SQL injection in CKAN's `datastore_search_sql` action allows unauthenticated remote attackers to read private DataStore resources and enumerate PostgreSQL system information by injecting crafted SQL. The flaw affects CKAN versions below 2.10.10 and the 2.11.0-2.11.4 range, and also functions as an authorization bypass since private data protected by CKAN's access controls can be exfiltrated. Publicly available exploit code exists; EPSS rates it in the 87th percentile (3.15%), but it is not listed in CISA KEV and there is no public exploit identified as being actively used in the wild.
XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated remote code execution in Cockpit CMS lets attackers holding collection-management privileges inject arbitrary PHP through the /cockpit/collections/save_collection endpoint's rule parameters, which are persisted to server-side PHP files and executed via include(). A low-privileged authenticated user can therefore run arbitrary OS commands on the host. Publicly available exploit code exists (VulnCheck advisory and a public gist), though this is not listed in CISA KEV; EPSS is modest at 0.39% (60th percentile).
BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Alloksoft Video joiner 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized string in the License. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Allok AVI to DVD SVCD VCD Converter 4.0.1217 contains a structured exception handling (SEH) based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service and potential heap buffer overflow in libsndfile 1.2.2's IMA ADPCM codec allows remote attackers to crash or corrupt memory in any application that parses an attacker-supplied WAV file. The flaw is an integer overflow in the frame-count calculation that was left unpatched in the WAV and close code paths after an incomplete fix for CVE-2022-33065. Publicly available exploit code exists, though EPSS is very low (0.04%, 12th percentile) and it is not on CISA KEV, indicating no observed active exploitation.
Remote code execution risk in the UTT HiPER 1250GW router (firmware up to 3.2.7-210907-180535) stems from an unbounded strcpy in the ConfigAdvideo web handler, where an oversized 'Profile' parameter overflows a stack buffer. Authenticated remote attackers (CVSS 4.0 PR:L) can crash the device or potentially hijack execution flow, achieving total impact on confidentiality, integrity, and availability. Publicly available exploit code exists per VulDB, though EPSS remains very low (0.04%) and there is no public exploit identified as actively used in the wild.
Stack buffer overflow in the UTT HiPER 1250GW gateway/router (firmware up to 3.2.7-210907-180535) lets a low-privileged authenticated attacker corrupt memory by supplying an oversized 'Profile' parameter to the formTaskEdit_ap web handler, which copies it via an unbounded strcpy(). The flaw is remotely reachable over the device's management interface and publicly available exploit code exists, though it is not listed in CISA KEV and carries a very low EPSS score (0.04%). Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.
Stack buffer overflow in the UTT HiPER 1250GW enterprise router (firmware up to 3.2.7-210907-180535) allows an authenticated attacker to corrupt memory by supplying an oversized Profile parameter to the route/goform/NTP web handler, which passes it to an unbounded strcpy(). The flaw is remotely reachable over the management interface and publicly available exploit code exists, though it is not listed in CISA KEV and carries a very low EPSS score (0.04%). Successful exploitation yields total compromise of confidentiality, integrity, and availability on the device.
LifeSize ClearSea 3.1.4 contains directory traversal vulnerabilities that allow authenticated attackers to download and upload arbitrary files by manipulating path parameters in the smartgui. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows authenticated attackers to disclose arbitrary files by injecting path traversal. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in CDAC-Noida's e-Sushrut Hospital Management Information System (HMIS) lets remote attackers gain unauthorized access to user accounts by tampering with server responses. The login flow trusts client-side response parameters to decide whether authentication succeeded, so an attacker who intercepts and rewrites the response is treated as authenticated. Reported by CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis, and EPSS is low at 0.31% (54th percentile).
Account takeover in C-DAC's e-Sushrut Hospital Management Information System (HMIS) arises because one-time passwords (OTPs) are returned in plaintext inside API responses, letting a remote attacker who can observe those responses harvest a valid OTP and impersonate the targeted user. CERT-In flagged the flaw (CIVN-2026-0207) and it is tagged as an authentication bypass; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.17%. The CVSS 4.0 vector rates it 8.8 with high confidentiality impact and no privileges or user interaction required.
OS command injection in Pardus OS "My Computer" (versions up to and including 0.7.5, fixed in 0.8.0) lets an attacker execute arbitrary operating-system commands when a victim interacts with attacker-controlled input, inheriting the privileges of the file-manager process. Reported by Turkey's national CERT (TR-CERT) with a vendor patch available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.10%).
