SenseLive X3050 web management interface transmits all administrative communication including authentication credentials and configuration data over unencrypted HTTP, allowing network-adjacent attackers to intercept sensitive operational information without authentication or user interaction. The vulnerability affects all versions of the X3050 and is classified as information disclosure with confirmed CISA ICS advisory coverage.
Remote code execution in FlowiseAI Flowise before 3.1.0 allows an attacker to abuse the AirtableAgent node, which passes unsanitized user question input into a Python code template executed via Pyodide/Pandas. Because the question is reflected directly into the generated Python without validation, a crafted prompt-injection payload escapes the intended LLM behavior and executes arbitrary Python. SSVC rates technical impact as total with a public proof-of-concept, though EPSS remains low at 0.43% (63rd percentile) and there is no public exploit identified in CISA KEV at time of analysis.
Remote code execution in OpenLearnX (npm package openlearnx) before 2.0.3 lets an authenticated low-privilege user escape the Python code-execution sandbox and run arbitrary OS commands on the host. Because submitting code to the compiler/execution environment is the platform's intended feature, any user with access to that endpoint can weaponize it. Classified CWE-78 (OS command injection); no public exploit identified at time of analysis, EPSS 0.41% (61th percentile), and the flaw is fixed in 2.0.3.
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.
Privilege escalation in Actual Budget sync-server (npm @actual-app/sync-server before 26.4.0) allows any authenticated user, including a low-privilege BASIC-role account, to gain full ADMIN control on servers that were migrated from password authentication to OpenID Connect. The flaw chains an unauthorized /account/change-password endpoint, an orphaned password auth row left active after migration, and a client-controlled loginMethod override, letting an attacker set a known password and log in as the anonymous ADMIN account. Publicly available exploit code exists (SSVC PoC) with a working curl-based chain, though EPSS is low (0.07%) and it is not listed in CISA KEV.
Denial of service in the CODESYS EtherNet/IP adapter stack (versions 1.0.0.0 up to but not including 4.9.0.0) lets an unauthenticated remote attacker exhaust all available TCP connections, blocking legitimate EtherNet/IP clients from establishing new sessions. The flaw is remotely reachable with no authentication or user interaction (CVSS 4.0 8.7, VA:H). No public exploit has been identified at time of analysis and EPSS is low (0.14%), but CISA SSVC rates it automatable with partial technical impact.
Authorization bypass in OpenClaw before 2026.3.28 lets an LLM agent silently disable execution-approval controls by writing to protected configuration paths (tools.exec.ask and tools.exec.security) through the gateway tool's config.patch and config.apply actions. Once the exec-approval guardrail is turned off, the agent can run commands without the user consent prompt that normally gates them, effectively self-escalating its own operational authority. EPSS is low (0.11%, 28th percentile) and there is no public exploit identified at time of analysis, but the technical impact is rated total by CISA's SSVC framework and a vendor patch is available.
Remote unauthenticated attackers can access sensitive operating system files in Ziostation2 medical imaging software v2.9.8.7 and earlier via path traversal, achieving high confidentiality impact. The vulnerability requires no authentication, low attack complexity, and no user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), making it easily exploitable from the network. While not currently listed in CISA KEV and lacking public exploit code at time of analysis, the trivial exploitation conditions and exposure of medical system data present significant risk to healthcare organizations using affected versions.
Remote denial of service via regular expression attack in GROWI allows unauthenticated network attackers to exhaust server resources by submitting maliciously crafted input strings that trigger catastrophic backtracking in regex processing (CWE-1333). GROWI, Inc.'s collaboration platform is vulnerable to ReDoS with a CVSS 4.0 base score of 8.7 (High), reflecting high availability impact through network-accessible, low-complexity exploitation requiring no privileges or user interaction. No CISA KEV listing or public exploit code identified at time of analysis, though vendor advisory confirms the vulnerability and provides remediation guidance.
