Unauthenticated open email relay in Responsive Blocks - Page Builder for Blocks & Patterns WordPress plugin (versions up to 2.2.0) allows remote attackers to send arbitrary emails through the affected site's mail server via a public REST API endpoint lacking authorization checks and email recipient validation. The vulnerability enables attackers to abuse WordPress sites for spam distribution and phishing campaigns without authentication.
Authorization bypass in GitHub Enterprise Server allows a repository admin to hijack secret scanning push protection delegated bypass reviewer lists on repositories they do not administer. The server authorizes requests against the repository specified in the URL path but applies the configuration change to the repository identified by the attacker-controlled owner_id parameter in the request body - a classic IDOR pattern (CWE-639). Impact is constrained: an attacker can only assign existing trusted users within the instance as bypass reviewers, not introduce arbitrary external accounts. No public exploit exists and EPSS is 0.05% (14th percentile); patched releases are available for all supported GHES branches.
Mozilla Firefox JavaScript Engine contains an improper input validation flaw that permits remote, unauthenticated information disclosure to attackers without user interaction. The vulnerability (CWE-20: Improper Input Validation) affects all versions prior to Firefox 150 and allows attackers to access sensitive data via a network-based attack with low complexity. A vendor-released patch is available in Firefox 150.
Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Signed integer overflow in OpenEXR 3.4.0-3.4.9 HTJ2K decompression allows remote attackers to cause denial of service via crafted EXR files with excessive FLOAT channels. The `ht_undo_impl()` function accumulates a bytes-per-line value in a 32-bit signed integer without overflow protection; on memory-permissive systems, the wrapped negative value enables heap out-of-bounds writes. OpenEXR 3.4.10 contains the fix. This is a distinct overflow from CVE-2026-34545 in the same function and mirrors the pattern of CVE-2026-34588.
Uncontrolled resource consumption in Sanluan PublicCMS versions 6.202506.a through 6.202506.d enables low-privileged remote attackers to trigger denial-of-service conditions by manipulating the ZipSecureFile.setMinflateRatio function within the document-to-HTML conversion utility DocToHtmlUtils.java. The flaw (CWE-400) causes the server to exhaust resources when processing attacker-controlled input through the affected code path. No public exploit exists, EPSS sits at 0.03% (10th percentile), SSVC confirms no known exploitation and non-automatable attack profile - real-world priority is low for most deployments, though the vendor's non-response to disclosure leaves patch status unresolved.
Confidentiality compromise in Firefox NSS Libraries allows remote unauthenticated attackers to leak sensitive information over the network without user interaction. The vulnerability affects Firefox 150 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier, and has been patched in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. No public exploit code or active exploitation has been identified at the time of analysis.
Denial of service via null pointer dereference in Firefox's Audio/Video Playback component allows remote attackers to crash the browser without user interaction. The vulnerability affects Firefox versions prior to 150 and requires only a network connection to trigger, resulting in availability loss but not code execution or data compromise. No active exploitation has been confirmed at time of analysis.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.
Unauthenticated information disclosure in WWBN AVideo versions 29.0 and prior exposes the full output of `git log -1` via a publicly accessible `git.json.php` endpoint, leaking the exact deployed commit hash, developer names and email addresses, and commit messages to any network client without credentials. The commit hash enables an attacker to fingerprint the precise deployed version and cross-reference it against AVideo's 22 published GHSAs to enumerate which vulnerabilities remain unpatched on a given instance - making this a high-value reconnaissance primitive even at a moderate CVSS score. A public proof-of-concept exists; no patched version has been released as of time of publication.
Information disclosure via the Form Autofill component in Mozilla Firefox exposes private user data to unauthorized parties through a network-accessible vector requiring no privileges. All Firefox versions prior to 150 and Firefox ESR versions prior to 140.10 are affected. With an EPSS of 0.03% and SSVC exploitation status of none, real-world exploitation appears limited at this time, though the low-friction CVSS vector and widespread browser deployment make patching advisable.
