Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that carries a serverName parameter. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in FilePress up to version 2.2.0 allows unauthenticated remote attackers to manipulate the order parameter in the Shares Filelist API (dzz/shares/admin.php and dzz/shares/ajax.php) to execute arbitrary SQL queries. The vulnerability exploits insufficient input validation on the order parameter, enabling data exfiltration or manipulation. Publicly available exploit code exists, and a vendor patch has been released.
SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_username parameter in /login.php, enabling database queries to be executed with low confidentiality and integrity impact. Publicly available exploit code exists for this vulnerability, increasing real-world exploitation risk despite the moderate CVSS score of 5.5.
SQL injection in SourceCodester SUP Online Shopping 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the msgid parameter in /admin/replymsg.php, enabling data extraction or modification. Publicly available exploit code exists and the vulnerability has a CVSS score of 5.5 with confirmed low impact to confidentiality, integrity, and availability.
SQL injection in SourceCodester SUP Online Shopping 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the seenid parameter in /admin/message.php. The vulnerability has a publicly available exploit and presents moderate confidentiality and integrity risk with a CVSS score of 5.5, though impact is limited to partial data access and modification without availability impact.
SQL injection in SourceCodester SUP Online Shopping 1.0 allows remote unauthenticated attackers to manipulate the delwlistid parameter in wishlist.php, enabling arbitrary SQL query execution with potential impact on data confidentiality and integrity. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk despite the moderate CVSS 5.5 score.
SQL injection in SourceCodester SUP Online Shopping 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via manipulation of the msgid parameter in /admin/viewmsg.php. The vulnerability has a publicly available exploit and impacts data confidentiality, integrity, and availability with a CVSS score of 5.5. While actively demonstrated through public proof-of-concept code, the lack of authentication requirements combined with network accessibility presents moderate real-world risk to exposed instances.
SQL injection in SourceCodester Comment System 1.0 allows remote unauthenticated attackers to manipulate the Name argument in post_comment.php, enabling arbitrary SQL query execution with low confidentiality and integrity impact. Publicly available exploit code exists and the attack requires no special user interaction or authentication, making it accessible to any network-connected attacker.
Heap buffer overflow in Vim's spell file parser affects all versions prior to 9.2.0450, reachable via a crafted .spl file that exploits a 32-bit signed integer multiplication overflow in read_compound() to allocate an undersized heap buffer and overflow it during a write loop. The attack can be delivered passively through Vim's modeline feature: a text file with a spelllang modeline silently triggers .spl loading when a malicious spell file has been pre-planted on the runtimepath, requiring only that the victim open the file. A public proof-of-concept exists on GitHub Gist; EPSS is 0.00% and CISA KEV has not listed this CVE, indicating no confirmed widespread exploitation at time of analysis.
SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the GINA UI, allowing remote attackers to retrieve sensitive system information including configuration details, internal paths, and potentially credentials. The vulnerability requires only network access to the affected endpoint with no authentication, authentication complexity, or user interaction; it is classified as an information disclosure flaw with limited confidentiality impact (CVSS 6.9).
Username enumeration via observable timing discrepancy affects Sync-in Server versions prior to 2.2.0, exposing valid account names to unauthenticated remote attackers through a logic flaw in the /api/auth/login endpoint. The authentication handler short-circuits immediately when a submitted username does not exist in the database, producing responses averaging 95-100ms, while valid usernames that proceed to password hashing return in approximately 350-400ms - a 250-300ms gap measurable by automated tooling. No confirmed active exploitation (not in CISA KEV), but SSVC classifies this as automatable with a publicly validated proof-of-concept technique (TickTock Enum via Burp Suite); EPSS at 0.14% (34th percentile) suggests limited observed exploitation activity to date.
Path traversal vulnerability in YARD prior to version 0.9.42 allows remote attackers to access arbitrary files on a server running yard server with unsanitized HTTP requests when using the --docroot flag. The vulnerability affects the documentation serving functionality and has been patched in version 0.9.42. No public exploit code or active exploitation has been identified at the time of analysis.
