Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive files from the server via symlink traversal in the ZIP download feature. No active exploitation or public exploit code has been identified, and the EPSS score (0.01%) indicates very low likelihood of exploitation. A vendor-released patch is available in Weblate 5.17.
Limited file disclosure and server-side request forgery in OpenRemote Manager through 1.21.0 allow authenticated low-privileged users to read local files under 1023 characters from the Manager host and initiate outbound connections. A publicly available proof-of-concept exists, but no active exploitation has been reported. The EPSS probability is very low at 0.06%.
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrators or shop managers) to extract sensitive information from the site's database. Versions up to and including 3.7.1 are affected. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability of exploitation.
Blind SQL injection in Element Pack Elementor Addons for WordPress versions through
Directory traversal in SAC-NFe v2.0.02 allows unauthenticated attackers to read arbitrary files from the server via crafted GET requests to download.php. The flaw exposes sensitive files, potentially including credentials or configuration data, and a proof-of-concept exploit is publicly available, though active exploitation has not been confirmed.
Remote code execution in Google Chrome on Android versions prior to 147.0.7727.101 is possible through a use-after-free vulnerability in the Payments feature. Attackers who successfully convince users to perform specific UI interactions on a malicious webpage can achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability requires high attack complexity and user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), indicating social engineering is necessary. Google has released Chrome 147.0.7727.101 to address this issue. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code has been identified at time of analysis.
Out-of-bounds read in Google Chrome's media component (versions prior to 147.0.7727.101) enables remote code execution when attackers convince users to perform specific UI interactions on a malicious HTML page. Google rated this high severity and released Chrome 147.0.7727.101 as a fix. No active exploitation confirmed via CISA KEV at time of analysis, though CVSS 7.5 reflects significant impact if user interaction prerequisite is met. The UI gesture requirement and high attack complexity (AC:H) reduce automated exploitation risk compared to interaction-free vulnerabilities.
Sensitive information disclosure in Slah v1.5.0 and below allows unauthenticated remote attackers to read the contents of config.php and extract active session credentials. The vulnerability permits high-confidentiality impact with no user interaction required, enabling session hijacking and unauthorized access. A proof-of-concept exploit is publicly available,
Remote validation bypass in Fastify 5.3.2+ allows unauthenticated attackers to bypass per-content-type body schema validation by prepending a single space character to the Content-Type HTTP header. Applications using schema.body.content for request validation accept malformed or malicious payloads that should be rejected, enabling data integrity violations. This regression was introduced by the fix for CVE-2025-32442. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Affects Fastify web framework version 5.3.2 through 5.8.4.
Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Connection slot exhaustion in Deadwood (MaraDNS 3.5.0036) allows remote unauthenticated attackers to cause denial of service by triggering lookups for zones with unresolvable authoritative nameserver addresses. This resource exhaustion vulnerability (CWE-670) has CVSS 7.5 severity and EPSS data indicates low exploitation probability. No public exploit identified at time of analysis, though the attack mechanism appears straightforward given the network-accessible attack vector with low complexity.
CentSDR's Thread1 function suffers a remote stack overflow, leading to denial of service without authentication. A public proof-of-concept is available, but no active exploitation has been observed. The low EPSS score and niche user base suggest limited real-world risk despite the high CVSS score.
Payment bypass in the Accept Cryptocurrencies with Plisio WordPress plugin through version 2.0.5 allows unauthenticated attackers to manipulate order payment statuses due to missing authorization checks. This high‑integrity vulnerability can be exploited to mark orders as paid without a legitimate transaction, enabling financial fraud. No active exploitation or public proofs of concept have been observed, and EPSS indicates a very low likelihood of in‑the‑wild attacks.
Cryptographically weak password salts in Apache::API::Password (Perl, CPAN) through v0.5.2 allow offline dictionary attacks against hashed credentials when optional secure-random modules are absent. The library's _make_salt and _make_salt_bcrypt methods silently fall back to Perl's built-in rand() - a non-cryptographic PRNG - if both Crypt::URandom and Bytes::Random::Secure are unavailable at runtime, producing predictable salt values that dramatically reduce the search space for password cracking. No public exploit code and no confirmed active exploitation are recorded; EPSS is 0.02% (4th percentile), consistent with a configuration-dependent cryptographic weakness rather than a directly triggerable remote flaw.
Denial of service in Nordic Semiconductor IronSide SE for n
Unauthenticated access to Apache SkyWalking 9.7.0 to 10.3.0 allows remote attackers to retrieve sensitive MySQL/PostgreSQL configuration details through the /debugging/config/dump endpoint. No active exploitation or public exploit code is known, though the attack is trivial and automatable. The low EPSS score (0.02%) indicates minimal real-world exploitation likelihood.