Path traversal in nesquena hermes-webui allows any authenticated user to redirect a session workspace to an arbitrary existing directory on the host filesystem by supplying attacker-controlled paths to four POST endpoints. Once the workspace is redirected, the attacker leverages the application's own file read and write APIs to access or modify files well outside the intended workspace sandbox, bounded only by the OS-level permissions of the hermes-webui process. No public exploit is identified at time of analysis and this is not listed in CISA KEV; vendor-patched release v0.50.34 is available.
CAPTCHA bypass in WWBN AVideo 29.0 and prior enables unauthenticated attackers to defeat bot protection on user registration, password recovery, and contact form endpoints in at most 33 HTTP requests per session. Two cooperating flaws are responsible: the getCaptcha.php endpoint accepts the word-length parameter directly from the query string without bounds checking, allowing an attacker to force a 1-character CAPTCHA, and failed validation attempts do not invalidate the stored session token, enabling exhaustive brute-forcing of the 33-symbol alphabet. No CISA KEV listing exists, though SSVC rates the attack as automatable with POC-level exploitation, and the effective attack complexity is trivially low regardless of the AC:L CVSS rating.
Unauthenticated information disclosure in Oracle GoldenGate versions 23.4 through 23.10 exposes a subset of accessible data to remote attackers via HTTP, requiring no credentials or user interaction. The Libraries component contains a CWE-200 flaw that allows network-based attackers to read protected data, though impact is limited to partial confidentiality - integrity and availability are unaffected. No active exploitation has been identified (not in CISA KEV), and EPSS places exploitation probability at 0.03%, consistent with the SSVC exploitation status of none despite the automatable flag.
Integer overflow in Firefox's Audio/Video Playback component allows remote unauthenticated attackers to cause integrity violations through specially crafted multimedia content. The vulnerability stems from incorrect boundary condition handling in numeric calculations, potentially enabling attackers to modify playback state or corrupt audio/video streams without user interaction. Firefox 150 and later contain the fix.
Incorrect boundary conditions in Firefox's WebRTC component allow remote attackers to read limited memory contents without authentication. Firefox versions prior to 150 are affected by this low-confidentiality vulnerability, which CVSS rates at 5.3 due to network exploitability without user interaction, though CISA's SSVC framework indicates no current exploitation activity and limited technical impact.
Denial of service in Firefox DNS networking component allows unauthenticated remote attackers to cause partial availability impact through crafted network requests. The vulnerability, classified as a cross-site request forgery (CSRF) issue within DNS handling, affects Firefox versions prior to 150 and has been patched by Mozilla.
OpenClaw before version 2026.4.2 fails to enforce write-scope authorization on the POST /sessions/:sessionKey/kill endpoint, allowing authenticated users with read-only credentials to terminate arbitrary subagent sessions. The vulnerability requires valid API credentials with read scope but does NOT require write permissions, enabling privilege escalation within identity-bearing authentication modes. No public exploit code has been identified, and this is not listed as actively exploited by CISA; however, the low CVSS score of 5.3 reflects the requirement for prior authentication rather than the ease of exploitation once credentials are obtained.
Erlang OTP SSH daemon (ssh_sftpd) stores unresolved user-supplied paths in file handles, allowing authenticated SFTP users to modify file attributes (permissions, ownership, timestamps) outside the configured chroot directory via SSH_FXP_FSETSTAT requests. When the SSH daemon runs as root, this enables privilege escalation through setting setuid bits or changing ownership of system files. The vulnerability affects OTP versions 17.0 through 28.4.3 (and earlier point releases in 27.x and 26.x series); patched versions are available per vendor advisory.
Cleartext credential storage in PublicCMS 6.202506.a through 6.202506.d exposes user-supplied passwords to any party with read access to the application's log files. The failed login handler (`log_login` in `LoginAdminController.java`) persists the raw `errorPassword` argument to disk without obfuscation, meaning that mistyped or probed passwords accumulate in plaintext logs indefinitely. No public exploit code exists and CISA has not listed this in KEV; EPSS sits at 0.01% (2nd percentile), confirming negligible observed exploitation activity at time of analysis.
