Authentication bypass in CDAC-Noida's e-Sushrut Hospital Management Information System (HMIS) lets remote attackers gain unauthorized access to user accounts by tampering with server responses. The login flow trusts client-side response parameters to decide whether authentication succeeded, so an attacker who intercepts and rewrites the response is treated as authenticated. Reported by CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis, and EPSS is low at 0.31% (54th percentile).
Account takeover in C-DAC's e-Sushrut Hospital Management Information System (HMIS) arises because one-time passwords (OTPs) are returned in plaintext inside API responses, letting a remote attacker who can observe those responses harvest a valid OTP and impersonate the targeted user. CERT-In flagged the flaw (CIVN-2026-0207) and it is tagged as an authentication bypass; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.17%. The CVSS 4.0 vector rates it 8.8 with high confidentiality impact and no privileges or user interaction required.
OS command injection in Pardus OS "My Computer" (versions up to and including 0.7.5, fixed in 0.8.0) lets an attacker execute arbitrary operating-system commands when a victim interacts with attacker-controlled input, inheriting the privileges of the file-manager process. Reported by Turkey's national CERT (TR-CERT) with a vendor patch available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.10%).
Cross-site scripting (XSS) in n8n's MCP OAuth client registration allows remote attackers to execute arbitrary JavaScript in authenticated user sessions. Unauthenticated attackers can inject malicious scripts via the client_name parameter during OAuth client registration, which executes when a second user revokes the OAuth consent, triggering a vulnerable toast notification. Successful exploitation enables session token theft, workflow manipulation, and privilege escalation. CVSS 8.2 (High) reflects the changed scope and complex attack chain requiring victim interaction across multiple user sessions. No public exploit or CISA KEV listing identified at time of analysis, but exploit development is straightforward given the clear attack vector.
Authentication bypass in TUBITAK BILGEM Pardus (versions <=0.6.4 up to 0.8.0) stems from improper neutralization of CRLF sequences, letting remote attackers manipulate protocol/header handling to circumvent authentication controls when a user is lured into triggering the crafted request. Reported by TR-CERT, the flaw carries a CVSS 8.8 with total technical impact per CISA SSVC, though EPSS is very low (0.05%, 17th percentile) and there is no public exploit identified at time of analysis. A vendor patch (0.8.0) is available.
Local file tampering via symlink following in Pardus About (the 'About this system' utility of the TÜBİTAK BİLGEM Pardus Linux distribution) before v1.2.1 lets an attacker abuse improper link resolution (CWE-59) so that a privileged file operation is redirected to an attacker-chosen path. Reported by TR-CERT with SSVC technical impact rated 'total' and CVSS 8.8, though there is no public exploit identified at time of analysis and EPSS is very low (0.05%, 14th percentile). Note a signal conflict: the published vector is network (AV:N) yet a symlink attack in a local desktop utility strongly implies local access, which should be verified with the vendor.
Privilege escalation in TUBITAK BILGEM's Pardus Software Center before 1.0.3 allows an attacker to hijack a privileged process, enabling full compromise of confidentiality, integrity, and availability on affected Pardus Linux systems. The flaw stems from improper privilege management (CWE-269) and requires user interaction to trigger, but no prior authentication per the CVSS vector. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.
Remote code execution in Cockpit CMS 2.13.5 and earlier allows authenticated users with low privileges to execute arbitrary PHP code on the server. Attackers exploit a filter bypass in the Bucket component's _isFileTypeAllowed function by crafting filenames that evade extension validation, then renaming files to .php for execution. Public proof-of-concept exists (SSVC: poc). EPSS data unavailable, but CVSS 8.8 with network vector and low attack complexity indicates high exploitability once authenticated.
