Authenticated command injection in DreamFactory's package export handler (saveZipFile in src/Components/Package/Package.php) lets a high-privilege user execute arbitrary OS commands as the service account when creating a password-protected ZIP archive. Only administrators with package-management rights are affected, and the vulnerable shell path is reached only when PHP's native ZipArchive encryption is unavailable, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code has been identified and EPSS is a modest 1.58% (75th percentile); an upstream fix commit exists but a tagged patched release was not independently confirmed.
TLS renegotiation exhaustion in Keycloak allows unauthenticated remote denial of service via repeated client-initiated TLS 1.2 renegotiation requests that drain CPU resources. Affects Red Hat Single Sign-On deployments using TLS 1.2 with client renegotiation enabled. EPSS exploitation probability and KEV status not available at analysis time; CVSS 7.5 (High) reflects network-accessible attack with low complexity but availability impact only. Red Hat has issued multiple security advisories (RHSA-2025:18254, 18255, 18889, 18890) addressing this flaw.
Sante PACS Server can be forced into a denial-of-service condition by a remote, unauthenticated attacker who sends a crafted HTTP Content-Length header that triggers a NULL pointer dereference in the server's HTTP handling code. The high CVSS availability score reflects a service crash with no confidentiality or integrity impact, and the main exposure factor is whether the PACS HTTP listener is reachable from an untrusted network. No public exploit code or CISA KEV entry was identified in the provided data.
Local privilege escalation in MSP360 Free Backup (CVSS 7.3) lets an attacker who already has low-privileged code execution create a filesystem junction that the restore function follows, causing arbitrary files to be created with SYSTEM privileges when an administrator initiates a restore, potentially leading to code execution as SYSTEM. Exploitation requires local access, a pre-existing foothold, and administrator interaction; EPSS is low at 0.18% (7th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in Hotech Software's Otello product (versions 2.4.0 through 2.4.3) allows authenticated low-privileged attackers to inject persistent malicious scripts that execute in other users' browsers upon viewing affected pages. Reported by Turkey's national CERT (USOM), the vulnerability carries a 7.3 CVSS score with high confidentiality and integrity impact, though no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.03%.
Directory traversal in the mariadb-dump utility (part of MariaDB) allows code execution when the tool is run against a database with attacker-controlled view names. Exploitation requires the victim to invoke mariadb-dump against malicious or untrusted database content - such as a compromised server being dumped or an untrusted backup being restored - and only yields code execution at the dumping user's privilege level. The flaw (CWE-22, ZDI-CAN-27000) is scored CVSS 7.0 with high attack complexity and mandatory user interaction; EPSS is low (0.52%) and there is no KEV listing, with no public exploit identified at time of analysis.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when the application processes a crafted XLS file and runs dangerous embedded script without presenting the user a warning prompt (CWE-356). An attacker must convince a target to open a malicious XLS file - or visit a page that serves one - after which code executes in the context of the current user; the LOCAL attack vector, mandatory user interaction (UI:R), and HIGH attack complexity (AC:H) confine this to targeted file-delivery scenarios rather than broad remote exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the 7.0 score reflects high confidentiality, integrity, and availability impact gated behind user action and attacker-uncontrolled preconditions.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when a user opens a crafted DOC file, because the application executes dangerous embedded script without presenting a security warning (CWE-356). This is a moderate-risk client-side flaw requiring user interaction and high-complexity conditions, with code running only at the current user's privilege level; no public exploit identified at time of analysis and no CISA KEV entry is available.
Arbitrary code execution in PDFsam Enhanced 7.0.76.15222 occurs when a user opens a crafted XLS file containing dangerous embedded script, because the application executes that content without showing the unsafe-action warning it should (CWE-356). The attack is client-side and gated by mandatory user interaction - the victim must open the malicious spreadsheet or visit a page that delivers it - and any code runs only with the current user's privileges, with no scope change or privilege escalation. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; high attack complexity (AC:H) means a crafted file must satisfy specific conditions to execute reliably.
PDFsam Enhanced 7.0.76.15222 can execute dangerous embedded script from a crafted DOC file without displaying a user warning, leading to code execution in the context of the current user. Exploitation requires local access (AV:L), no privileges (PR:N), and user interaction (UI:R); no public exploit code or KEV entry was identified at time of analysis, making this a moderate, user-gated risk.
Local privilege escalation in PDFsam Enhanced 7.0.76.15222 allows a physically-present attacker to obtain code execution as SYSTEM by planting a malicious OpenSSL configuration file. The product loads its OpenSSL config from an unsecured location (CWE-427, uncontrolled search path element), so an attacker who can mount an attacker-controlled drive onto the Windows host can hijack the config load. Exploitation requires physical access and drive-mounting capability, no network vector exists, and EPSS is low (0.33%, 25th percentile) with no public exploit or KEV entry identified at time of analysis.
