Client-side denial of service in the PostgreSQL JDBC Driver (pgjdbc) versions 42.2.0 through 42.7.10 lets a malicious, compromised, or attacker-controlled PostgreSQL server exhaust client CPU during SCRAM-SHA-256 authentication by advertising an extremely large PBKDF2 iteration count in the server-first-message. The affected Java client burns unbounded CPU inside PBKDF2 before authentication even fails, and because loginTimeout does not stop the worker thread, repeated or concurrent attempts can saturate cores and wedge connection pools. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not in CISA KEV; this is an availability-only issue with no authentication bypass, privilege escalation, or password disclosure.
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.
Remote unauthenticated denial of service crashes GoBGP routing daemon via malformed BGP UPDATE message exploiting index-out-of-bounds panic. Attackers send crafted BGP UPDATE with AS4_PATH attribute preceding AS_PATH, causing slice index mismanagement in UpdatePathAttrs4ByteAs function (internal/pkg/table/message.go). Publicly available exploit code exists with hex-level proof-of-concept payload demonstrating immediate process termination. Affects GoBGP v4.2.0 and earlier; vendor-released patch v4.3.0 available per GitHub advisory GHSA-8rxh-r2p6-7f2q. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network-accessible, low-complexity attack requiring no privileges, resulting in complete routing service disruption.
Remote denial of service via nil pointer dereference crashes GoBGP 4.3.0 when processing malformed BGP UPDATE messages containing unrecognized well-known path attributes. A single crafted UPDATE packet with an invalid Type Code (e.g., 0xEE or 0xFF) marked as well-known (Optional bit = 0) triggers a panic that terminates the entire BGP daemon process, not just the affected session. Publicly available exploit code exists with detailed proof-of-concept payloads confirmed by GitHub advisory GHSA-7235-89m6-f4px. Network-facing BGP deployments are at immediate operational risk despite CVSS 7.5, as BGP peering relationships make this trivially exploitable by any established peer.
Broken access control in the SureForms Pro WordPress form-builder plugin (versions up to and including 2.8.0) lets remote unauthenticated attackers reach functionality that should be protected by capability checks, resulting in limited confidentiality, integrity, and availability impact. The flaw stems from missing authorization (CWE-862) on incorrectly configured access-control security levels rather than a memory-safety or injection bug. EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, though SSVC rates the flaw as automatable with partial technical impact.
B1 Free Archiver v1.5.86 strips Mark of the Web (MotW) protections from files extracted from internet-downloaded archives, allowing untrusted executables to run without Windows Defender SmartScreen warnings. Attackers can deliver malware via email attachments or malicious downloads that, when extracted using this archiver, bypass Windows security prompts entirely. EPSS exploitation probability is minimal (0.01%) with no active exploitation or public POC identified, suggesting limited real-world targeting despite the 7.3 CVSS score and theoretical RCE capability.
Denial of service and network-configuration corruption in Amazon's FreeRTOS-Plus-TCP embedded IP stack (versions 4.0.0-4.2.5 and 4.3.0-4.4.0) allows an adjacent-network attacker to send a single crafted DHCPv6 packet that triggers an integer underflow in the DHCPv6 sub-option parser, corrupting the device's IPv6 address, DNS settings, and lease times and permanently freezing the IP task until a hardware reset. Exploitation requires no authentication and no user interaction on any device with DHCPv6 enabled. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC rates exploitation as none, though the technical impact is assessed as total.
Cross-site scripting in GCHQ CyberChef before 11.0.0 allows attackers to execute arbitrary JavaScript in a victim's browser via the 'Show Base64 offsets' operation, which rendered attacker-influenced input into the HTML output without escaping. A crafted recipe URL (e.g. /#recipe=Show_Base64_offsets('<script...')) triggers script execution in the CyberChef page context. No public exploit is identified beyond the demonstrative payload in the advisory; EPSS is negligible (0.01%) and the flaw is not automatable per CISA SSVC, though a fix is confirmed in v11.0.0.