Unauthenticated remote attackers can crash n8n workflow automation instances by flooding the MCP OAuth client registration endpoint with large payloads, exhausting server memory and causing denial of service. The vulnerability affects all n8n instances regardless of whether MCP (Model Context Protocol) access is enabled, as the endpoint lacks authentication and resource controls. Vendor-released patches (1.123.32, 2.17.4, 2.18.1) impose registration limits and disable the endpoint when MCP is turned off. No public exploit identified at time of analysis, though the attack is trivial to execute given the unauthenticated nature of the endpoint.
Sensitive information disclosure in e-Sushrut (Hospital Management Information System / HMIS) lets an unauthenticated remote attacker read client-side JavaScript to harvest exposed sensitive data and hardcoded AES encryption keys, undermining the application's cryptographic protections. The flaw was reported by CERT-In and carries a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis. EPSS is very low (0.06%, 18th percentile) and CISA SSVC rates exploitation as 'none' with only partial technical impact, indicating no observed exploitation despite the high severity rating.
Authenticated users with theme upload permission in CI4MS (CodeIgniter 4 CMS/ERP) versions 0.26.0.0 through 0.31.6.0 can achieve remote code execution by uploading a malicious ZIP archive containing PHP files. The theme installation routine writes arbitrary files-including executable PHP-directly into the web-accessible public/templates/ directory without extension filtering or content validation, enabling direct HTTP access to webshells. A proof-of-concept exploit is publicly available via the GitHub security advisory (GHSA-fw49-9xq4-gmx6), and the vendor has released a patched version 0.31.7.0 implementing strict file extension allowlists for the public directory.
Server-side request forgery in pygeoapi 0.23.0 through 0.23.2 lets remote unauthenticated attackers coerce the server into issuing HTTP requests to internal, loopback, and link-local resources by supplying a crafted `subscriber` object (in_progress/success/failed URIs) in an OGC API - Processes execution request. Rated CVSS 8.6 (CWE-918), it is fixed in 0.23.3, which blocks internal-target requests by default. EPSS is low (0.04%, 14th percentile) and there is no public exploit identified at time of analysis.
Memory corruption in the Text::CSV_XS Perl module (all versions before 1.62) occurs when application-registered callbacks such as after_parse, before_print, or on_error extend the Perl argument stack during Parse, print, getline, or getline_all, causing a use-after-free through a stale stack pointer. Affected code receives the Text::CSV_XS object instead of parsed rows, producing logic errors, crashes, or potential type confusion. EPSS is 0.01% and there is no public exploit identified at time of analysis, though the fix commit ships a sandbox reproducer.
Arbitrary file read and Server-Side Request Forgery in i18next-http-middleware before 3.9.3 arise because the getResourcesHandler route passes user-controlled 'lng' and 'ns' query parameters straight into i18next's backendConnector.load() with no sanitisation, letting attackers inject path-traversal or URL-shaping payloads through the resource-loading endpoint. The concrete impact depends on the paired backend: with i18next-fs-backend it becomes arbitrary filesystem read (e.g. /etc/passwd, .env, .ssh keys, Docker secrets), and with i18next-http-backend it becomes SSRF against internal services and cloud metadata endpoints. No public exploit identified at time of analysis and EPSS is very low (0.05%), but a working example request is documented in the vendor advisory and a fixed release (3.9.3) is available.
SAML response redirection in Admidio 5.0.8 and earlier allows attackers to steal signed authentication assertions containing user credentials and profile data by exploiting missing validation of the AssertionConsumerServiceURL in SAML AuthnRequests. The Identity Provider (IdP) accepts attacker-controlled destination URLs from SAML requests without verifying them against registered Service Provider endpoints, enabling assertion theft and account impersonation across federated applications. No public exploit code identified at time of analysis, though proof-of-concept demonstration is included in the GitHub security advisory GHSA-p9w9-87c8-m235. EPSS data not available for this CVE.