Buffer overflow in CROSS crypto_sign_open() function allows remote attackers to corrupt memory via malformed signature input due to integer underflow in message length validation. The vulnerability affects the reference implementation prior to commit fc6b7e7, enabling potential code execution or denial of service when processing untrusted signatures. The flaw exists in the core cryptographic signing operation with no authentication required, making it exploitable in any system integrating this algorithm for signature verification.
Port confusion in pupnp's URI parser allows remote unauthenticated attackers to bypass port-based access controls by supplying port values exceeding 65535 in crafted URIs. The integer truncation caused by atoi() in parse_hostport() within uri.c causes the parsed port to wrap around (e.g., port 65537 resolves to port 1), enabling SSRF-style redirection to unintended internal services. All pupnp releases prior to 1.18.5 are affected; no confirmed active exploitation exists (EPSS 0.04%, no KEV listing), but SSVC rates the attack as automatable with partial technical impact.
Denial of service in Zebra's JSON-RPC HTTP middleware allows authenticated RPC clients to crash a Zebra node by disconnecting mid-request, exploiting improper error handling that treats incomplete HTTP body reads as unrecoverable failures instead of returning error responses. Affects zebrad versions 2.2.0 through 4.3.0 and zebra-rpc versions 1.0.0-beta.45 through 6.0.1. No public exploit code or active exploitation confirmed; patch available in zebrad 4.3.1 and zebra-rpc 6.0.2.
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
Uncontrolled resource consumption in the Volcano webhook server allows any in-cluster pod with low-privilege access to exhaust the webhook process memory by streaming an arbitrarily large HTTP request body, resulting in an OOM kill. All Volcano deployments across the v1.12.x, v1.13.x, and v1.14.x release lines are affected until the respective patch versions. No public exploit or active exploitation has been identified; EPSS sits at 0.02% (7th percentile), consistent with low observed exploitation activity, though the availability impact on cluster admission control elevates operational priority for multi-tenant environments.
Out-of-bounds read in ASUS System Control Interface IOCTL handler allows local authenticated users to trigger denial of service via oversized read operations. A local user with limited privileges can supply a read size exceeding the allocated buffer, causing a system crash (BSOD). No public exploit code or active exploitation has been confirmed at this time.
Authentication bypass in Scoold prior to version 1.67.0 allows high-privileged attackers to inject arbitrary administrator email addresses via the /api/config/set/admins endpoint using a forged Bearer token, establishing persistent administrative access after application restart. The vulnerability exploits insufficient token validation in the configuration API, enabling attackers to escalate privileges reliably by injecting their own email into the admin configuration file, which is loaded on startup.
FlashMQ MQTT broker versions prior to 1.26.1 crashes with a divide-by-zero fault when a client with retained publish permission sends a retained message while both the `set_retained_message_defer_timeout` and `set_retained_message_defer_timeout_spread` settings are configured to non-default values, resulting in full denial of service and disconnection of all active MQTT sessions. Publicly available exploit code exists per SSVC classification, though EPSS sits at 0.11% (30th percentile) and no active exploitation is confirmed via the CISA KEV catalog. The vulnerable configuration requires explicit operator action to trigger, meaningfully narrowing real-world exposure.
Unauthenticated attackers can create file-type pushes through Password Pusher's JSON API endpoints when the application is configured to allow anonymous pushes, bypassing intended authentication requirements for file uploads. Affected versions prior to 1.69.3 and 2.4.2 permit remote POST requests to /p.json and /api/v2/pushes endpoints with file payloads without valid credentials, allowing unauthorized file storage and potential information disclosure. Vendor-released patches versions 1.69.3 and 2.4.2 enforce mandatory authentication for all file-type push creation regardless of anonymous-push configuration.
Authenticated panic-DoS in free5GC v4.2.1's UDR data-repository DELETE handler allows any network attacker holding a valid nudr-dr OAuth2 token to crash the endpoint repeatedly with a single request targeting a non-existent ueId. The nil-interface type assertion fires before any state mutation, producing an HTTP 500 on every trigger while Gin recovery keeps the process alive - making the panic indefinitely repeatable. A full end-to-end PoC is published in GHSA-jqfc-gwj5-3w63; no CISA KEV listing exists and EPSS is 0.06% (18th percentile), consistent with the niche 5G core deployment footprint.