Sandbox escape in n8n's Python Task Runner enables authenticated workflow editors to execute arbitrary code on the task runner container. This vulnerability (CWE-94: Improper Control of Generation of Code) affects n8n instances with the Python Code Node feature enabled, allowing attackers with workflow creation/modification permissions to break out of the Python sandbox. Vendor-released patches are available in versions 1.123.32, 2.17.4, and 2.18.1. No public exploit identified at time of analysis, though the technical details in the GitHub advisory provide sufficient information for exploitation by authenticated users.
Authenticated users with shared workflow access in n8n can exfiltrate other users' API credentials by injecting foreign credential IDs into dynamic-node-parameters endpoint requests. The vulnerability forces the n8n backend to decrypt and replay stolen credentials against attacker-controlled URLs, enabling credential theft across workflow collaborators. Affects npm package n8n versions <1.123.33 and 2.17.0-2.17.4, with vendor-confirmed patches available in 1.123.33 and 2.17.5. No public exploit identified at time of analysis, though CVSS 8.5 with scope change (S:C) reflects the multi-tenant credential boundary violation.
Inverted authorization logic in Admidio's two-factor authentication reset module allows non-admin users with profile edit permissions to strip TOTP protection from administrator accounts while paradoxically blocking users from resetting their own 2FA. A group leader holding 'hasRightEditProfile()' rights on an admin account can send a single POST request to /adm_program/modules/profile/two_factor_authentication.php with the admin's UUID, disabling the admin's 2FA and reducing account security to password-only. This vulnerability affects Admidio versions ≤5.0.8; patched version 5.0.9 corrects the inverted comparison operator. Public exploit code exists via the GitHub advisory's proof-of-concept. No confirmed active exploitation (not in CISA KEV).
Sensitive information disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated attacker to access data belonging to other users by decoding and tampering with Base64-encoded parameters carried in request URLs. Because Base64 is a reversible encoding rather than a cryptographic control, a low-privileged logged-in user can enumerate or alter these object references (CWE-639) to reach records they are not authorized to view. This was reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Insecure Direct Object Reference (IDOR) in C-DAC's e-Sushrut Hospital Management Information System (HMIS) lets an authenticated attacker read other patients' records by tampering with encoded identifiers in the request URL. Any logged-in, low-privilege user (per CVSS PR:L) can pivot from their own session to arbitrary patient accounts, exposing sensitive medical data. Reported to CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Unauthorized patient-data disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated user to read other patients' sensitive records by tampering with an identifier parameter in an API request URL. The flaw is a classic insecure-direct-object-reference (IDOR) authorization gap reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.05%, but the low attack complexity makes abuse trivial for any logged-in account.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
Reflected cross-site scripting in the wpeverest User Registration plugin for WordPress (all versions up to and including 5.1.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS scope-change rating (7.1) reflects that injected script can act beyond the vulnerable component, but practical impact is bounded by the privileges of whichever user is lured into clicking. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 10th percentile), and CISA SSVC records no known exploitation.
Checksum and size-validation bypass in Amazon's FreeRTOS-Plus-TCP stack (versions 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0) lets an adjacent-network attacker inject malformed packets by spoofing the Ethernet source MAC to match one of the device's own registered endpoint MACs, causing the loopback-detection path to skip all input validation. This is a CWE-290 spoofing/authentication-bypass flaw carrying a CVSS 4.0 base of 7.1 with integrity-only impact and no confidentiality or availability loss. No public exploit identified at time of analysis, EPSS is 0.02% (4th percentile), and CISA SSVC rates exploitation as none and automatable as no, so real-world urgency is modest despite the medium-high score.
Privilege escalation in Dell iDRAC10 (baseboard management controller firmware) versions 1.20.70.50 and 1.30.05.10 lets an already-authenticated low-privileged user exploit a race condition against insufficiently protected credentials to obtain elevated access to the server management controller. The flaw carries a CVSS 3.1 score of 7.1 with total confidentiality, integrity, and availability impact on the affected component. There is no public exploit identified at time of analysis and EPSS rates near-term exploitation at only 0.01%, but Dell has shipped a fix.