Cross-site scripting (XSS) in n8n's MCP OAuth client registration allows remote attackers to execute arbitrary JavaScript in authenticated user sessions. Unauthenticated attackers can inject malicious scripts via the client_name parameter during OAuth client registration, which executes when a second user revokes the OAuth consent, triggering a vulnerable toast notification. Successful exploitation enables session token theft, workflow manipulation, and privilege escalation. CVSS 8.2 (High) reflects the changed scope and complex attack chain requiring victim interaction across multiple user sessions. No public exploit or CISA KEV listing identified at time of analysis, but exploit development is straightforward given the clear attack vector.
Authentication bypass in TUBITAK BILGEM Pardus (versions <=0.6.4 up to 0.8.0) stems from improper neutralization of CRLF sequences, letting remote attackers manipulate protocol/header handling to circumvent authentication controls when a user is lured into triggering the crafted request. Reported by TR-CERT, the flaw carries a CVSS 8.8 with total technical impact per CISA SSVC, though EPSS is very low (0.05%, 17th percentile) and there is no public exploit identified at time of analysis. A vendor patch (0.8.0) is available.
Local file tampering via symlink following in Pardus About (the 'About this system' utility of the TÜBİTAK BİLGEM Pardus Linux distribution) before v1.2.1 lets an attacker abuse improper link resolution (CWE-59) so that a privileged file operation is redirected to an attacker-chosen path. Reported by TR-CERT with SSVC technical impact rated 'total' and CVSS 8.8, though there is no public exploit identified at time of analysis and EPSS is very low (0.05%, 14th percentile). Note a signal conflict: the published vector is network (AV:N) yet a symlink attack in a local desktop utility strongly implies local access, which should be verified with the vendor.
Privilege escalation in TUBITAK BILGEM's Pardus Software Center before 1.0.3 allows an attacker to hijack a privileged process, enabling full compromise of confidentiality, integrity, and availability on affected Pardus Linux systems. The flaw stems from improper privilege management (CWE-269) and requires user interaction to trigger, but no prior authentication per the CVSS vector. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.
Remote code execution in Cockpit CMS 2.13.5 and earlier allows authenticated users with low privileges to execute arbitrary PHP code on the server. Attackers exploit a filter bypass in the Bucket component's _isFileTypeAllowed function by crafting filenames that evade extension validation, then renaming files to .php for execution. Public proof-of-concept exists (SSVC: poc). EPSS data unavailable, but CVSS 8.8 with network vector and low attack complexity indicates high exploitability once authenticated.
Unauthenticated remote attackers can crash n8n workflow automation instances by flooding the MCP OAuth client registration endpoint with large payloads, exhausting server memory and causing denial of service. The vulnerability affects all n8n instances regardless of whether MCP (Model Context Protocol) access is enabled, as the endpoint lacks authentication and resource controls. Vendor-released patches (1.123.32, 2.17.4, 2.18.1) impose registration limits and disable the endpoint when MCP is turned off. No public exploit identified at time of analysis, though the attack is trivial to execute given the unauthenticated nature of the endpoint.
Sensitive information disclosure in e-Sushrut (Hospital Management Information System / HMIS) lets an unauthenticated remote attacker read client-side JavaScript to harvest exposed sensitive data and hardcoded AES encryption keys, undermining the application's cryptographic protections. The flaw was reported by CERT-In and carries a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis. EPSS is very low (0.06%, 18th percentile) and CISA SSVC rates exploitation as 'none' with only partial technical impact, indicating no observed exploitation despite the high severity rating.
Authenticated users with theme upload permission in CI4MS (CodeIgniter 4 CMS/ERP) versions 0.26.0.0 through 0.31.6.0 can achieve remote code execution by uploading a malicious ZIP archive containing PHP files. The theme installation routine writes arbitrary files-including executable PHP-directly into the web-accessible public/templates/ directory without extension filtering or content validation, enabling direct HTTP access to webshells. A proof-of-concept exploit is publicly available via the GitHub security advisory (GHSA-fw49-9xq4-gmx6), and the vendor has released a patched version 0.31.7.0 implementing strict file extension allowlists for the public directory.
Server-side request forgery in pygeoapi 0.23.0 through 0.23.2 lets remote unauthenticated attackers coerce the server into issuing HTTP requests to internal, loopback, and link-local resources by supplying a crafted `subscriber` object (in_progress/success/failed URIs) in an OGC API - Processes execution request. Rated CVSS 8.6 (CWE-918), it is fixed in 0.23.3, which blocks internal-target requests by default. EPSS is low (0.04%, 14th percentile) and there is no public exploit identified at time of analysis.
Memory corruption in the Text::CSV_XS Perl module (all versions before 1.62) occurs when application-registered callbacks such as after_parse, before_print, or on_error extend the Perl argument stack during Parse, print, getline, or getline_all, causing a use-after-free through a stale stack pointer. Affected code receives the Text::CSV_XS object instead of parsed rows, producing logic errors, crashes, or potential type confusion. EPSS is 0.01% and there is no public exploit identified at time of analysis, though the fix commit ships a sandbox reproducer.