Information disclosure in FlowiseAI Flowise before 3.1.0 exposes plaintext credentials through the unauthenticated GET /api/v1/public-chatflows/:id and public-chatbotConfig endpoints, which return the full raw flowData for any chatflow flagged public. Because the sanitizeFlowDataForPublicEndpoint helper is absent from the released v3.0.13 Docker image, remote attackers can retrieve credential IDs, plaintext API keys, and password-type fields without authentication. No public exploit is identified at time of analysis and EPSS probability is low (0.04%), but the disclosure is trivially automatable per CISA SSVC.
Stored cross-site scripting in pretalx conference planning software before 2026.1.0 lets any registered user inject HTML/JavaScript via submission titles, speaker display names, or user names/emails, which executes in an organiser's browser when the organiser's typeahead search matches the malicious record. Because the backend rendered these fields into the search dropdown via innerHTML string interpolation, the injected script runs in the authenticated organiser context and can steal the CSRF token and perform actions on the victim's behalf. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but a scope-changing high-impact CVSS (8.7) and a vendor GHSA make this a credible privilege-escalation vector.
Path traversal in Zurich Instruments LabOne Web Server allows unauthenticated remote attackers to read arbitrary files accessible to the LabOne process. The vulnerability combines insufficient input validation (CWE-22) with missing CORS restrictions, enabling direct exploitation or browser-based attacks via malicious websites. EPSS data not available, but the network-accessible unauthenticated attack vector (AV:N/PR:N/UI:N) combined with vendor-confirmed patch indicates active vendor response to a readily exploitable information disclosure flaw. Exploitation limited to installations running the Web Server component; API-only deployments are unaffected.
Server-side request forgery in Microsoft Purview eDiscovery lets an unauthorized remote attacker coerce the service into issuing crafted requests to elevate privileges over the network, with a scope-changing confidentiality impact (CVSS 8.6). The flaw is remotely reachable without authentication or user interaction, and Microsoft has issued a fix. There is no public exploit identified at time of analysis, and EPSS (0.06%) rates near-term mass exploitation as low.
Reflected Cross-Site Scripting in STIG Manager 1.5.10 through 1.6.7 enables arbitrary JavaScript execution during OIDC authentication error handling. Attackers crafting malicious redirect URLs can exploit unsanitized error parameters written directly to DOM via innerHTML. When victims with active sessions follow these links, injected code executes in application context with access to SharedWorker-managed authentication tokens, enabling authenticated API requests to read and modify STIG assessment collection data. CVSS 8.5 reflects high confidentiality and integrity impact despite requiring user interaction. No public exploit identified at time of analysis; vendor-released patch available in version 1.6.8.
DNS zone file injection in Froxlor versions prior to 2.3.6 allows authenticated customers to inject arbitrary BIND directives and DNS records through unvalidated record types and unsanitized newline characters. Attackers with low-privilege customer accounts can manipulate DNS resolution for managed domains by embedding malicious directives like $INCLUDE, $ORIGIN, or $GENERATE into zone files, potentially redirecting traffic, creating unauthorized records, or disrupting DNS services. CVSS 8.5 with scope change indicates impact beyond the vulnerable component. Vendor patch released in version 2.3.6 (GitHub commit 47a8af5d). No CISA KEV listing or public exploit identified at time of analysis, but attack complexity is low (AC:L) for authenticated users.
Arbitrary code execution in OpenClaw before 2026.3.31 (npm package 'openclaw') arises because a workspace-local .env file is allowed to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, redirecting the trusted bundled-hooks root to an attacker-controlled directory. Because bundled hooks are default-on and run automatically at startup, a victim who opens or runs OpenClaw inside an untrusted workspace loads and executes attacker-supplied hook code with the user's privileges. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), but technical impact is total (full C/I/A compromise) and a vendor patch is available.
Path traversal in Vite+ downloadPackageManager() allows local attackers to write or delete arbitrary files outside the intended cache directory. The vulnerability affects Vite+ versions before 0.1.17 and stems from inadequate input validation on the version parameter, enabling directory traversal via '../' sequences or absolute paths. Attackers with local access can manipulate filesystem operations to compromise system integrity and availability (CVSS 8.4, VI:H/VA:H). No public exploit identified at time of analysis, but exploitation requires minimal technical complexity (AC:L) and no authentication (PR:N). Vendor-released patch available in version 0.1.17.