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers to passively intercept and read sensitive data in transit without authentication or user interaction. The vulnerability exposes confidential information including credentials and system details to packet sniffing attacks on any network where the service is accessible.
XiangShan open-source RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 and earlier versions fail to properly gate the Control and Status Register (CSR) write-enable path for Physical Memory Attribute (PMA) configuration, allowing local attackers with code execution privileges to write to PMA CSRs that should raise illegal-instruction exceptions per the RISC-V specification. Successful exploitation enables attackers to alter memory attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on platform security boundaries. No public exploit code or active exploitation has been confirmed at time of analysis.
Improper access control in Oracle Hyperion Infrastructure Technology's Lifecycle Management component allows a network-reachable, high-privileged authenticated attacker to perform unauthorized creation, deletion, or modification of critical Hyperion data, while also gaining read access to a subset of accessible data. Affected is the single supported version 11.2.24.0.000, patched in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (7th percentile) and CISA's SSVC framework rates exploitation as none, placing this firmly in a low-urgency remediation tier despite the High integrity impact component.
Reflected cross-site scripting in Navigate CMS allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via unsanitized query parameters in the /blog endpoint. The vulnerability affects Navigate CMS versions 0 through 2.9.5 and requires user interaction (clicking a malicious link). CVSS 5.1 reflects the limited scope (only session/cookie theft) and mandatory user interaction, though exploitation is straightforward for phishing campaigns.
HTML injection vulnerability in PHP Point of Sale v19.4 allows unauthenticated remote attackers to render arbitrary HTML in victims' browsers via the '/reports/generate/specific_customer' endpoint, affecting the 'start_date_formatted' and 'end_date_formatted' parameters. User interaction is required (victim must visit a crafted link), limiting impact to stored/reflected XSS scenarios. No public exploit code or active exploitation has been confirmed at the time of analysis.
Reflected cross-site scripting (XSS) in Semantic MediaWiki 5.0.2 allows unauthenticated remote attackers to inject malicious JavaScript via the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. A victim visiting an attacker-crafted URL executes arbitrary JavaScript in their browser, enabling session cookie theft or unauthorized actions on behalf of the user. User interaction (clicking the link) is required. No public exploit code or active exploitation has been identified at time of analysis.
Local denial-of-service in MySQL Shell's Core Client component allows a low-privileged OS user, with required interaction from a legitimate victim user, to repeatedly crash or hang the MySQL Shell process across three active release branches. Affected deployments span 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0, as confirmed by Oracle's April 2026 CPU. EPSS sits at the 2nd percentile with no public exploit code and no CISA KEV listing, placing this squarely in the routine-patching tier rather than emergency response.
Denial-of-service in Oracle MySQL Shell's Core Client component allows a low-privileged local attacker, with required human interaction from another user, to cause a hang or repeatable crash of MySQL Shell across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit has been identified, EPSS sits at 0.01% (2nd percentile), and SSVC assesses exploitation as 'none' with non-automatable attack conditions - all signals converging on minimal real-world risk. Impact is strictly limited to availability; there is no confidentiality or integrity exposure.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in MySQL Server's Optimizer component allows a high-privileged network attacker to hang or repeatedly crash the database engine across three major release branches (8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0). Exploitation requires a high-privilege database account (DBA-level), but once authenticated, the attack is low-complexity and requires no user interaction - Oracle's advisory describes it as 'easily exploitable' in that context. No public exploit code or active exploitation has been identified; EPSS of 0.04% (11th percentile) and SSVC exploitation rating of 'none' together indicate this poses negligible real-world exploitation risk at time of analysis.
