Server-side request forgery in ProcessWire CMS 3.0.255 and prior allows authenticated administrators to abuse the 'Add Module From URL' feature to issue outbound HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance, port scanning, and potential access to cloud metadata endpoints. A public exploit exists but requires admin credentials, limiting real-world risk.
Unauthenticated information disclosure in WordPress 3D FlipBook plugin ≤1.16.17 allows remote attackers to retrieve metadata of draft, private, and password-protected flipbooks via the send_post_pages_json() function missing a capability check. EPSS predicts very low exploitation probability (0.03%), but publicly available exploit code exists, and the attack requires no authentication or user interaction (CVSS 5.3). No evidence of active exploitation (not in CISA KEV) and SSVC flags automatable partial technical impact with no current exploitation.
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Vantage. A local authenticated user can overwrite files during installation or hardware scan, posing integrity and availability risks. No active exploitation or public exploits have been identified (EPSS 0.01%), and a vendor patch is available.
Authorization bypass in OAuth2 Proxy versions before 7.15.2 allows authenticated attackers to circumvent email domain restrictions by presenting an email claim containing multiple '@' symbols (e.g., attacker@evil.com@company.com). The flaw affects deployments that rely on email_domain enforcement with identity providers that do not strictly validate email syntax; no active exploitation or public exploit code is currently reported, and EPSS indicates low exploitation probability.
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to validate CSRF tokens on authentication endpoints, allowing remote attackers to update a targeted user's authentication method by tricking them into visiting a malicious page. The attack requires user interaction (UI:R) and results in high confidentiality and integrity impact, but no public exploit or CISA KEV confirmation has been identified at the time of analysis.
Account management inconsistencies in Splunk Enterprise and Splunk Cloud Platform allow users with the high-privilege 'edit_user' capability to create specially crafted usernames containing null bytes or non-UTF-8 percent-encoded bytes. This can lead to improper storage of usernames, resulting in inability to edit or delete affected users. No active exploitation has been identified and the EPSS score is very low (0.04%), indicating minimal real-world risk.
Prototype pollution in mafintosh's protocol-buffers-schema 3.6.0 allows remote attackers to inject arbitrary properties into JavaScript objects by supplying a malicious protocol buffer schema definition to the parse function. This can lead to application logic manipulation, security check bypass, denial of service, or remote code execution. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV at this time.
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials to exfiltrate system files via crafted HTTPS requests. The flaw stems from improper input sanitization (CWE-23) in the web-based management interface. No active exploitation or public proof-of-concept is known, and EPSS (0.08%) indicates low exploitation likelihood, making this a moderate priority for patching in environments where the management interface is already adequately protected.
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers with administrative credentials to download arbitrary files via crafted HTTPS requests. The flaw stems from improper sanitization of user input leading to relative path
A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).
Information disclosure in Google Chrome prior to version 147.0.7727.101 allows a remote attacker to obtain sensitive information from process memory by enticing a user to open a crafted file. The vulnerability, rated Medium severity by Chrome, resides in the Skia graphics library and is not currently listed in CISA KEV, with a low EPSS exploitation probability (0.03%). A patch is available from Google.
Arbitrary directory deletion in Eleganzo theme for WordPress up to version 1.2 allows authenticated attackers with Subscriber-level access to delete any server directory, including the WordPress root directory, via a path traversal flaw in the akd_required_plugin_callback function. No active exploitation or public proof-of-concept is known, and EPSS probability is very low.
Stored cross-site scripting in Emarket-design's YouTube Showcase WordPress plugin up to version 3.5.1 allows authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.03% probability of exploitation over the next 30 days. The vulnerability carries a medium CVSS 6.5 score and requires low-privilege access and user interaction.
DOM-based Cross-Site Scripting in the Zahlan Categories Images WordPress plugin through version 3.3.1 permits authenticated low-privileged attackers to inject arbitrary web scripts. When a victim visits a page embedding the manipulated content, the script executes in their browser, potentially leading to session hijacking or content spoofing. No active exploitation or public exploit code has been identified; EPSS indicates very low exploitation probability (0.03%).
Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to enforce atomic consumption of guest magic link tokens, allowing unauthenticated attackers to establish multiple concurrent authenticated sessions from a single valid magic link. This enables unauthorized access and potential information disclosure without requiring additional credentials or user interaction beyond intercepting or obtaining the link.