Arbitrary file read and Server-Side Request Forgery in i18next-http-middleware before 3.9.3 arise because the getResourcesHandler route passes user-controlled 'lng' and 'ns' query parameters straight into i18next's backendConnector.load() with no sanitisation, letting attackers inject path-traversal or URL-shaping payloads through the resource-loading endpoint. The concrete impact depends on the paired backend: with i18next-fs-backend it becomes arbitrary filesystem read (e.g. /etc/passwd, .env, .ssh keys, Docker secrets), and with i18next-http-backend it becomes SSRF against internal services and cloud metadata endpoints. No public exploit identified at time of analysis and EPSS is very low (0.05%), but a working example request is documented in the vendor advisory and a fixed release (3.9.3) is available.
SAML response redirection in Admidio 5.0.8 and earlier allows attackers to steal signed authentication assertions containing user credentials and profile data by exploiting missing validation of the AssertionConsumerServiceURL in SAML AuthnRequests. The Identity Provider (IdP) accepts attacker-controlled destination URLs from SAML requests without verifying them against registered Service Provider endpoints, enabling assertion theft and account impersonation across federated applications. No public exploit code identified at time of analysis, though proof-of-concept demonstration is included in the GitHub security advisory GHSA-p9w9-87c8-m235. EPSS data not available for this CVE.
SAML signature validation in Admidio's Identity Provider implementation can be completely bypassed due to discarded return values in authentication flows. The validateSignature() method returns error strings on failure but both call sites (SSO and Single Logout handlers) discard the return value, allowing unsigned or invalidly-signed SAML requests to proceed. Attackers can forge AuthnRequests to exfiltrate logged-in users' personal data (username, email, real name, role memberships) to attacker-controlled endpoints, or forge LogoutRequests to terminate victim sessions and cascade logout across federated Service Providers. The smc_require_auth_signed configuration setting provides no protection. Public exploit code exists (PoC in GitHub advisory). CVSS 8.2 reflects network-accessible attack with no authentication required, though practical exploitation of the SSO path requires victim to have an active session. No active exploitation confirmed at time of analysis.
Stored cross-site scripting in Jenkins HTML Publisher Plugin (versions 427 and earlier) lets an attacker with Item/Configure permission inject JavaScript via an unescaped job name and URL written into the legacy wrapper file, which then executes in the browser of any user who later views the published report. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 12th percentile), but the SSVC technical impact is rated total, meaning a successful payload can fully compromise a victim session such as an administrator's.
Incorrect authorization in SailPoint IdentityIQ lets an authenticated user who is the requestor or assignee of a work item edit the definition of a role even though they lack the capability that normally gates role editing. All versions prior to the 8.3p5, 8.4p4, and 8.5p2 patch levels are affected, enabling privilege-boundary bypass within the identity governance platform itself. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%), but the technical impact is rated total because roles drive downstream access across connected systems.
Improper access control in SonicWall SonicOS lets an adjacent-network attacker reach certain management interface functions that should be restricted, exposing sensitive information (tagged Information Disclosure) with high confidentiality, integrity, and availability impact per CVSS 8.0. The flaw is vendor-reported by SonicWall PSIRT (SNWLID-2026-0004) and affects the firewall/appliance operating system across the 6.5.5.x, 7.0.x, 7.3.x, and 8.1.x branches. There is no public exploit identified at time of analysis, and EPSS is negligible (0.01%).
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
Local privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud Agent (Windows, builds before 42183) allows a low-privileged local user to escalate to full system control through improper input validation. Classified as CWE-123 (write-what-where condition), successful exploitation yields total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the SSVC technical impact is rated total.
Local privilege escalation in EnTech Taiwan TVicPort v4.0 (driver v5.2.1.0) allows authenticated low-privileged users to gain SYSTEM privileges via crafted IOCTL 0x80002008 requests to the TVicPort64.sys kernel driver. The vulnerability stems from improper input validation (CWE-20) in IOCTL handling. Publicly available exploit code exists (GitHub gist), enabling straightforward elevation of privileges on systems with the driver installed. SSVC assessment indicates total technical impact with no active exploitation reported, though the low attack complexity and available POC present significant risk to environments using this I/O port access driver.
Arbitrary code execution in berabuddies AgentFlow (all versions prior to fix commit 1667fa3) allows attackers to run local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints of the local web API. Because 'agentflow serve' binds its control plane to 127.0.0.1, an attacker who can induce requests to that local API - for example via a victim's browser - can make it load and execute an existing .py pipeline on disk, gaining code execution as the user running AgentFlow. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total.