Denial-of-service exposure in Oracle MySQL Server's DML (Data Manipulation Language) component allows a high-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server. Affected across three active release trains - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - the vulnerability is exploitable over multiple network protocols without user interaction. No public exploit exists and the vulnerability is not listed in CISA KEV; EPSS at 0.04% (11th percentile) confirms very low exploitation activity at time of analysis.
Denial-of-service in MySQL Server's InnoDB component allows a high-privileged authenticated attacker with network access to cause a hang or frequently repeatable crash of the database server across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Impact is confined to availability - no data exfiltration or integrity compromise is possible through this vector. No public exploit has been identified at time of analysis, and EPSS probability of 0.04% (11th percentile) is consistent with SSVC's confirmed zero observed exploitation, placing this firmly in the lower-priority patch tier for most organizations.
Denial-of-service in MySQL Server's InnoDB storage engine allows a high-privileged, network-authenticated attacker to hang or repeatedly crash the database server across all major release trains (8.0.x, 8.4.x, and 9.x). The vulnerability is reachable over multiple network protocols without user interaction, making it exploitable by any account holding high database privileges (e.g., DBA or SUPER). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, consistent with an EPSS score of just 0.04%.
InnoDB component in MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0 exposes a denial-of-service condition reachable over the network by a highly privileged attacker, causing the database server to hang or crash repeatably. Disclosed as part of Oracle's April 2026 Critical Patch Update (CVSS 3.1: 4.9), the vulnerability has an EPSS of 0.04% (11th percentile), SSVC exploitation status of 'none', and no public exploit identified at time of analysis. Oracle has released a patch; risk is largely limited to scenarios involving compromised administrative credentials or malicious insiders.
Denial-of-service in Oracle MySQL Server's GIS (Geographic Information System) component allows a high-privileged, network-authenticated attacker to cause the database server to hang or repeatedly crash. Versions 9.0.0 through 9.6.0 are confirmed affected. No public exploit has been identified and EPSS probability stands at 0.04% (11th percentile), consistent with SSVC's exploitation rating of 'none' - real-world risk is confined primarily to insider threat or compromised DBA account scenarios.
Denial-of-service in Oracle MySQL Server's Partition component (versions 9.0.0-9.6.0) allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash, resulting in full availability loss. Exploitation is constrained to authenticated users holding high database privileges (CVSS PR:H), sharply limiting the realistic attack surface. No public exploit code exists, EPSS is 0.04% (11th percentile), and SSVC confirms no known exploitation - placing this firmly in the low real-world priority tier despite its network-accessible vector.
Denial-of-service in MySQL Server's InnoDB component allows high-privileged authenticated attackers with network access to crash or hang the database server via multiple protocols. Affected versions span three major release lines - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - covering a broad footprint of Oracle MySQL deployments including downstream Red Hat and SUSE packages. Proof-of-concept exploit code exists per SSVC classification, though EPSS stands at 0.04% (11th percentile) with no CISA KEV listing, indicating low observed exploitation probability consistent with the high-privilege prerequisite.
MySQL Server versions 8.0.0 through 8.0.45 expose a denial-of-service condition in the DML processing component, enabling a highly privileged, network-authenticated attacker to crash or hang the database server. Oracle patched this in the April 2026 Critical Patch Update; no active exploitation has been observed (EPSS 0.04%, 11th percentile; SSVC exploitation: none). The mandatory high-privilege authentication requirement significantly constrains the realistic attacker pool to insiders or post-compromise scenarios.
MySQL Server's Optimizer component, across all 8.0.x releases from 8.0.0 through 8.0.45, is susceptible to uncontrolled resource consumption (CWE-400) that allows a high-privileged, network-authenticated attacker to cause a complete denial of service via server hang or repeatable crash. Oracle disclosed this in the April 2026 Critical Patch Update and has released a fix; no active exploitation has been identified (EPSS 0.04%, CISA SSVC exploitation: none). The combination of a required PR:H attack and availability-only impact considerably reduces real-world urgency compared to the network-vector framing alone.