SAML signature validation in Admidio's Identity Provider implementation can be completely bypassed due to discarded return values in authentication flows. The validateSignature() method returns error strings on failure but both call sites (SSO and Single Logout handlers) discard the return value, allowing unsigned or invalidly-signed SAML requests to proceed. Attackers can forge AuthnRequests to exfiltrate logged-in users' personal data (username, email, real name, role memberships) to attacker-controlled endpoints, or forge LogoutRequests to terminate victim sessions and cascade logout across federated Service Providers. The smc_require_auth_signed configuration setting provides no protection. Public exploit code exists (PoC in GitHub advisory). CVSS 8.2 reflects network-accessible attack with no authentication required, though practical exploitation of the SSO path requires victim to have an active session. No active exploitation confirmed at time of analysis.
Stored cross-site scripting in Jenkins HTML Publisher Plugin (versions 427 and earlier) lets an attacker with Item/Configure permission inject JavaScript via an unescaped job name and URL written into the legacy wrapper file, which then executes in the browser of any user who later views the published report. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 12th percentile), but the SSVC technical impact is rated total, meaning a successful payload can fully compromise a victim session such as an administrator's.
Incorrect authorization in SailPoint IdentityIQ lets an authenticated user who is the requestor or assignee of a work item edit the definition of a role even though they lack the capability that normally gates role editing. All versions prior to the 8.3p5, 8.4p4, and 8.5p2 patch levels are affected, enabling privilege-boundary bypass within the identity governance platform itself. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%), but the technical impact is rated total because roles drive downstream access across connected systems.
Improper access control in SonicWall SonicOS lets an adjacent-network attacker reach certain management interface functions that should be restricted, exposing sensitive information (tagged Information Disclosure) with high confidentiality, integrity, and availability impact per CVSS 8.0. The flaw is vendor-reported by SonicWall PSIRT (SNWLID-2026-0004) and affects the firewall/appliance operating system across the 6.5.5.x, 7.0.x, 7.3.x, and 8.1.x branches. There is no public exploit identified at time of analysis, and EPSS is negligible (0.01%).
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
Local privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud Agent (Windows, builds before 42183) allows a low-privileged local user to escalate to full system control through improper input validation. Classified as CWE-123 (write-what-where condition), successful exploitation yields total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the SSVC technical impact is rated total.
Local privilege escalation in EnTech Taiwan TVicPort v4.0 (driver v5.2.1.0) allows authenticated low-privileged users to gain SYSTEM privileges via crafted IOCTL 0x80002008 requests to the TVicPort64.sys kernel driver. The vulnerability stems from improper input validation (CWE-20) in IOCTL handling. Publicly available exploit code exists (GitHub gist), enabling straightforward elevation of privileges on systems with the driver installed. SSVC assessment indicates total technical impact with no active exploitation reported, though the low attack complexity and available POC present significant risk to environments using this I/O port access driver.
Arbitrary code execution in berabuddies AgentFlow (all versions prior to fix commit 1667fa3) allows attackers to run local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints of the local web API. Because 'agentflow serve' binds its control plane to 127.0.0.1, an attacker who can induce requests to that local API - for example via a victim's browser - can make it load and execute an existing .py pipeline on disk, gaining code execution as the user running AgentFlow. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total.
Remote code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) lets an attacker who can influence HTTP update responses write arbitrary executables outside the update staging directory. The flaw stems from unvalidated attacker-controlled HTTP headers being passed to filepath.Join, permitting path traversal into sensitive locations such as the Windows Startup folder. Chained with CVE-2026-42248 (missing update signature verification), the silent auto-updater executes the planted binary, yielding automatic and persistent code execution with no user interaction. There is no public exploit identified at time of analysis and EPSS is very low (0.03%).
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verification routine that unconditionally returns success, so no signature or trust check is performed before staging and executing downloaded update payloads (CWE-494). Because Ollama on Windows applies updates silently and automatically, an attacker who can substitute the update executable can have arbitrary code installed and run without user awareness. No public exploit identified at time of analysis; EPSS is very low (0.01%) and CISA SSVC records exploitation as none, though technical impact is rated total.