2-3 sentence plain-language synthesis. Not copy description. Start with impact, product, etc. Mention actively exploited? KEV? None. POC? Not mentioned, so
Stored Cross-Site Scripting in WP Circliful plugin for WordPress up to version 1.2 allows authenticated attackers with Contributor-level access to inject arbitrary HTML and JavaScript via insufficiently sanitized shortcode attributes in [circliful] and [circliful_direct] shortcodes. The vulnerability exists in the circliful_shortcode() and circliful_direct_shortcode() functions, which concatenate user input directly into HTML attributes without escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser. No public exploit code or active exploitation in the wild has been confirmed at time of analysis.
Server-side request forgery (SSRF) in NocoBase's workflow HTTP request and custom request action plugins allows authenticated workspace members to access internal network services, cloud metadata endpoints, and localhost. The vulnerability has a public proof-of-concept and a low EPSS exploitation probability, with no confirmed active exploitation. A vendor-released patch is available in version 2.0.37.
Stored cross-site scripting in Power Charts Lite WordPress plugin versions up to 0.1.0 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'id' parameter of the [pc] shortcode. The vulnerability exists because the plugin extracts user-supplied shortcode attributes, directly concatenates them into HTML class attributes without sanitization, and then decodes HTML entities, creating a persistent XSS payload that executes for all users viewing the affected page. No active exploitation has been confirmed, but the attack requires only standard WordPress contributor permissions and no additional complexity.
Stored cross-site scripting in WM JqMath WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'style' shortcode attribute, which executes in the browsers of all users viewing affected pages. The vulnerability stems from direct concatenation of unsanitized user input into HTML without proper escaping (missing esc_attr() calls). CVSS 6.4 reflects moderate risk with scope change; no public exploit code or active KEV status identified at time of analysis.
Stored cross-site scripting in Coachific Shortcode plugin for WordPress versions up to 1.0 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the 'userhash' shortcode attribute. The plugin sanitizes input with sanitize_text_field() but fails to apply JavaScript-specific escaping before interpolating the value into a script tag, enabling persistent XSS attacks visible to all page visitors. EPSS score of 6.4 reflects moderate real-world risk constrained by the requirement for authenticated contributor access and user interaction.
Stored Cross-Site Scripting in VI: Include Post By WordPress plugin up to version 0.4.200706 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class_container' shortcode attribute, which executes in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode parameters. No public exploit code or active exploitation has been reported; however, the low attack complexity and broad scope of impact (affecting all site visitors) make this a moderate-priority issue for WordPress installations using this plugin.
Signature verification bypass in Bouncy Castle BC-JAVA (bcpkix module versions 1.49-1.83) allows remote unauthenticated attackers to forge cryptographic signatures by submitting empty signature sequences that are incorrectly accepted as valid by the draft CompositeVerifier implementation. This critical flaw (CVSS 4.0: 10.0) enables complete subversion of digital signature trust chains, potentially allowing authentication bypass, code signing forgery, and man-in-the-middle attacks against Java ap
An unauthenticated remote attacker could execute cross-site scripting in Cisco Webex Contact Center’s Desktop Agent, stealing authentication and session data from victims who clicked a malicious link. Cisco fully patched the cloud service, eliminating the vulnerability without requiring any customer action. No active exploitation has been reported, and EPSS indicates very low exploitation probability.
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote attackers to execute arbitrary script code in a victim's browser context by tricking them into clicking a crafted link. This reflected XSS vulnerability (CVE-2026-20059, CVSS 6.1) affects multiple 14.x and 15.x SU releases, requiring user interaction to exploit. While no active exploitation or public exploit code has been identified, the EPSS score of 0.04% indicates a very low likelihood of widespread attacks.
Cross-site scripting (XSS) in ApostropheCMS 4.28.0 and sanitize-html 2.17.1 allows remote attackers to bypass HTML tag filtering and inject arbitrary tags through entity-encoded payloads in textarea and option elements. A regression in the sanitize-html parser incorrectly assumes htmlparser2 does not decode entities within non-text elements, causing encoded HTML to be decoded and written directly to output without sanitization. Exploitation requires non-default configurations where textarea or option tags are in the allowedTags list, commonly found in form builders, and user interaction to submit form content. No active exploitation has been identified at time of analysis, but the vulnerability is trivial to exploit once configuration conditions are met.
Cross-Site Request Forgery (CSRF) in OPEN-BRAIN plugin for WordPress versions up to 0.5.0 allows unauthenticated attackers to inject malicious web scripts by tricking site administrators into clicking a malicious link, due to missing nonce verification in the func_page_main() settings form handler. With a CVSS score of 6.1 and network-level attack surface requiring only user interaction, this vulnerability affects any WordPress installation using the affected plugin. No public exploit code or active exploitation has been confirmed at time of analysis.