Uncontrolled resource consumption in the Optimizer component of MySQL Server 8.0.0 through 8.0.45 enables a high-privileged, network-connected attacker to cause a complete denial of service via a hang or repeatable crash. The impact is availability-only - no confidentiality or integrity risk exists - and the CVSS vector (PR:H) confirms exploitation is gated behind high-level database credentials. Oracle addressed this in the April 2026 Critical Patch Update; no active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.04% (11th percentile) reflects minimal observed exploitation probability.
MySQL Server's Optimizer component crashes or hangs when high-privileged authenticated attackers submit crafted SQL queries over the network, affecting all active release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The uncontrolled resource consumption (CWE-400) results in complete availability loss for the database service, though confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and EPSS at 0.04% (11th percentile) places this among the lowest-exploitation-probability CVEs, consistent with the SSVC determination of no active exploitation.
Denial of service in MySQL Server's InnoDB component allows a high-privileged, network-connected attacker to cause the server to hang or crash repeatedly, achieving complete availability disruption. All three active release branches are affected: 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and CISA SSVC confirms no active exploitation - placing this firmly in a patch-and-monitor posture rather than emergency response.
Uncontrolled resource consumption in the MySQL Server Optimizer component allows a high-privileged, network-accessible attacker to cause a complete denial of service across all three actively maintained release trains (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The Oracle April 2026 CPU addresses this flaw; no public exploit code is identified and EPSS stands at 0.04% (11th percentile), reflecting low real-world exploitation probability. The scope extends to MySQL Server packages distributed by Red Hat and SUSE, broadening the patching surface for enterprise Linux environments.
Denial-of-service in MySQL Server's Optimizer component allows high-privileged, network-authenticated attackers to cause a complete crash or hang across three active release trains (8.0.x, 8.4.x, 9.x). The broad version coverage and multi-protocol attack surface are notable, but the PR:H requirement limits the attacker pool to actors who already hold elevated MySQL credentials. No public exploit has been identified and EPSS at 0.04% (11th percentile) confirms low observed exploitation probability; Oracle has released a patch via the April 2026 Critical Patch Update.
October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated backend users with Editor permissions to read arbitrary server files by crafting malicious CSS preprocessor files (.less, .sass, .scss) that exploit the compiler's import functionality. The vulnerability persists even when cms.safe_mode is enabled, enabling high-confidence information disclosure of sensitive configuration files, credentials, and application source code without requiring administrative privileges.
OpenClaw before version 2026.3.31 contains a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality, where unguarded fetch() calls allow authenticated users with user interaction to make arbitrary network requests on behalf of the affected system. Remote attackers can access internal resources or interact with external services, potentially disclosing sensitive data or compromising internal infrastructure; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw before version 2026.3.31 allows authenticated users to exploit server-side request forgery (SSRF) through unvalidated HTTP redirects in the marketplace plugin download functionality, enabling access to internal resources and potential information disclosure. The marketplace.ts module fails to validate redirect destinations during archive downloads, permitting remote attackers with valid credentials and user interaction to redirect requests to arbitrary internal or external servers. Real-world exploitation is limited by authentication and interaction requirements, keeping the baseline CVSS at 4.8 (medium), though impact depends on network exposure of internal services.
Authentication bypass in mitmproxy 12.2.1 and below allows remote attackers to bypass LDAP-based proxy authentication through unsanitized username injection. The vulnerability affects only instances explicitly configured with the proxyauth option using LDAP authentication, which is disabled by default. Attackers can exploit this over the network without authentication or user interaction to gain unauthorized access to proxied connections.
Improper authorization in the User Interface component of Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) exposes critical financial data to low-privileged network attackers. Affected versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allow an authenticated attacker to bypass authorization controls via HTTP, contingent on human interaction from a victim user, resulting in complete confidentiality compromise of all data accessible within the platform. No public exploit exists and EPSS sits at 0.03%, indicating negligible opportunistic exploitation pressure at time of analysis.