URL injection via unsanitized path parameters in i18next-locize-backend prior to 9.0.2 allows remote attackers to manipulate translation resource URLs by injecting path traversal sequences, query strings, or fragments through user-controlled lng, ns, projectId, or version parameters. When these values are exposed via query parameters, cookies, or request headers through i18next-browser-languagedetector, an attacker can redirect requests to unintended translation resources or trigger SSRF/arbitrary-file-read attacks against internal/file-scheme URLs. No public exploit code has been identified, but the vulnerability is straightforward to exploit given network-accessible backend services.
Nil pointer dereference in free5GC v4.2.1's Policy Control Function (PCF) allows any caller holding a valid npcf-policyauthorization OAuth2 token to trigger a Go runtime panic on every POST to /npcf-policyauthorization/v1/app-sessions, causing HTTP 500 responses that deny app-session creation for that request. The flaw activates only when suppFeat="1" enables traffic-routing feature negotiation and a medComponents entry supplies afAppId without AfRoutReq - a valid input combination the handler passes into provisioningOfTrafficRoutingInfo with routeReq==nil and then immediately dereferences. Publicly available exploit code exists in the GHSA advisory; a vendor patch is confirmed at PCF module v1.4.3 / free5GC v4.2.2. No confirmed active exploitation (CISA KEV absent) and EPSS sits at 0.05%, consistent with the product's niche 5G core deployment footprint.
Wrong reuse of HTTP Negotiate-authenticated connections in curl exposes a high-integrity-impact vulnerability where subsequent HTTP requests may inherit an authentication context they should not, potentially allowing requests to be dispatched under incorrect Negotiate (Kerberos/NTLM/SPNEGO) credentials. Affecting an extraordinarily broad version range - curl 7.10.6 through at least 8.19.0 per EUVD data - this flaw was coordinated and disclosed by curl maintainer Daniel Stenberg via oss-security on 2026-04-29 alongside three related connection-reuse CVEs. No public exploit code has been identified and no active exploitation has been confirmed; a vendor-released patch is available, with downstream fixes confirmed by Red Hat (RHSA-2026:12916) and SUSE.
Concurrent PUT requests to free5GC BSF v4.2.1 deterministically crash the Binding Support Function process via an unsynchronized Go map write, collapsing the entire nbsf-management SBI surface until manual restart. The `ReplaceIndividualSubcription()` handler reads `BsfSelf.Subscriptions` under `RLock()` but writes to the same map without acquiring the write mutex in its create-if-absent branch, causing the Go runtime to emit a non-recoverable `fatal error: concurrent map read and map write` that bypasses Gin's recovery middleware and terminates the process with exit code 2. Publicly available exploit code exists and was validated by the researcher against the official Docker compose lab; the attack is repeatable across restarts, enabling sustained outage for authenticated token holders. EPSS is low (0.04%, 11th percentile), consistent with the OAuth2 token prerequisite limiting opportunistic exploitation.
DNS rebinding exploits a TOCTOU flaw in Postiz v2.16.6-2.21.6 to bypass all SSRF protections added in v2.21.4-v2.21.6, allowing unauthenticated remote attackers to reach internal network services and cloud metadata endpoints. The root defect is architectural: `isSafePublicHttpsUrl()` validates an IP via one DNS resolution, but the subsequent `fetch()` call performs its own independent DNS resolution - an attacker controlling a DNS server can return a legitimate public IP on the first query and swap to an internal address (e.g., 169.254.169.254) on the second. No public exploit has been identified and exploitation is not confirmed by CISA KEV, but the high confidentiality impact reflects realistic cloud-credential theft via IMDSv1-style metadata services.
Unauthorized revision disclosure in Wagtail CMS allows authenticated CMS users lacking page-edit permissions to read historical page revisions through the revision compare view by supplying known or guessed revision primary keys. Affected installations running Wagtail versions below 7.0.7 or between 7.1 and 7.3.2 (exclusive) expose draft and revision content to lower-privileged CMS accounts. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS at 0.03% (8th percentile) and SSVC exploitation status of 'none' together indicate low real-world exploitation activity at time of analysis.