Reflected cross-site scripting (XSS) in Icinga Web's ipl-web library (composer package ipl/web) allows remote attackers to execute arbitrary JavaScript in victim browsers via malformed search requests. Affects all versions ≤0.13.0. Fixed in ipl/web 0.13.1 (bundled in icinga-php-library 0.19.2). Requires high-privilege authenticated attacker and victim user interaction via social engineering. No active exploitation confirmed by CISA KEV. CVSS 7.7 reflects scope change (cross-user impact) despite complex attack prerequisites.
Blind SQL injection in TaxoPress (simple-tags) for WordPress, versions up to and including 3.44.0, lets a high-privileged authenticated user inject SQL through improperly neutralized input (CWE-89) and read arbitrary database contents. Reported by Patchstack (EUVD-2026-26217); there is no public exploit identified at time of analysis and EPSS is very low (0.03%). The CVSS 3.1 base score is 7.6 with a scope change, reflecting that a successful injection reaches the backend database beyond the plugin's own security boundary.
Arbitrary file write in the Jenkins Credentials Binding Plugin (version 719.v80e905ef14eb_ and earlier) allows an authenticated user who can supply file or zip file credentials to a job to escape the intended credentials directory via unsanitized file names (path traversal), planting files anywhere on the node filesystem. When Jenkins is configured to let a low-privileged user configure such credentials for a job running on the built-in node, this file write escalates to remote code execution. There is no public exploit identified at time of analysis, and EPSS is low (0.34%, 57th percentile), consistent with the high attack complexity and non-default preconditions.
Directory exposure in pygeoapi's STAC FileSystemProvider (versions 0.23.0 through 0.23.2) lets remote unauthenticated attackers read arbitrary directories on the server by supplying '..' traversal sequences in requests to a stac-collection resource. The flaw stems from raw string path concatenation and only surfaces when pygeoapi is deployed without a URL-normalizing proxy and a stac-collection resource is configured. There is no public exploit identified at time of analysis and EPSS is low (0.09%), but exploitation is trivial (AV:N/AC:L/PR:N) wherever the preconditions hold.
CPU denial-of-service in the PHPOffice PhpSpreadsheet library (versions 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0) allows remote attackers to hang application worker processes by uploading a ~1.6KB crafted XLSX file. The XLSX reader trusts the row number in a `<row r="...">` attribute without bounding it against the 1,048,576 row limit, so a single `<row r="999999999"/>` element inflates the cached highest row and forces roughly one billion iterations (~144s CPU burn) whenever the application iterates rows or uses getHighestRow() as a loop bound. Publicly available exploit code exists (a full PoC in the GitHub Security Advisory); EPSS is low at 0.04% (12th percentile) and it is not in CISA KEV.
Denial of service in PhpSpreadsheet's SpreadsheetML (Excel 2003 XML) reader lets a remote unauthenticated attacker exhaust server CPU with a single ~300-byte file. The Reader\Xml component fails to bound the ss:Index row attribute against AddressRange::MAX_ROW (1,048,576), so a crafted value like ss:Index="999999999" inflates cachedHighestRow to ~1 billion; any later getRowIterator() call then attempts ~1 billion iterations. A working proof-of-concept is published in the GitHub advisory, though this is not confirmed as actively exploited and EPSS risk is negligible (0.04%).
Denial of service (and likely memory-corruption code execution) affects the TOTOLINK A3002RU V3 router through firmware V3.0.0-B20220304.1804, where the hostname parameter passed to the formMapDelDevice handler in the device's boa web server is copied into a fixed-size stack buffer without bounds checking. Remote attackers can send an oversized hostname value to crash the device or corrupt the stack. A public proof-of-concept exists on GitHub, but the issue is not in CISA KEV - no public exploit indicating active exploitation was identified, and EPSS remains very low at 0.04% (12th percentile).