Command injection in the Netgear EX8000 range extender's action_bandwidth handler allows remote attackers to pass a crafted iface parameter into a shell command, potentially achieving arbitrary command execution on devices running firmware V1.0.0.126. The severity signals are mixed: the published record scores it 6.5 with no privileges required, while independent review rates confidentiality, integrity and availability impact as high but assumes an authenticated admin session, and that authentication requirement is not confirmed from the available data. There is no CISA KEV listing and EPSS is 0.90% (59th percentile); a public proof-of-concept reference and a demonstration video exist in a third-party GitHub repository but are not verified as working exploit code, and the priority label is this_month.
VPSUForm WordPress plugin versions 3.2.24 and earlier expose sensitive embedded system information to unauthorized users via improper access controls, allowing attackers to retrieve data that should be restricted to administrators or authenticated users. The vulnerability affects a widely-deployed WordPress form plugin and has an EPSS score of 0.05% (low exploitation probability), with no confirmed active exploitation or public exploit code at the time of analysis.
Cross-site scripting (XSS) vulnerability in CodexThemes TheGem Theme Elements (for Elementor) plugin through version 5.10.5.1 allows improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the context of other users' browsers, potentially compromising WordPress site visitors and administrators. No active exploitation has been confirmed at time of analysis, though the low EPSS score (0.04%) suggests limited real-world exploitation likelihood despite the vulnerability's presence in a widely-used Elementor theme plugin.
Stored cross-site scripting (XSS) in WebCodingPlace Responsive Posts Carousel Pro WordPress plugin versions 15.2 and earlier allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability resides in improper input sanitization during web page generation, enabling attackers to compromise site integrity and steal sensitive user data. EPSS exploitation probability is notably low (0.04%, 14th percentile), suggesting limited real-world attack incentive despite the stored nature of the flaw.
Stored cross-site scripting in the Happy Addons for Elementor WordPress plugin (all versions up to and including 3.20.3) lets an authenticated user with Contributor-level access or higher inject arbitrary JavaScript through the 'ha_page_custom_js' parameter, which persists in page content and executes in the browser of anyone who later views that page. The flaw combines missing input sanitization and output escaping with a broken role restriction - Custom JS is intended to be Administrator-only but is reachable by lower-privileged accounts. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with EPSS of 0.29% (20th percentile); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and real-world exposure is materially lower on sites that do not grant Contributor-or-higher accounts to untrusted users.
Stored cross-site scripting (CWE-79) in the WordPress plugin 'Membership Plugin - Restrict Content' through version 3.2.15 lets an authenticated user with contributor-level access or higher inject arbitrary JavaScript that persists in page content and executes for any visitor who later loads the affected page. The flaw lies in the plugin's 'register_form' and 'restrict' shortcodes, which render user-supplied shortcode attributes without adequate sanitization or output escaping; because WordPress grants contributors the ability to create posts, this becomes a realistic privilege-escalation and session-theft vector on sites that permit lower-trust content authoring. Public exploit code has not been identified and there is no confirmed active exploitation (no CISA KEV listing), and EPSS sits at roughly 0.24% (14th percentile), so this is assessed as moderate rather than urgent, though it should still be patched promptly on multi-author sites.
Stored cross-site scripting in the Calendar plugin for WordPress (versions through 1.3.16) lets authenticated users with Contributor-level access or higher inject arbitrary script through the event_desc parameter, which then runs when another user-potentially an administrator-views the affected calendar page. Exploitation is gated by a non-default configuration in which an administrator has enabled lower-privilege users to manage calendar events, so default installations are not exploitable by low-privilege users. No public exploit was identified at time of analysis and EPSS is low (0.24%, 14th percentile), making this a low real-world priority despite the stored-XSS impact.
An out-of-bounds read in pdfforge PDF Architect's PDF parsing routine (confirmed affected build 9.1.74.23030) allows an attacker who supplies a crafted PDF to disclose sensitive contents of process memory. Exploitation is not remote or interaction-free: the victim must open the malicious document or visit a page that causes PDF Architect to render it (UI:R), and the assessed vector is local (AV:L) with no privileges required (PR:N). Standalone impact is confidentiality-only - arbitrary code execution in the context of the current process is only achievable by chaining this bug with a separate vulnerability. Risk in practice is low: EPSS is 0.18% (7th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis.
Memory corruption in Soda PDF Desktop's PDF parsing logic can disclose sensitive in-process information when a user opens a crafted PDF, requiring local access and user interaction; achieving code execution would depend on chaining with another vulnerability. No public exploit code or CISA KEV-listed active exploitation was identified, and EPSS is low at 0.18%.
An out-of-bounds read in Soda PDF Desktop's PDF parsing engine (build 14.0.509.23030) lets an attacker craft a malicious PDF that leaks process memory contents when the victim opens it, requiring user interaction and local execution context. The impact is limited to information disclosure (confidentiality high, no integrity or availability effect) unless the leak is chained with a separate memory-corruption bug to achieve code execution; no public exploit code has been identified at time of analysis, EPSS is low at roughly 0.18% (7th percentile), and the issue is not confirmed actively exploited (CISA KEV).