DLL hijacking in LiveOn Meet Client and Canon Network Camera Plugin installers allows local attackers to execute arbitrary code with installer privileges when users run vulnerable installer executables from directories containing malicious DLLs. The flaw affects four installer executables (Downloader5Installer.exe, Downloader5InstallerForAdmin.exe, CanonNWCamPlugin.exe, CanonNWCamPluginForAdmin.exe) version 1.0.0.0. No public exploit identified at time of analysis, though the attack technique is well-documented. CVSS 8.4 (High) reflects significant impact contingent on user interaction and attacker's ability to place malicious files in the installer directory before execution - real-world risk depends heavily on organizational download practices and endpoint controls preventing untrusted DLL placement.
Sandbox escape in Google Chrome on Windows before 147.0.7727.117 lets a remote attacker exploit a race condition (CWE-362) in the GPU process by luring a victim into loading a crafted video file, potentially breaking out of the browser sandbox. Google rates the Chromium severity Medium, but the CVSS scope-changing vector drives an 8.3 score; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 19th percentile).
Server-Side Request Forgery in Flowise's GET/POST API Chain components (versions prior to 3.1.0) lets unauthenticated remote attackers coerce the server into issuing arbitrary HTTP requests to internal and external hosts. Because the chain trusts LLM-generated URLs derived from user-supplied API documentation, an attacker injects a fake documentation prompt that overrides the intended BASE URL, enabling internal reconnaissance, cloud-metadata access, and data exfiltration. Publicly available exploit code exists (SSVC exploitation: poc), but EPSS is very low (0.05%) and the flaw is not in CISA KEV, so no active exploitation is confirmed.
Sign-up restriction bypass in Mastodon (self-hosted ActivityPub social server) before v4.5.9, v4.4.16, and v4.3.22 allows remote attackers to register accounts on instances that restrict registration by e-mail domain. Because Mastodon validates addresses but does not restrict characters that downstream mail servers interpret differently, a crafted address can pass the allow/deny-list check while ultimately delivering mail to a domain the operator intended to block. No public exploit identified at time of analysis, and EPSS is very low (0.04%), but SSVC rates the flaw automatable with partial technical impact.
Unauthenticated authorization-key abuse in FlowiseAI Flowise before 3.1.0 lets remote attackers invoke the whitelisted text-to-speech endpoint (POST /api/v1/text-to-speech/generate) with an attacker-supplied credentialId, causing the server to decrypt and use a victim's stored provider API key (OpenAI, ElevenLabs, Azure, Google) to generate speech at the victim's expense. The GitHub Security Advisory (GHSA-5fw2-mwhh-9947) includes Docker-based validation proving the code path executes without authentication, but there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is very low (0.04%, 12th percentile), consistent with SSVC exploitation status of 'none'.
Denial of service in SWUpdate (versions through 2025.12) allows unauthenticated remote attackers to crash the update service by sending a crafted HTTP POST to the /upload endpoint with a malformed multipart boundary and controlled TCP stream timing. An integer underflow in the bundled Mongoose multipart parser produces an out-of-bounds heap read that corrupts data written to a local IPC socket. No public exploit identified at time of analysis; EPSS is very low (0.03%) and CISA SSVC rates exploitation as none, but a vendor patch commit is available.
Lua code injection in Contour (Kubernetes ingress controller for Envoy) from v1.19.0 through the fixes in v1.31.6/v1.32.5/v1.33.4 lets a low-privileged tenant achieve arbitrary code execution inside the shared Envoy proxy. A user with RBAC rights to create or modify HTTPProxy resources injects Lua via the cookie-rewrite pathRewrite.value field; although the code only runs on the attacker's own route, it executes in shared infrastructure and can steal Envoy's xDS credentials (exposing other tenants' TLS keys) or cause denial of service for co-tenants. No public exploit identified at time of analysis, and EPSS is low (0.07%, 22nd percentile), consistent with the requirement for pre-existing cluster RBAC access.
