Unauthenticated API input validation flaws in Tandoor Recipes (<2.6.4) enable cross-tenant data leakage and denial of service. The /api/food/{id}/shopping/ endpoint accepts unvalidated amount and unit parameters, allowing attackers to cause application crashes via malformed numeric inputs (HTTP 500 errors) and leak foreign-key references across multi-tenant Space boundaries by associating unit IDs from other tenants. CVSS 7.3 reflects network-accessible, low-complexity attacks requiring no authentication. No public exploit identified at time of analysis, though exploitation is straightforward via direct API calls. EPSS data not available. Vendor-released patch: version 2.6.4.
Arbitrary code execution in NVIDIA DALI (all versions prior to 2.0) allows local authenticated attackers with low privileges to execute malicious code by exploiting insecure deserialization of untrusted data, requiring user interaction. EPSS exploitation probability and KEV status data not available; no public exploit identified at time of analysis. The vulnerability affects NVIDIA's Data Loading Library, a critical component in AI/ML data preprocessing pipelines.
Stored XSS in ChurchCRM Note Editor enables authenticated users to execute arbitrary JavaScript in victims' browsers, leading to session hijacking and privilege escalation against administrators managing sensitive church member data. Affects ChurchCRM versions prior to 6.5.3. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. EPSS and KEV data not provided; no public exploit identified at time of analysis. Vendor patch released in version 6.5.3.
Command injection in NSA Emissary P2P workflow engine (versions prior to 8.39.0) allows authenticated remote administrators to execute arbitrary shell commands through unsanitized PLACE_NAME parameter values. The Executrix utility class passes configuration-derived values directly to /bin/sh -c with only space-to-underscore sanitization, enabling shell metacharacters (semicolons, pipes, backticks) to trigger command execution. CVSS 7.2 (High) reflects network accessibility with low attack complexity, though exploitation requires high-privilege administrator credentials (PR:H). No public exploit code identified at time of analysis, with EPSS data unavailable for this recent CVE. Vendor-released patch available in version 8.39.0 per GitHub security advisory.
Arbitrary file write in Pega Browser Extension allows remote attackers to compromise system integrity when Robot Runtime users visit malicious websites while running automations in Chrome or Edge. Affects Pega Robotic Automation versions 22.1 and R25. Attack requires user interaction (navigating to attacker-controlled site) but no authentication. No public exploit identified at time of analysis, though attack complexity is low once user visits malicious site.
Path traversal in mintplex-labs/anything-llm (versions ≤1.9.1) allows authenticated administrators to read or delete arbitrary JSON files on the server, bypassing directory restrictions in the AgentFlows component. Exploitation requires high privileges (administrator access) but achieves cross-scope impact including leaking sensitive API keys from configuration files or destroying critical package.json files. Fixed in version 1.12.1. No public exploit identified at time of analysis, though technical details are disclosed via Huntr bounty platform.
SQL injection in ChurchCRM 7.0.x and earlier allows authenticated administrators to execute arbitrary SQL commands via unsanitized EN_tyid parameter in EditEventTypes.php. While requiring high-privilege administrative access (CVSS PR:H), successful exploitation enables complete database compromise including data exfiltration, modification, and potential server-level access through database features. Patched in version 7.1.0. No public exploit identified at time of analysis, EPSS data not available for assessment.
SQL injection in ChurchCRM 7.0.5 allows authenticated administrators to execute arbitrary SQL commands through the /SettingsUser.php endpoint's type array parameter. Attackers with high-privilege administrative access can extract sensitive database contents, modify church records, or potentially escalate privileges within the system. Fixed in version 7.1.0. No public exploit identified at time of analysis, with EPSS probability data unavailable for this recent CVE.
Server-Side Request Forgery (SSRF) in WWBN AVideo 26.0 and earlier allows authenticated uploaders to exfiltrate data from internal network resources via objects/aVideoEncoder.json.php. The flaw bypasses existing SSRF protections by permitting attacker-controlled URLs with common media extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm), forcing the server to fetch and store arbitrary remote content. This represents an incomplete fix for CVE-2026-27732. No public exploit identified at time of analysis. CVSS 7.1 with network-accessible attack vector requiring low-privileged authentication.
Server-Side Request Forgery in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to trigger outbound HTTP/HTTPS requests to arbitrary external hosts by injecting malicious URLs into the Referer header. Attackers with high-privilege access can exploit this to probe internal networks, exfiltrate data, or interact with cloud metadata services. CVSS 7.0 reflects medium-high severity requiring privileged access (PR:H). No public exploit identified at time of analysis, though SSRF exploitation techniques are well-documented. EPSS data not provided, but the requirement for admin credentials significantly reduces real-world attack surface compared to unauthenticated SSRF vulnerabilities.
Cryptographic bypass in Semtech LR11xx LoRa transceiver secure boot allows physically proximate attackers to install arbitrary firmware via hash collision. The implementation uses a non-standard, collision-vulnerable hashing algorithm (CWE-327), enabling second preimage attacks that forge signed firmware images. Affects LR1110, LR1120, and LR1121 transceivers widely deployed in IoT/LoRaWAN devices. CVSS 7.0 requires physical access (AV:P), low complexity, no privileges. No public exploit identified at time of analysis; EPSS data unavailable for this recent CVE.
Local man-in-the-middle and SSH security downgrade in libssh on Windows stems from the library automatically loading configuration files from C:\etc, a directory that any unprivileged local user can create and populate. By planting a malicious config, an attacker can manipulate trusted host data and weaken SSH cryptographic negotiation, compromising the confidentiality, integrity, and availability of SSH sessions established by applications linking libssh. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not in CISA KEV.