Credential hash disclosure in Git for Windows versions prior to 2.53.0.windows.3 allows unauthenticated remote attackers to obtain a user's NTLM hash by tricking them into cloning a malicious repository or checking out a malicious branch that contacts an attacker-controlled server. The extracted hash can be brute-forced offline to recover plaintext credentials, though no active exploitation or public exploit has been identified at time of analysis and EPSS likelihood is very low (0.06%).
Two-factor authentication bypass in OpenProject before 17.3.0 allows attackers with a known password to brute-force the TOTP code, gaining full account access. No rate limiting or lockout mechanism exists for the 2FA verification endpoint, making it possible to cycle through the 6‑digit code in roughly 11 hours under default settings. The flaw also affects backup code verification, completely negating 2FA protection; publicly available exploit code exists based on SSVC intelligence, though EPSS indicates a low exploitation probability.
Remote command injection in Jaaz 1.0.30 allows unauthenticated attackers to execute arbitrary commands on the underlying server via crafted MCP STDIO requests. The vulnerability resides in the application's handling of the Model Context Protocol (MCP) over standard input/output, and despite a CVSS score of 7.3 with low impact metrics, the description indicates full compromise is possible. No active exploitation or public exploit code has been identified, but the flaw is automatable and remotely exploitable without privileges.
Local privilege escalation in HP Omen Gaming Hub versions prior to 1101.2603 allows a low-privileged local attacker to execute arbitrary code with SYSTEM privileges. A public proof-of-concept detection template exists, but no active exploitation has been reported. The vulnerability is rated High severity with an EPSS of 0.01%, indicating low near-term exploitation probability.
Stored XSS in Accessibly WordPress plugin (≤3.0.3) allows unauthenticated attackers to inject malicious JavaScript executed by all site visitors via unprotected REST API endpoints. Two endpoints (/otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config) lack authentication checks (permission_callback set to __return_true), enabling attackers to modify the widgetSrc option with a URL pointing to attacker-controlled scripts. The malicious URL is stored unsanitized in WordPress options and
Stored Cross-Site Scripting in Quick Interest Slider plugin for WordPress (versions ≤3.1.5) allows unauthenticated remote attackers to inject malicious scripts via unsanitized 'loan-amount' and 'loan-period' parameters. Injected scripts execute in victim browsers when accessing compromised pages, enabling session hijacking, credential theft, or malicious redirects. CVSS 7.2 with network-accessible, low-complexity attack vector (AV:N/AC:L/PR:N) and scope change (S:C) indicates significant cross-tenant impact. No public exploit identified at time of analysis, though exploitation requires minimal technical sophistication due to unauthenticated attack surface.
Stored Cross-Site Scripting in Token of Trust WordPress plugin versions ≤3.32.3 allows unauthenticated remote attackers to inject malicious scripts via the unsanitized 'description' parameter, achieving persistent code execution in victim browsers with changed security context (CVSS scope changed). CVSS 7.2 with network attack vector and no authentication required. No public exploit identified at time of analysis, but EPSS data not provided to assess exploitation probability.
Splunk MCP Server below version 1.0.3 logs session and authorization tokens in clear text within the `_internal` index, exposing them to any user with access to that index or the high-privilege `mcp_tool_admin` capability. A remote attacker with high privileges can view these tokens via the Splunk search interface, enabling session hijacking and impersonation of other users. No public exploit is identified at time of analysis, and the EPSS score of 0.04% indicates very low near-term exploitation probability.
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users to perform administrative actions, including modifying or deleting threat intelligence rules. With CVSS 8.1 (High) driven by high integrity and availability impact, this access control bypass (CWE-863) enables low-privileged users to alter critical security configurations remotely. No public exploit identified at time of analysis, though EPSS data unavailable. Authentication requirements lower the barrier only slightly, as compromised low-privilege accounts are common in enterprise environments.
Remote code execution in Splunk Enterprise and Splunk Cloud Platform is achievable by low-privileged users - those without the admin or power role - by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory, exploiting insufficient isolation of temporary files (CWE-377). Affected versions span Splunk Enterprise below 10.2.1/10.0.5/9.4.10/9.3.11 and multiple Splunk Cloud Platform release trains. No public exploit code has been identified and CISA has not listed this in KEV; SSVC assigns Exploitation: none and Automatable: no, indicating low immediate threat despite total technical impact.
Stored Cross-Site Scripting (XSS) in Nozomi Networks Guardian and CMC allows authenticated attackers with custom field privileges to inject malicious JavaScript payloads through the Assets and Nodes custom field functionality. When victims view affected pages, the XSS executes with high integrity and availability impact due to changed scope (CVSS S:C), enabling unauthorized actions including data modification and service disruption. No public exploit identified at time of analysis, though the attack complexity is low (AC:L) once custom field access is obtained.
Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated user to execute arbitrary code with elevated privileges during installation via an uncontrolled search path (CWE-427). The vulnerability requires local access and user interaction to run the installer. No active exploitation or public exploit code is known at this time.