drive CPU exhaustion and degrade or stall the service, with no confidentiality or integrity impact. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, though EPSS places it in the low range (0.30%, ~21st percentile). The library ships fixes in 3.26.2 and 4.1.2.
SQL injection in loganSite's Article Handler allows a low-privileged authenticated remote attacker to manipulate the ID parameter in /includes/article_detail.php and influence backend SQL queries. The project ships as a rolling release, so no tagged affected or fixed versions are published; defenders must compare deployments against commit c035fb5c3edd0b2a5e32fd4051cbbc9e61a31426. No public exploit was identified at time of analysis, EPSS is 0.23% (13th percentile), and the flaw is rated medium severity with limited confidentiality, integrity, and availability impact.
Stored cross-site scripting in Centreon Infra Monitoring lets authenticated users with elevated privileges inject script into Notification rules or the Open Tickets module, which then executes in another user's browser when the affected page is viewed. Affected releases are 24.10.0 before 24.10.5, 24.04.0 before 24.04.5, and 23.10.0 before 23.10.4. Exploitation requires high privileges and user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), EPSS is 0.24%, no public exploit was identified at time of analysis, and vendor patches are available.
Stored cross-site scripting in Centreon Infra Monitoring (Centreon Web) allows authenticated users with elevated privileges to inject persistent scripts into the Hostgroup configuration page, which may execute in the context of other administrators who view the affected page. Affected versions are 24.10.0 before 24.10.15, 24.04.0 before 24.04.19, and 23.10.0 before 23.10.29; the vendor has released patched versions. No public exploit code has been identified at time of analysis, and EPSS is low at 0.19% (9th percentile), consistent with a medium-to-low priority issue.
Cross-site request forgery (CSRF) in Kunal Custom 404 Pro WordPress plugin through version 3.12.0 allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects all versions up to and including 3.12.0, with no CVSS score assigned at the time of analysis. No public exploit code has been identified, and the EPSS score of 0.02% indicates minimal likelihood of active exploitation despite the moderate technical severity of CSRF flaws.
Cross-site request forgery (CSRF) vulnerability in PluginOps Feather Login Page WordPress plugin versions up to 1.1.7 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent. The vulnerability stems from missing CSRF token validation on plugin functionality, enabling attackers to craft malicious requests that execute when users visit attacker-controlled pages while logged into sites using the vulnerable plugin. No public exploit code or active exploitation has been identified at time of analysis; however, the low EPSS score (0.02%) and lack of CVSS data suggest this may represent a lower-severity implementation gap rather than a critical attack vector in typical WordPress deployments.
Network key exposure in Johnson Controls PowerG wireless security networks can allow an attacker within radio range to capture the network key under narrow conditions and then read or modify encrypted PowerG packets. This is a low-severity issue (CVSS 2.3; assessed CVSS 3.1 AV:A/AC:H/PR:N/UI:R/C:L/I:L/A:N), with EPSS 0.18% and no public exploit identified at time of analysis. Exploitation requires RF proximity and a specific capture window, so realistic risk is limited despite the unauthenticated vector.
Stack-based buffer overflow in sokol_gfx.h function _sg_validate_pipeline_desc allows local authenticated attackers to corrupt stack memory with limited confidentiality and integrity impact. The vulnerability affects sokol up to commit 5d11344150973f15e16d3ec4ee7550a73fb995e0, with patch commit b95c5245ba357967220c9a860c7578a7487937b0 available. Publicly available exploit code exists, though EPSS exploitation probability remains very low at 0.03%, indicating limited real-world attack surface.