Improper mass assignment in the account registration endpoint of Flowise (Flowise Cloud, versions prior to 3.1.0) lets unauthenticated attackers smuggle server-managed fields and nested objects into the POST /api/v1/account/register payload, forging ownership metadata, timestamps, organization association, and role mappings. In a multi-tenant SaaS deployment this breaks tenant trust boundaries, potentially letting an attacker attach a freshly-registered account to an existing organization with an elevated role. Publicly available exploit code exists (a working PoC is published in the GitHub Security Advisory), but the issue is not in CISA KEV and EPSS is very low (0.04%, 13th percentile).
Remote code execution in Microsoft Power Apps arises from an uncontrolled search path element (CWE-427) that lets an unauthorized attacker run arbitrary code over a network when a victim is lured into a triggering action. The flaw carries a CVSS 8.0 rating with a scope-changed impact, but exploitation requires high attacker effort and user interaction, and there is no public exploit identified at time of analysis. EPSS is very low (0.04%, 13th percentile) and CISA SSVC records no known exploitation, indicating limited real-world weaponization so far.
Use-after-free in Linux kernel CAN raw socket implementation allows local authenticated attackers to corrupt memory and potentially achieve code execution. The vulnerability stems from premature deallocation of percpu uniq storage in raw_release() while raw_rcv() may still access it via deferred RCU callbacks. Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability remains low (0.02%, 5th percentile) with no active exploitation confirmed at time of analysis.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Authentication-bypass leading to remote code execution in OpenClaw before 2026.3.31 allows a node that is only device-paired to skip the node scope gate and invoke privileged node commands (including system.run) on the host. An attacker holding device-pairing credentials - but without the stricter node-pairing approval - can execute arbitrary commands with total impact to host confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.37%, 59th percentile) and CISA SSVC records no known exploitation.
Authentication bypass in FlowiseAI Flowise before 3.1.0 lets an unauthenticated remote attacker who knows a victim's email address take over their account by abusing the password reset flow. The resetPassword method of AccountService never verifies that a reset token was actually issued, and because the stored token defaults to null (or an empty string after a prior reset), submitting a null/empty token to /api/v1/account/reset-password sets an attacker-chosen password. Publicly available exploit code exists (ZDI-CAN-28762, SSVC exploitation:poc); it is not listed in CISA KEV and EPSS is low (0.15%, 35th percentile).
Unauthenticated OAuth 2.0 access token disclosure in FlowiseAI Flowise before 3.1.0 lets remote attackers harvest valid third-party access tokens by chaining two unauthenticated endpoints. Because public chatflows expose their chatflowId by design, an attacker can query the public chatbot-config endpoint to read internal flowData containing OAuth credential identifiers, then invoke the unauthenticated token-refresh endpoint to mint live access tokens for services such as Gmail OAuth2. Publicly available exploit code exists (detailed PoC in the GHSA advisory); it is not listed in CISA KEV and EPSS is low (0.09%, 25th percentile).
Unauthenticated sensitive data disclosure in FlowiseAI Flowise before 3.1.0 lets any remote party retrieve stored secrets by requesting /api/v1/public-chatbotConfig/:id with only a chatflow UUID. The endpoint returns the full flowData object - including plaintext password-type fields (e.g. Unstructured API keys), HTTP Authorization headers from Requests nodes, and internal endpoint/webhook URLs - with no authorization check, enabling credential theft and downstream pivoting. Publicly available exploit code exists (vendor GHSA advisory with PoC), though EPSS is very low (0.05%, 15th percentile) and it is not on CISA KEV.