Unauthorized access to private RAG file and knowledge base content in Open WebUI (versions ≤ 0.8.12) is possible because three of five code paths in the `get_sources_from_items` function pass user-supplied collection names directly to the vector store without any authorization check, making access revocation ineffective at the RAG layer. Authenticated users who previously held access to a file or knowledge base - or who learn the predictable collection name format (`file-<uuid>`) - can continue extracting full document content via the chat completion API long after their access was revoked. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, but attack complexity is low and the impact is complete confidentiality loss of targeted private documents.
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to bypass internal IP range restrictions and access internal image endpoints. An attacker can submit a crafted post whose Open Graph image tag points to an internal server; Lemmy will fetch and cache the image server-side, potentially exposing sensitive internal resources. The vulnerability exists because the initial page URL is validated against internal IP ranges, but the extracted og:image URL is not subject to the same restriction, creating a two-stage bypass.
Onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 expose an authorization bypass in the GET /chat/file/{file_id} endpoint that permits authenticated users to download any other user's files by directly accessing file UUIDs. The endpoint enforces authentication but lacks per-file ownership validation, allowing attackers with valid credentials to exfiltrate confidential documents and chat attachments belonging to other users system-wide. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized boolean field manipulation in nova-toggle-5 (versions prior to 1.3.0) allows any user authenticated on the shared Laravel web guard to call the Nova toggle endpoint and flip boolean columns on any model - even without Nova admin access. The endpoint's attribute parameter accepted arbitrary column names, bypassing field-level exposure controls and permitting writes to columns never declared as Toggle fields. No public exploit has been identified (EPSS 0.03%, SSVC exploitation: none), but the integrity impact is rated High because critical boolean flags such as is_admin or is_active on any resource are writable.
Improper permission enforcement in Wagtail's form submission deletion feature allows authenticated CMS users with limited access to delete form submissions belonging to pages outside their authorized scope. Affected versions are pip/wagtail < 7.0.7 and >= 7.1, < 7.3.2. An attacker must already hold a Wagtail admin account - ordinary site visitors cannot exploit this. No public exploit or active exploitation (CISA KEV) has been identified; EPSS stands at 0.03% (8th percentile), consistent with SSVC's 'exploitation: none' assessment.
Open WebUI's POST /api/v1/models/import endpoint allows authenticated users with workspace.models_import permission to overwrite any existing model in the database without ownership validation, silently replacing system prompts, base model routing, and access grants. This enables a low-privilege user to hijack organization-wide models and inject malicious behavior affecting all downstream queries. The vulnerability bypasses access grant restrictions enforced on all other model mutation endpoints by never calling filter_allowed_access_grants.
Improper permission enforcement in Wagtail's page copy feature allows authenticated low-privilege CMS users to exfiltrate and potentially publish page content they are not authorized to access. Affected versions include all Wagtail releases below 7.0.7 and the 7.1-7.3.x range below 7.3.2. While the CVSS confidentiality impact is rated High (C:H), real-world exploitation probability is very low - EPSS sits at 0.02% (7th percentile), SSVC records no exploitation, and the attack requires an existing CMS account, making this a medium-priority internal threat rather than a perimeter risk. No public exploit code has been identified at time of analysis.
Path traversal in SharpCompress `WriteToDirectory()` allows malicious ZIP and TAR archives to create directories outside the intended extraction root via relative (`../../`) and absolute path (`/tmp/`) overrides in the directory-entry fast-path. TAR archives can be further escalated to arbitrary file writes when callers implement `SymbolicLinkHandler` without validating symlink targets, enabling an attacker to write files anywhere on the filesystem subject to process permissions. CVSS 5.9 reflects moderate severity; real-world impact depends on whether the application extracts untrusted archives and implements symlink handling.
Xenstored denial of service in Xen hypervisor (XSA-484) allows a low-privileged guest domain to crash the xenstored daemon by issuing a crafted XS_RESET_WATCHES command that triggers a reachable assertion (CWE-617), aborting the process. Because xenstored is the host-side service that brokers all inter-domain communication via XenStore, its crash disrupts all VMs co-resident on the host, explaining the Changed scope in the CVSS vector. No public exploit is identified at time of analysis and EPSS is 0.01% (2nd percentile), though the low exploitation complexity and high host-availability impact make this a meaningful risk in multi-tenant Xen deployments.