Buffer overflow in GIMP's file-seattle-filmworks plugin allows denial of service when a user opens a specially crafted Seattle Filmworks file. A remote attacker can deliver the malicious file via email or download, triggering a crash of the plugin and potentially impacting GIMP's stability. No active exploitation or public exploit code has been identified.
Cross-Site Request Forgery (CSRF) in Product Pricing Table by WooBeWoo plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts or delete pricing tables by tricking site administrators into clicking a malicious link, exploiting missing nonce validation in the updateLabel() and remove() functions across all versions up to and including 1.1.0. No public exploit code identified at time of analysis, but the vulnerability requires only user interaction (UI:R) and has a network attack vector, making it moderately exploitable in real-world scenarios.
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to inject and execute arbitrary commands on the underlying operating system. This command injection flaw stems from insufficient input validation in a specific CLI command, granting full control of the network access control appliance. No public exploit or active exploitation has been identified, and the EPSS score of 0.05% indicates very low likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in Mini Ajax Cart for WooCommerce up to version 1.3.4 allows authenticated administrators to inject malicious scripts into pages. When other users view these pages, the scripts execute, potentially leading to session theft or defacement. No active exploitation reported (CISA KEV not listed, SSVC exploitation none); EPSS score very low (0.03%).
LDAP injection in Bouncy Castle BC-JAVA bcprov module (versions 1.49 through 1.83) allows remote unauthenticated attackers to manipulate LDAP queries via specially crafted input to LDAPStoreHelper.java, enabling complete compromise of confidentiality, integrity, and availability across security boundaries. This critical vulnerability (CVSS 10.0) affects a widely deployed cryptographic library used throughout the Java ecosystem. No active exploitation confirmed (not in CISA KEV), but the attack r
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Denial of service in GIMP's PVR image loader on Red Hat Enterprise Linux 6 through 9 allows an attacker to crash the application by tricking a user into opening a specially crafted PVR file. The flaw arises from a stack-based buffer overflow and out-of-bounds read, causing the application to terminate unexpectedly. It is not known to be actively exploited; proof-of-concept code has not been publicly identified.
Local denial of service in SSSD's PAM passkey responder allows a low-privileged attacker to crash the daemon by sending crafted passkey authentication data, disrupting authentication services on affected Red Hat Enterprise Linux and OpenShift systems. The vulnerability is not known to be actively exploited, and its EPSS score is negligible (0.01%).
Local file overwrite in Cisco ThousandEyes Enterprise Agent allows authenticated, low-privileged CLI users to overwrite arbitrary files by placing a symbolic link in a specific directory, achieving integrity compromise on the agent host. This vulnerability (CVE-2026-20161) has low exploitation probability (EPSS 0.01%) and is not listed in CISA KEV; no public exploit code is currently known.
Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attackers with Subscriber-level access to invoke unvalidated WordPress action hooks via the Dynamic Data feature, potentially enabling privilege escalation, file inclusion, denial of service, or remote code execution depending on available hooks in the WordPress installation. The vulnerability stems from the `output_action_hook()` function accepting user-controlled input without authorization checks. No public exploit code or active exploitation has been confirmed at time of analysis.
Authorization bypass in KubeVirt's RBAC evaluation logic allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing restricted actions. Additionally, legitimate users may be denied resource access. Exploitation requires prior authentication and the presence of custom RBAC roles; no active exploitation or public exploit code is known at time of analysis.
Stored cross-site scripting in ApostropheCMS versions 4.28.0 and prior allows authenticated editors to inject arbitrary JavaScript into the color-field widget, executing in the browsers of all site visitors. Exploitation enables mass session hijacking and privilege escalation to administrative control; publicly available proof-of-concept exploit code exists, though no active exploitation has been confirmed. The vulnerability has been patched in version 4.29.0.
Stored cross-site scripting in Kimai before 2.53.0 allows authenticated low-privilege users to inject JavaScript via the profile alias field. The incomplete `escapeForHtml()` function fails to escape double and single quotes, enabling HTML attribute injection when the alias is rendered in the team member widget, and leading to privilege escalation if an administrator views the page. Public proof-of-concept code exists, but no active exploitation has been confirmed in the wild.
Authorization policy bypass in Istio service mesh due to incorrect handling of dots (.) as regular expression metacharacters in service account names. In affected versions 1.25.0–1.27.8, 1.28.0–1.28.5, and 1.29.0–1.29.1, the `serviceAccounts` and `notServiceAccounts` fields in AuthorizationPolicy misinterpret dots, causing an ALLOW rule for e.g. `cert-manager.io` to also match `cert-manager-io` and similar variants, while a DENY rule fails to block them. An authenticated attacker with low privileges can exploit this to gain unauthorized access or bypass restrictions. No active exploitation or public proof-of-concept has been identified; EPSS indicates very low exploitation probability (0.03%). Patches are available.