Arbitrary file read in Mako (the Python template library maintained under the SQLAlchemy project) affects all versions prior to 1.3.11, where TemplateLookup.get_template() mishandles URIs beginning with a double slash (e.g. //../../../etc/passwd). Because get_template() strips all leading slashes while Template.__init__ stripped only one, the 'relative outside of root' safety check is bypassed, letting any file readable by the process be returned as rendered template content when an application feeds untrusted input into get_template(). CVSS 4.0 rates it 7.7 (confidentiality-only); it is not in CISA KEV and EPSS is very low (0.05%), but the CVSS exploit-maturity flag E:P and the vendor's published test cases indicate proof-of-concept exploit code exists.
Denial of service in the Argo Workflows controller (versions 3.6.5 through 4.0.4, plus the 3.7.0-rc1 through 3.7.12 pre-releases) lets any user able to submit a workflow crash-loop the entire controller by attaching a malformed workflows.argoproj.io/pod-gc-strategy pod annotation that contains no '/' separator, triggering an out-of-range index panic in an informer goroutine that sits outside the controller's recover() scope. Because the poisoned pod persists across restarts, the controller enters CrashLoopBackOff and halts all workflow processing cluster-wide until the pod is manually deleted. A working proof-of-concept manifest is published in the GHSA advisory (SSVC exploitation status: poc), but there is no evidence of active exploitation and EPSS is very low at 0.04%.
Cross-workspace object takeover in Flowise (versions prior to 3.1.0) lets authenticated low-privilege users overwrite DocumentStore records belonging to other workspaces. The DocumentStore create endpoint accepts a client-supplied primary key and persists it via TypeORM repository.save(), turning the POST into an implicit UPSERT that can UPDATE another tenant's record and reassign or modify it. SSVC rates technical impact as total and lists proof-of-concept exploitation; EPSS is low (0.05%), and it is not on CISA KEV.
Access control bypass in OpenClaw's Node browser proxy (all versions <= 2026.3.13-1, fixed in 2026.3.22) lets an authenticated remote attacker defeat the `nodeHost.browserProxy.allowProfiles` allowlist by mutating persistent profiles and selecting profiles at runtime, reaching browser profiles that were meant to be off-limits. Because the pre-fix proxy did not enforce the allowlist across the `query.profile`/`body.profile` selectors or block profile create/delete routes, an attacker with proxy access can target and manipulate restricted profiles. No public exploit identified at time of analysis, and EPSS is very low (0.04%, 13th percentile), but SSVC rates technical impact as total.
Server-Side Template Injection in Kirby CMS (versions before 4.9.0 and 5.0.0-5.3.x) lets an authenticated Panel user achieve remote code execution and unauthorized read/write actions by planting malicious query templates in untrusted dynamic option sources. Affected sites are those using option fields (checkboxes, color, multiselect, select, radio, tags, toggles) or the Options package with values sourced from a query or API, where the double-resolution of dynamic values re-parses attacker-controlled strings such as {{ users.first.password }} or {{ page.delete }}. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but vendor-rated severity is high; SSVC technical impact is total.
Symlink-based privilege escalation in Froxlor versions prior to 2.3.6 allows authenticated customers to gain ownership of arbitrary system directories. When the ExportCron executes as root, it performs 'chown -R' on user-controlled export paths that bypass symlink validation (introduced to fix CVE-2023-6069), enabling attackers to place symbolic links and hijack ownership of critical system files. This is a regression of the CVE-2023-6069 fix where DataDump.add() failed to apply the same symlink protections used elsewhere. EPSS data unavailable; no evidence of active exploitation (not in CISA KEV), but the specific vulnerability class (symlink following in privileged operations) has well-known exploitation patterns. Patch available in version 2.3.6.
Cleartext transmission of password reset links in Flowise (via cloud.flowiseai.com) prior to version 3.1.0 allows a network-positioned man-in-the-middle attacker to intercept the reset token and hijack a victim's account. The reset email embeds the link over plain HTTP instead of HTTPS, so anyone sharing the victim's network (e.g., public Wi-Fi) can sniff the token during a reset flow. Publicly available exploit code exists (HackerOne report #1888915), but EPSS is very low (0.03%, 10th percentile) and there is no evidence of active exploitation.