An out-of-bounds read in the PDF parsing engine of Soda PDF Desktop 14.0.509.23030 lets remote attackers disclose sensitive process memory by getting a victim to open a crafted PDF file or visit a page that serves one. The flaw is a missing validation of user-supplied data during file parsing, so the parser reads past the end of an allocated buffer; the standalone impact is confidentiality-only, and code execution would require chaining this memory disclosure with a separate vulnerability. Exploitation is local to the endpoint and requires user interaction, EPSS is low at 0.18% (7th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but comparatively low-priority issue.
Type confusion in the Linux kernel's team network driver (team_port_add) allows a local user with CAP_NET_ADMIN to corrupt a team device's header_ops state, leading to a kernel hang or BUG(). When an already-UP GRE device is added as a team port, the operation fails but not before team_dev_type_check_change irreversibly replaces eth_header with ipgre_header on the team device; subsequent packet transmission causes ipgre_header() to dereference struct team private data as struct ip_tunnel, triggering a local denial-of-service. No active exploitation has been confirmed (not in CISA KEV), though a syzbot reproducer demonstrates the issue reliably.
Missing authorization controls in VillaTheme HAPPY helpdesk plugin versions up to 1.0.9 allow unauthenticated attackers to bypass access restrictions and interact with support ticket functionality without proper permission verification. This authentication bypass vulnerability affects WordPress installations using the vulnerable plugin and could permit unauthorized access to sensitive support tickets and helpdesk operations. The issue has been reported by Patchstack security researchers with a low EPSS exploitation probability (0.04%) despite the authorization flaw.
A path-traversal flaw in Deciso OPNsense's diag_backup.php configuration backup/restore handler lets an administrator-level user supply a crafted backup filename that is used in file operations without validation, allowing arbitrary file creation with root privileges outside the intended /conf/backup and /var/db/rrd directories. The attack surface is limited: the CVSS vector (AV:A/PR:H/UI:N) and the vendor description both require a valid high-privilege web GUI session plus network-adjacent access to the management interface, so a remote unauthenticated attacker cannot reach it directly. Impact is integrity-only (no confidentiality or availability loss), EPSS is low at 0.61% (48th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; an upstream fix commit exists in the opnsense/core repository and ZDI tracks the issue as ZDI-25-1022 / ZDI-CAN-28133.
Chakra test WordPress plugin version 1.0.1 and earlier fails to properly enforce access control restrictions, allowing unauthenticated or lower-privileged users to bypass authentication mechanisms and access restricted functionality. The vulnerability stems from incorrectly configured security levels that do not validate user permissions before executing sensitive operations, and is tracked with an exceptionally low EPSS score (0.04%) despite the missing authorization flaw, suggesting limited real-world exploitation despite the theoretical risk.
Cross-Site Request Forgery in Premium Addons for Elementor plugin versions up to 4.11.53 allows unauthenticated remote attackers to create arbitrary Elementor templates by exploiting missing nonce validation in the 'insert_inner_template' function. An attacker must trick a site administrator or user with edit_posts capability into clicking a malicious link, but no public exploit code has been identified. The EPSS score of 0.02% indicates this vulnerability has very low exploitation probability in practice despite the CVSS 4.3 rating.
Out-of-bounds read in Soda PDF Desktop 14.0.509.23030 enables remote attackers to disclose limited contents of process memory when a victim opens a crafted PDF file or visits a malicious page serving one. Exploitation requires user interaction and local processing by the application; on its own the flaw provides only limited information disclosure, and code execution would require chaining a separate vulnerability. No public exploit was identified at time of analysis, and EPSS is low at 0.17% (6th percentile), consistent with a low-priority risk.
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short.
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the data after the header depends on the gs_host_frame hf::flags and the active device features (e.g. time stamping). Introduce a new function gs_usb_get_minimum_length() and check that we have at least received the required amount of data before accessing it. Only copy the data to that skb that has actually been received. [mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]
In the Linux kernel, the following vulnerability has been resolved: atm/fore200e: Fix possible data race in fore200e_open() Protect access to fore200e->available_cell_rate with rate_mtx lock in the error handling path of fore200e_open() to prevent a data race. The field fore200e->available_cell_rate is a shared resource used to track available bandwidth. It is concurrently accessed by fore200e_open(), fore200e_close(), and fore200e_change_qos(). In fore200e_open(), the lock rate_mtx is correctly held when subtracting vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth. However, if the subsequent call to fore200e_activate_vcin() fails, the function restores the reserved bandwidth by adding back to available_cell_rate without holding the lock. This introduces a race condition because available_cell_rate is a global device resource shared across all VCCs. If the error path in fore200e_open() executes concurrently with operations like fore200e_close() or fore200e_change_qos() on other VCCs, a read-modify-write race occurs. Specifically, the error path reads the rate without the lock. If another CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in fore200e_close()) between this read and the subsequent write, the error path will overwrite the concurrent update with a stale value. This results in incorrect bandwidth accounting.
In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksz_irq_free() can be called on uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It leads to freeing uninitialized IRQ numbers and/or domains. Use dsa_switch_for_each_user_port_continue_reverse() in the error path to iterate only over the fully initialized ports.