Authentication bypass in cPanel & WHM allows unauthenticated remote attackers to gain unauthorized access to the control panel by exploiting a flaw in the login flow. The vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, an EPSS score of 16.52% (95th percentile), and affects multiple long-term support branches of cPanel & WHM as well as WP Squared. Given that cPanel administers shared hosting environments, successful exploitation typically grants attackers control over many downstream customer sites.
Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in DocsGPT 0.15.0 through 0.16.0 (exclusive) lets an attacker reach the application's 'MCP test' function and submit a crafted payload that bypasses its validation to run arbitrary commands on the host. Because the hosted arc53 DocsGPT site and any local or public self-hosted deployment expose the same code path, exploitation requires no authentication or user interaction (CVSS 4.0 base 10.0, CWE-77 command injection). Publicly available exploit code exists per SSVC, though EPSS remains low at 0.29% and it is not listed in CISA KEV.
Unauthenticated SQL injection in MegaCMS v12.0.0 lets remote attackers inject arbitrary SQL through the 'id_territorio' parameter of the '/web_comunications/cms/get_provincias' endpoint, which is invoked immediately after the public registration form is submitted. Because no authentication is required and the endpoint is reachable during normal user registration, an attacker can read, modify, or destroy the backing database. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.03%), but CISA's SSVC framework rates the technical impact as total and the flaw as automatable.
Remote code execution in Cockpit CMS versions 2.13.5 and earlier allows unauthenticated attackers to execute arbitrary system commands on the server by injecting malicious payloads through the filter parameter across multiple endpoints. The vulnerability exploits the MongoLite database layer's $func operator, which processes user-controlled input as executable code. Public proof-of-concept exists and the attack is fully automatable with total system compromise potential, though EPSS scoring suggests limited observed exploitation attempts (2nd percentile) at time of analysis.
Remote unauthenticated command injection in TOTOLINK N200RE V5 router allows complete device compromise via formMapDelDevice function. Attackers can execute arbitrary OS commands by injecting malicious payloads into the macstr or bandstr parameters with no authentication required (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Public proof-of-concept code exists per SSVC framework (exploitation: poc), making this immediately weaponizable against internet-facing devices. EPSS data unavailable, but CVSS vector and POC availability indicate critical real-world risk for consumer routers with default configurations exposed to the internet.
Path traversal (CWE-22) in TUBITAK BILGEM's Pardus Software Center before 1.0.3 lets a remote attacker craft package or repository content whose file paths escape the intended install directory, resulting in high-severity confidentiality, integrity, and availability impact with a scope change (CVSS 9.6). Exploitation requires the victim to interact (UI:R), typically by installing or opening attacker-supplied content, and there is no public exploit identified at time of analysis. EPSS is very low (0.03%, 10th percentile) and CISA SSVC records exploitation as 'none', indicating no observed activity despite the critical score.
Prototype pollution in n8n's XML webhook parser (xml2js library) enables remote code execution when chained with Git node SSH operations. Authenticated users with workflow editing permissions can inject malicious XML payloads to pollute JavaScript object prototypes, then leverage the polluted prototype in Git node operations to execute arbitrary code on the n8n host server. GitHub advisory GHSA-q5f4-99jv-pgg5 confirms patches available in versions 1.123.32, 2.17.4, and 2.18.1. No CISA KEV listing or public POC identified at time of analysis, but the CVSS 10.0 score appears inconsistent with the authenticated (PR:L expected) nature described in the advisory.
Prototype pollution in n8n's XML node allows authenticated workflow editors to achieve remote code execution through global prototype manipulation. The vulnerability affects n8n workflow automation platform versions prior to 1.123.32, 2.17.4, and 2.18.1, enabling attackers with workflow creation privileges to inject malicious properties into JavaScript object prototypes that can be exploited by other nodes to execute arbitrary code. Vendor-released patches are available for all affected version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 10.0 score reflects the critical scope change and complete system compromise potential.
Remote code execution in Hyperledger fabric-sdk-java (all versions 1.0.0 through 2.2.26) allows unauthenticated attackers to execute arbitrary commands via malicious serialized Java objects. The deprecated SDK's Channel.java class deserializes untrusted byte arrays without input filtering in readObject() and deSerializeChannel() methods, enabling classic Java gadget chain exploitation. Publicly available exploit code exists (ysoserial toolkit), and exploitation requires only that an application accept Channel serialization data from attacker-controlled sources such as compromised files, external APIs, or injected parameters. EPSS data unavailable; not listed in CISA KEV. Vendor has published GHSA advisory but provides no patch-remediation requires migration to the replacement fabric-gateway SDK.
Server-side request forgery and potential remote code execution affect PhpOffice PhpSpreadsheet when an application passes an attacker-controlled filename to IOFactory::load or any Reader. Because the File::assertFile helper validates paths with is_file(), which is PHP stream-wrapper aware, an attacker can supply phar://, ftp://, or ssh2.sftp:// paths to force outbound connections (SSRF) or trigger phar metadata deserialization (CWE-502) leading to code execution if a usable POP gadget exists. Publicly available exploit code exists (PoC in the GitHub advisory); it is not in CISA KEV and EPSS is low (0.10%), indicating no observed widespread exploitation yet.
Plack::Middleware::XSendfile through version 1.0053 allows remote unauthenticated attackers to read arbitrary files from nginx-proxied servers by injecting malicious X-Sendfile-Type and X-Accel-Mapping headers. When the middleware's sendfile type is not explicitly configured, clients can force nginx's X-Accel-Redirect mode and manipulate path mappings to access sensitive files outside intended directories. The middleware has been deprecated as of version 1.0053 and will be removed in future Plack releases. EPSS score of 0.01% suggests low current exploitation activity despite the high CVSS 9.1 rating. No public exploit code identified at time of analysis, though the attack technique mirrors the documented CVE-2025-61780 vulnerability in Rack::Sendfile.
Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. Writing to sensitive locations such as cron directories or Python module paths leads to remote code execution. CVSS 9.0 Critical (network-accessible, high privilege required, scope changed). Patch available in v4.14.4; no active exploitation identified.
Stored cross-site scripting in the Jenkins GitHub Plugin (versions ≤ 1.46.0) lets a low-privileged authenticated user with Overall/Read permission inject JavaScript by controlling the current job URL, which is unsafely embedded into the client-side validation logic for the 'GitHub hook trigger for GITScm polling' feature. When another user — potentially a Jenkins administrator — views the affected page, the attacker's script executes inside their authenticated Jenkins session. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but the CVSS 9.0 rating and scope-changed impact make it a meaningful CI/CD privilege-escalation surface.