Path traversal in PsiTransfer versions before 2.4.3 enables remote code execution through malicious file uploads. An attacker exploits URL encoding inconsistencies in the upload validation flow to write attacker-controlled JavaScript configuration files outside the intended upload directory. When the application restarts, these injected config files execute with application privileges, granting the attacker persistent code execution. Vendor patch released in v2.4.3 addresses the encoding mismatch between validation and file-write operations. CVSS 7.5 reflects high attack complexity and required user interaction, limiting immediate mass exploitation risk despite the severe RCE impact.
PRNG state reuse across forked processes in CryptX for Perl allows remote attackers to recover private signing keys through cryptographic nonce-reuse attacks. When Crypt::PK objects are created before fork() in preforking web servers like Starman, every child process inherits identical PRNG state, causing duplicate randomness in cryptographic operations. Two ECDSA or DSA signatures generated by different worker processes are sufficient to mathematically recover the private key. EPSS exploitation probability is low (0.02%), but CISA SSVC framework confirms proof-of-concept availability and automatable exploitation. Vendor patch released in CryptX 0.088.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
reCaptcha by WebDesignBy WordPress plugin before version 2.0 fails to sanitize the Site Key setting before injecting it into JavaScript context via the grecaptcha_js() function, enabling site administrators without unfiltered_html capability on multisite installations to inject arbitrary JavaScript that executes for all login page visitors. Publicly available exploit code exists; patch released by vendor.
Credential and traffic interception in the OpenClaw CLI (npm package 'openclaw', versions <= 2026.3.24) stems from its remote onboarding component persisting attacker-supplied discovery endpoints without an explicit trust confirmation. An adjacent attacker who can spoof a discovery endpoint can steer onboarding toward an attacker-controlled gateway and capture future gateway credentials or connection traffic. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC records no observed exploitation, though the technical impact is rated total.
Remote code execution in IBM Total Storage Service Console (TSSC) and TS4500 IMC versions 9.2 through 9.6 allows unauthenticated attackers to execute arbitrary commands with normal user privileges via improper input validation. The vulnerability carries a CVSS score of 7.3 with network attack vector and low complexity (AV:N/AC:L/PR:N/UI:N), enabling remote exploitation without authentication. No public exploit identified at time of analysis, and EPSS risk data is not available for this 2026 CVE.
Authenticated Editor-level attackers can achieve Remote Code Execution in ExactMetrics WordPress plugin (all versions ≤9.1.2) by chaining exposed onboarding credentials to install and activate arbitrary plugin ZIP files from attacker-controlled URLs. The attack exploits a missing authorization check in the 'exactmetrics_connect_process' AJAX endpoint that accepts the one-time hash token obtained via the exposed 'onboarding_key' transient-effectively bypassing plugin installation controls. EPSS and KEV status unknown; CVSS 7.2 reflects high-privilege requirement (PR:H) but direct path to RCE makes this a critical risk for multi-author WordPress sites where Editors have dashboard viewing permissions. Wordfence advisory and source code references confirm the vulnerability chain across three distinct code locations in versions through 9.1.1.
Malicious file upload leading to potential remote code execution in FlowiseAI Flowise before 3.1.0 lets an authenticated attacker bypass MIME-type restrictions in the Chatflow file-upload configuration to add the application/javascript type and store .js Node.js web shells on the server. Publicly available exploit code exists (working web shell and Python upload script published in the GHSA advisory), though EPSS remains very low at 0.06% (19th percentile). This is a bypass of the earlier fix for CVE-2025-61687 (GHSA-35g6-rrw3-v6xc), indicating incomplete prior remediation.
Information disclosure in Google BigQuery materialized view refresh allows authenticated users to extract sensitive data via crafted views that generate error messages containing confidential information. Google Cloud Platform patched this server-side vulnerability on 29 January 2026 with automatic remediation requiring no customer action. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with network-accessible attack vector and low attack complexity, though no public exploit or CISA KEV listing exists at time of analysis.