Client-side denial of service in the PostgreSQL JDBC Driver (pgjdbc) versions 42.2.0 through 42.7.10 lets a malicious, compromised, or attacker-controlled PostgreSQL server exhaust client CPU during SCRAM-SHA-256 authentication by advertising an extremely large PBKDF2 iteration count in the server-first-message. The affected Java client burns unbounded CPU inside PBKDF2 before authentication even fails, and because loginTimeout does not stop the worker thread, repeated or concurrent attempts can saturate cores and wedge connection pools. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not in CISA KEV; this is an availability-only issue with no authentication bypass, privilege escalation, or password disclosure.
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.
Remote unauthenticated denial of service crashes GoBGP routing daemon via malformed BGP UPDATE message exploiting index-out-of-bounds panic. Attackers send crafted BGP UPDATE with AS4_PATH attribute preceding AS_PATH, causing slice index mismanagement in UpdatePathAttrs4ByteAs function (internal/pkg/table/message.go). Publicly available exploit code exists with hex-level proof-of-concept payload demonstrating immediate process termination. Affects GoBGP v4.2.0 and earlier; vendor-released patch v4.3.0 available per GitHub advisory GHSA-8rxh-r2p6-7f2q. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network-accessible, low-complexity attack requiring no privileges, resulting in complete routing service disruption.
Remote denial of service via nil pointer dereference crashes GoBGP 4.3.0 when processing malformed BGP UPDATE messages containing unrecognized well-known path attributes. A single crafted UPDATE packet with an invalid Type Code (e.g., 0xEE or 0xFF) marked as well-known (Optional bit = 0) triggers a panic that terminates the entire BGP daemon process, not just the affected session. Publicly available exploit code exists with detailed proof-of-concept payloads confirmed by GitHub advisory GHSA-7235-89m6-f4px. Network-facing BGP deployments are at immediate operational risk despite CVSS 7.5, as BGP peering relationships make this trivially exploitable by any established peer.
Broken access control in the SureForms Pro WordPress form-builder plugin (versions up to and including 2.8.0) lets remote unauthenticated attackers reach functionality that should be protected by capability checks, resulting in limited confidentiality, integrity, and availability impact. The flaw stems from missing authorization (CWE-862) on incorrectly configured access-control security levels rather than a memory-safety or injection bug. EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, though SSVC rates the flaw as automatable with partial technical impact.
B1 Free Archiver v1.5.86 strips Mark of the Web (MotW) protections from files extracted from internet-downloaded archives, allowing untrusted executables to run without Windows Defender SmartScreen warnings. Attackers can deliver malware via email attachments or malicious downloads that, when extracted using this archiver, bypass Windows security prompts entirely. EPSS exploitation probability is minimal (0.01%) with no active exploitation or public POC identified, suggesting limited real-world targeting despite the 7.3 CVSS score and theoretical RCE capability.
Denial of service and network-configuration corruption in Amazon's FreeRTOS-Plus-TCP embedded IP stack (versions 4.0.0-4.2.5 and 4.3.0-4.4.0) allows an adjacent-network attacker to send a single crafted DHCPv6 packet that triggers an integer underflow in the DHCPv6 sub-option parser, corrupting the device's IPv6 address, DNS settings, and lease times and permanently freezing the IP task until a hardware reset. Exploitation requires no authentication and no user interaction on any device with DHCPv6 enabled. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC rates exploitation as none, though the technical impact is assessed as total.
Cross-site scripting in GCHQ CyberChef before 11.0.0 allows attackers to execute arbitrary JavaScript in a victim's browser via the 'Show Base64 offsets' operation, which rendered attacker-influenced input into the HTML output without escaping. A crafted recipe URL (e.g. /#recipe=Show_Base64_offsets('<script...')) triggers script execution in the CyberChef page context. No public exploit is identified beyond the demonstrative payload in the advisory; EPSS is negligible (0.01%) and the flaw is not automatable per CISA SSVC, though a fix is confirmed in v11.0.0.