Remote code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) lets an attacker who can influence HTTP update responses write arbitrary executables outside the update staging directory. The flaw stems from unvalidated attacker-controlled HTTP headers being passed to filepath.Join, permitting path traversal into sensitive locations such as the Windows Startup folder. Chained with CVE-2026-42248 (missing update signature verification), the silent auto-updater executes the planted binary, yielding automatic and persistent code execution with no user interaction. There is no public exploit identified at time of analysis and EPSS is very low (0.03%).
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verification routine that unconditionally returns success, so no signature or trust check is performed before staging and executing downloaded update payloads (CWE-494). Because Ollama on Windows applies updates silently and automatically, an attacker who can substitute the update executable can have arbitrary code installed and run without user awareness. No public exploit identified at time of analysis; EPSS is very low (0.01%) and CISA SSVC records exploitation as none, though technical impact is rated total.
Reflected cross-site scripting (XSS) in Icinga Web's ipl-web library (composer package ipl/web) allows remote attackers to execute arbitrary JavaScript in victim browsers via malformed search requests. Affects all versions ≤0.13.0. Fixed in ipl/web 0.13.1 (bundled in icinga-php-library 0.19.2). Requires high-privilege authenticated attacker and victim user interaction via social engineering. No active exploitation confirmed by CISA KEV. CVSS 7.7 reflects scope change (cross-user impact) despite complex attack prerequisites.
Blind SQL injection in TaxoPress (simple-tags) for WordPress, versions up to and including 3.44.0, lets a high-privileged authenticated user inject SQL through improperly neutralized input (CWE-89) and read arbitrary database contents. Reported by Patchstack (EUVD-2026-26217); there is no public exploit identified at time of analysis and EPSS is very low (0.03%). The CVSS 3.1 base score is 7.6 with a scope change, reflecting that a successful injection reaches the backend database beyond the plugin's own security boundary.
Arbitrary file write in the Jenkins Credentials Binding Plugin (version 719.v80e905ef14eb_ and earlier) allows an authenticated user who can supply file or zip file credentials to a job to escape the intended credentials directory via unsanitized file names (path traversal), planting files anywhere on the node filesystem. When Jenkins is configured to let a low-privileged user configure such credentials for a job running on the built-in node, this file write escalates to remote code execution. There is no public exploit identified at time of analysis, and EPSS is low (0.34%, 57th percentile), consistent with the high attack complexity and non-default preconditions.
Directory exposure in pygeoapi's STAC FileSystemProvider (versions 0.23.0 through 0.23.2) lets remote unauthenticated attackers read arbitrary directories on the server by supplying '..' traversal sequences in requests to a stac-collection resource. The flaw stems from raw string path concatenation and only surfaces when pygeoapi is deployed without a URL-normalizing proxy and a stac-collection resource is configured. There is no public exploit identified at time of analysis and EPSS is low (0.09%), but exploitation is trivial (AV:N/AC:L/PR:N) wherever the preconditions hold.
CPU denial-of-service in the PHPOffice PhpSpreadsheet library (versions 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0) allows remote attackers to hang application worker processes by uploading a ~1.6KB crafted XLSX file. The XLSX reader trusts the row number in a `<row r="...">` attribute without bounding it against the 1,048,576 row limit, so a single `<row r="999999999"/>` element inflates the cached highest row and forces roughly one billion iterations (~144s CPU burn) whenever the application iterates rows or uses getHighestRow() as a loop bound. Publicly available exploit code exists (a full PoC in the GitHub Security Advisory); EPSS is low at 0.04% (12th percentile) and it is not in CISA KEV.
Denial of service in PhpSpreadsheet's SpreadsheetML (Excel 2003 XML) reader lets a remote unauthenticated attacker exhaust server CPU with a single ~300-byte file. The Reader\Xml component fails to bound the ss:Index row attribute against AddressRange::MAX_ROW (1,048,576), so a crafted value like ss:Index="999999999" inflates cachedHighestRow to ~1 billion; any later getRowIterator() call then attempts ~1 billion iterations. A working proof-of-concept is published in the GitHub advisory, though this is not confirmed as actively exploited and EPSS risk is negligible (0.04%).
Denial of service (and likely memory-corruption code execution) affects the TOTOLINK A3002RU V3 router through firmware V3.0.0-B20220304.1804, where the hostname parameter passed to the formMapDelDevice handler in the device's boa web server is copied into a fixed-size stack buffer without bounds checking. Remote attackers can send an oversized hostname value to crash the device or corrupt the stack. A public proof-of-concept exists on GitHub, but the issue is not in CISA KEV - no public exploit indicating active exploitation was identified, and EPSS remains very low at 0.04% (12th percentile).