Unauthorized modification of data in Tutor LMS 3.9.7 and earlier allows authenticated attackers with low privileges to exploit missing authorization checks, potentially altering course content or causing limited service disruption. The vulnerability carries a CVSS score of 5.4 but an EPSS score of 0.02% with no known active exploitation or public proof-of
We need to generate a JSON object for CVE-2026-1636. All fields must be plain text strings. Use all provided data: EPSS, KEV not mentioned (so not in KEV), tags, CPE, CVSS 4.0 vector, SSVC, etc. First, understand the vulnerability: "potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute code with elevated privileges." CWE-427: Uncontrolled Search Path Element (DLL hijacking). CVSS 4.0: AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That is local, low attack complexity, Attack Requirements: P (present? AT:P means attack requirements present, maybe specific conditions), Privileges Required: Low, User Interaction: Passive (UI:P means limited user interaction, e.g., user must open a file or perform some action). Impact: High on vulnerable system confidentiality, integrity, availability; no impact on subsequent system. This matches the description: local authenticated user, elevated privileges. The vector indicates PR:L, so authenticated. AT:P suggests there are some attack requirements beyond just running code, like needing to place a DLL in a specific path or something. EPSS 0.01%, percentile 2%, very low exploitation probability. SSVC: exploitation: none, automatable: no, technical impact: total. So not currently exploited, not automatable, total impact if exploited. Patch available, affected versions: Service Bridge 0 <5.0.2.20 (from EUVD). So fix version is 5.0.2.20 or later. Reference: Lenovo advisory LEN-211071. So we have exact patch. Now, fields: product_name: "Lenovo Service Bridge" (3 words) summary: Synthesize a 2-3 sentence plain-language summary, not copying description. Start with impact verb and product. For example: "Elevation of privilege in Lenovo Service Bridge allows a local authenticated user to execute code with elevated privileges via DLL hijacking." Then mention who is affected (Lenovo Service Bridge prior to 5.0.2.20), and that p
Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to bypass admin-configured field restrictions on the piece-type REST API, exposing sensitive content such as internal notes or draft metadata. Public exploit code is available, though the EPSS score (0.09%) indicates low current exploitation probability; no active exploitation has been confirmed.
Authentication policy bypass in Cisco Secure Web Appliance (AsyncOS) allows unauthenticated, remote attackers to send restricted HTTP requests through the appliance by exploiting improper validation of authentication input. The vulnerability (CWE-305) carries a CVSS 3.1 score of 5.3 and low EPSS likelihood (0.07%), with no active exploitation reported. Successful exploitation bypasses policy enforcement but does not directly compromise the appliance, resulting only in low integrity impact.
CPU exhaustion in python-multipart versions before 0.0.26 allows remote attackers to degrade service availability by sending crafted multipart/form-data requests containing oversized preamble or epilogue data. The parser inefficiently processes leading CR/LF data before the first boundary and continues to scan trailing epilogue data after the closing boundary, increasing CPU usage linearly with input size. No active exploitation or public proof‑of‑concept is known at this time, and EPSS indicates a very low likelihood of real‑world attacks.
Remote attackers can manipulate payment amounts in Stripe and PayPal transactions through the MetForm Pro WordPress plugin by submitting arbitrary values in the 'mf-calculation' field, bypassing price validation. Versions up to 3.9.7 are affected; the plugin fails to recompute or validate user-submitted calculation fields against configured form prices, allowing unauthenticated attackers to reduce or alter payment amounts on vulnerable forms. No active exploitation has been publicly confirmed, though the attack requires minimal complexity and produces direct financial impact.
Unauthenticated attackers can bypass field-level authorization in Advanced Custom Fields (ACF) plugin versions up to 6.7.0 via AJAX endpoints that process user-supplied filter parameters without proper privilege checks, enabling disclosure of draft, private, and restricted post/page content that should be hidden by field configuration. The vulnerability affects any WordPress site with ACF installed and frontend forms exposed, requiring only network access and no user interaction. CVSS 5.3 reflects confidentiality impact with low attack complexity; no KEV status or public POC confirmed at analysis time.
Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to extract distinct field values via the choices and counts REST API query parameters, bypassing publicApiProjection restrictions. The vulnerability exposes sensitive schema field values, including those protected by viewPermission, and a proof-of-concept exploit exists, though no active exploitation is confirmed.