Sandbox escape in n8n's Python Task Runner enables authenticated workflow editors to execute arbitrary code on the task runner container. This vulnerability (CWE-94: Improper Control of Generation of Code) affects n8n instances with the Python Code Node feature enabled, allowing attackers with workflow creation/modification permissions to break out of the Python sandbox. Vendor-released patches are available in versions 1.123.32, 2.17.4, and 2.18.1. No public exploit identified at time of analysis, though the technical details in the GitHub advisory provide sufficient information for exploitation by authenticated users.
Authenticated users with shared workflow access in n8n can exfiltrate other users' API credentials by injecting foreign credential IDs into dynamic-node-parameters endpoint requests. The vulnerability forces the n8n backend to decrypt and replay stolen credentials against attacker-controlled URLs, enabling credential theft across workflow collaborators. Affects npm package n8n versions <1.123.33 and 2.17.0-2.17.4, with vendor-confirmed patches available in 1.123.33 and 2.17.5. No public exploit identified at time of analysis, though CVSS 8.5 with scope change (S:C) reflects the multi-tenant credential boundary violation.
Inverted authorization logic in Admidio's two-factor authentication reset module allows non-admin users with profile edit permissions to strip TOTP protection from administrator accounts while paradoxically blocking users from resetting their own 2FA. A group leader holding 'hasRightEditProfile()' rights on an admin account can send a single POST request to /adm_program/modules/profile/two_factor_authentication.php with the admin's UUID, disabling the admin's 2FA and reducing account security to password-only. This vulnerability affects Admidio versions ≤5.0.8; patched version 5.0.9 corrects the inverted comparison operator. Public exploit code exists via the GitHub advisory's proof-of-concept. No confirmed active exploitation (not in CISA KEV).
Sensitive information disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated attacker to access data belonging to other users by decoding and tampering with Base64-encoded parameters carried in request URLs. Because Base64 is a reversible encoding rather than a cryptographic control, a low-privileged logged-in user can enumerate or alter these object references (CWE-639) to reach records they are not authorized to view. This was reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Insecure Direct Object Reference (IDOR) in C-DAC's e-Sushrut Hospital Management Information System (HMIS) lets an authenticated attacker read other patients' records by tampering with encoded identifiers in the request URL. Any logged-in, low-privilege user (per CVSS PR:L) can pivot from their own session to arbitrary patient accounts, exposing sensitive medical data. Reported to CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Unauthorized patient-data disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated user to read other patients' sensitive records by tampering with an identifier parameter in an API request URL. The flaw is a classic insecure-direct-object-reference (IDOR) authorization gap reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.05%, but the low attack complexity makes abuse trivial for any logged-in account.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
Reflected cross-site scripting in the wpeverest User Registration plugin for WordPress (all versions up to and including 5.1.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS scope-change rating (7.1) reflects that injected script can act beyond the vulnerable component, but practical impact is bounded by the privileges of whichever user is lured into clicking. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 10th percentile), and CISA SSVC records no known exploitation.
Checksum and size-validation bypass in Amazon's FreeRTOS-Plus-TCP stack (versions 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0) lets an adjacent-network attacker inject malformed packets by spoofing the Ethernet source MAC to match one of the device's own registered endpoint MACs, causing the loopback-detection path to skip all input validation. This is a CWE-290 spoofing/authentication-bypass flaw carrying a CVSS 4.0 base of 7.1 with integrity-only impact and no confidentiality or availability loss. No public exploit identified at time of analysis, EPSS is 0.02% (4th percentile), and CISA SSVC rates exploitation as none and automatable as no, so real-world urgency is modest despite the medium-high score.
Privilege escalation in Dell iDRAC10 (baseboard management controller firmware) versions 1.20.70.50 and 1.30.05.10 lets an already-authenticated low-privileged user exploit a race condition against insufficiently protected credentials to obtain elevated access to the server management controller. The flaw carries a CVSS 3.1 score of 7.1 with total confidentiality, integrity, and availability impact on the affected component. There is no public exploit identified at time of analysis and EPSS rates near-term exploitation at only 0.01%, but Dell has shipped a fix.