ViewComponent preview routes allow authenticated attackers to invoke inherited helper methods including render_with_template, enabling rendering of internal Rails templates and exposure of secrets, configuration, and debug data not otherwise routable. The vulnerability requires authenticated access (CVSS PR:L) and affects versions 3.0.0 through 4.8.x; it is confirmed by proof-of-concept code in the vendor repository and requires preview routes to be externally exposed.
Improper access control in the CloudStack Backup plugin allows authenticated users in CloudStack 4.21.0.0 through 4.22.0.0 to create new virtual machines using backups belonging to other users, enabling unauthorized data access and VM provisioning. The vulnerability requires valid CloudStack credentials and access to specific backup-related APIs but carries elevated risk in multi-tenant environments. Vendor-released patch available in CloudStack 4.22.0.1.
Improper authorization logic in the CloudStack Backup plugin allows authenticated users to enumerate backups from any account in the environment across versions 4.21.0.0 through 4.22.0.0. An attacker with valid user credentials can exploit this to gain unauthorized visibility into backup metadata and existence across all accounts, though backup contents remain protected. The vulnerability requires the Backup plugin to be enabled and affects multi-tenant CloudStack environments where account isolation is a critical security boundary.
TLS certificate validation is unconditionally disabled in the OpenTelemetry.Exporter.Instana NuGet package (versions <= 1.0.7) whenever the INSTANA_ENDPOINT_PROXY environment variable is set to any valid proxy URL, exposing all outbound telemetry and the Instana API key to network-level man-in-the-middle interception. The Transport.ConfigureBackendClient() method hard-codes this insecure behavior with no mechanism for callers to re-enable validation without upgrading. No public exploit has been identified and EPSS is negligible (0.01%, 0th percentile), but successful exploitation yields silent, persistent credential and observability data theft.
Apache CloudStack fails to properly validate resource allocation limits due to time-of-check time-of-use race conditions and missing validations, allowing authenticated users to exceed configured account and domain resource quotas and trigger denial of service conditions. Authenticated network attackers can exploit this vulnerability without user interaction to exhaust infrastructure resources. Affected versions prior to 4.20.3.0 and 4.22.0.1 require immediate patching.
Stored cross-site scripting in Sky Addons plugin for WordPress (versions up to 3.3.2) allows authenticated attackers with Author-level access to inject arbitrary JavaScript via the REST API that persists in the `sky-custom-scripts` post type and executes on all frontend pages for every site visitor. The vulnerability stems from insufficient input sanitization on the `sky_script_content` meta field combined with lack of output escaping during frontend rendering. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires only Author-level privileges and standard REST API access, making it a practical threat in multi-user WordPress environments.
Stored Cross-Site Scripting (XSS) in the NMR Strava Activities WordPress plugin through version 1.0.14 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the `strava_nmr_connect` shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, compromising session security and enabling account takeover or malware distribution. A vendor patch addressing the vulnerability is available in version 1.0.15.
Stored Cross-Site Scripting in E2Pdf - Export Pdf Tool for WordPress plugin versions up to 1.32.17 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'id' attribute of the e2pdf-download shortcode, which executes when any user views the affected page. The vulnerability stems from insufficient input sanitization and output escaping on shortcode attributes, enabling persistent script injection with moderate confidentiality and integrity impact across site scopes.
Server-Side Request Forgery in FastGPT prior to v4.14.17 allows authenticated users with MCP toolset management permissions to bypass internal network protections by storing private endpoint URLs through the MCP tool create or update API endpoints. The protection gap existed because preview and run endpoints validated URLs against internal address ranges, but the create and update paths did not, meaning a stored URL such as http://localhost:3000/mcp would later be resolved by the backend workflow runner without re-validation. No active exploitation is confirmed (not in CISA KEV); SSVC classifies this as POC-level with partial technical impact and non-automatable exploitation.