Memory-exhaustion denial of service in Meta's Proxygen HTTP library (versions v2017.01.16.00 through v2026.07.20.00) allows remote, unauthenticated attackers to force unbounded server-side buffering by abusing HTTP/2 flow control. Because the core HTTP session layer had no generalized slow-consumer detection, a client that advertises SETTINGS_INITIAL_WINDOW_SIZE of 0 or simply withholds WINDOW_UPDATE frames can stall many concurrent streams while fully-generated response bodies pile up in memory. No public exploit identified at time of analysis, but the technique is well-understood and the CVSS 7.5 availability impact is real against default deployments.
Remote code execution in Microsoft Windows Terminal allows an unauthenticated attacker to run arbitrary code by tricking a user into interacting with malicious content that triggers an integer overflow (CWE-190). The flaw carries a CVSS 7.5 rating driven by high complexity and required user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Microsoft has released a patch through the MSRC update guide.
Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.
SQL injection in ThemeHunk's Advance Product Search - Voice & Ajax Search for WooCommerce plugin (all versions ≤ 1.4.4) lets unauthenticated attackers inject arbitrary SQL through the 's' and 'match' search parameters, enabling extraction of sensitive database contents such as user credentials and order data. The flaw stems from unescaped, unprepared query construction in the plugin's AJAX search backend and is remotely exploitable without authentication or user interaction. Reported by Wordfence; no public exploit identified at time of analysis and not listed in CISA KEV.
Denial of service in the h2o HTTP server (all versions prior to commit 6b5370d) allows remote unauthenticated attackers to crash the server by requesting static files whose on-stack path construction via alloca can reach ~600KB, exceeding musl libc's default 128KB pthread stack and triggering a guard-page segmentation fault. The flaw is a CWE-770 uncontrolled resource allocation issue affecting availability only (CVSS 7.5, A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but exploitation is trivial where h2o is built against musl libc.
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated attackers to crash the process by sending more than 32KB of valid handshake messages over the CRYPTO stream within a single packet number space, tripping a reachable assertion (CWE-617). Affects all builds prior to commit 937d0e9. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the network-reachable, no-privilege nature makes it trivially triggerable once understood.
Uncontrolled memory allocation in Grafana Loki lets remote unauthenticated users issue queries with excessively large limit values, forcing the service to allocate large amounts of memory and potentially exhausting host resources. The impact is denial of service (CVSS 7.5, A:H only) and varies by deployment topology - a single-binary or under-provisioned deployment is far more exposed than a horizontally scaled microservices setup. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the input 'Information Disclosure' tag conflicts with the CVSS impact (C:N/I:N/A:H), which indicates an availability-only issue.
Memory exhaustion in Quicly's QUIC flow control handling allows an unauthenticated remote peer to force disproportionate receive buffer allocation in the H2O HTTP server by sending STREAM frames containing a single byte placed at the maximum permitted stream offset. The library pre-allocates buffers up to the largest received offset to accommodate out-of-order delivery, so a handful of crafted packets can cause the server to allocate memory far exceeding what the transferred data warrants. Under H2O's default stream concurrency settings, this attack multiplies per-connection memory usage by roughly 4x, making memory exhaustion achievable at low bandwidth cost. No public exploit identified at time of analysis; EPSS is 0.25% (16th percentile) and CISA SSVC lists exploitation as 'none', suggesting no observed real-world abuse.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Memory exhaustion denial-of-service affects HTTP/2 server implementations that fail to cap buffered response data under stalled flow-control conditions. A remote unauthenticated attacker opens many simultaneous HTTP/2 streams while advertising SETTINGS_INITIAL_WINDOW_SIZE = 0 or withholding WINDOW_UPDATE frames, forcing the server to accumulate unbounded in-memory response buffers it cannot transmit. Under permissive resource limits this can trigger OOM kills, swap exhaustion, and full system unresponsiveness; under tighter limits, connection and worker pool exhaustion degrades availability for legitimate clients. Reported 2026-07-16 by Okta Red Team and coordinated as CERT VU#885548 covering at least three CVE IDs (CVE-2026-59762, CVE-2026-59173, CVE-2026-44909) across multiple vendor implementations. No public exploit code identified at time of analysis, and CISA KEV listing not confirmed.
Denial of service in HTML::Bare through version 0.04, a Perl XML/HTML parsing module, allows remote unauthenticated attackers to hang the parsing process in an infinite loop by supplying malformed markup. The parserc_parse function fails to advance its attribute-parse cursor on certain malformed attribute forms - such as nameless attributes ("<a ='c'>") or unbalanced quotes ("<a b='''''''c'>") - causing the CPU to spin indefinitely. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 8th percentile), consistent with a resource-exhaustion bug rather than a high-value target.
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprecated TLS 1.0 and TLS 1.1 protocols, whose known cryptographic weaknesses let a suitably positioned attacker intercept and potentially decrypt session traffic. The flaw is an information-disclosure/confidentiality issue reported by HCL; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 3rd percentile). SSVC scores exploitation as none and automatable as no, indicating a real but low-urgency hardening issue rather than an actively targeted vulnerability.
Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop by submitting malformed XML attributes to any application that parses attacker-controlled input with the library. The parserc_parse function fails to advance its cursor on certain malformed attribute forms, causing 100% CPU consumption and unresponsiveness. No public exploit identified at time of analysis, but the trivial reproducer strings published in the oss-security advisory make triggering it straightforward.
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description force the `kiota generate` command to fetch arbitrary remote http(s) URLs and read local absolute or out-of-tree file paths while resolving $ref values. Because Kiota inlined those external schemas into generated clients, an attacker could exfiltrate internal endpoints or leak local file contents (e.g. REMOTE_KIOTA_PROP-style properties) into produced code. No public exploit has been identified at time of analysis; the risk is developer/CI-toolchain oriented and requires a developer to run generation against a malicious or influenced description (CVSS 7.1).
Authentication bypass and control-plane information disclosure in Envoy Gateway (versions >= 1.8.0-rc.0 to < 1.8.1, and all releases < 1.7.4) allows any in-cluster pod that can reach the xDS gRPC server on port 18000 to read sensitive xDS resources without valid credentials. The flaw affects only deployments running in GatewayNamespaceMode, where the JWT StreamInterceptor mishandles State-of-the-World DiscoveryRequests and no UnaryInterceptor guards the Fetch endpoints, exposing TLS private keys (SDS), clusters/endpoints, and routing configuration. No public exploit identified at time of analysis, and it is not listed in CISA KEV; CVSS is 7.4 (High).
Sensitive credential exposure in Frogman (an mwtcmi FreePBX module providing headless PBX control via MCP and an HTTP API) before 1.6.2 stores API tokens in cleartext, so any read of the oc_api_tokens database table yields fully reusable, active tokens at their assigned permission level - up to admin. Because Frogman.class.php authenticated the X-Frogman-Token header by directly comparing the presented value against the stored raw string, a leaked or read database directly hands an attacker working credentials. Rated CVSS 7.4 (high); no public exploit identified at time of analysis, and the issue is fixed in version 1.6.2.
Improper authorization in cert-manager 1.18.0 through 1.19.5 and 1.20.0-1.20.2 lets a namespaced tenant with standard Challenge/Order create rights forge ACME Challenge resources that reference a ClusterIssuer, bypassing DNS01 solver selectors (dnsZones, dnsNames, matchLabels) so the controller uses cluster-wide DNS credentials for attacker-chosen provider settings and names. The primary consequence is disclosure of shared ClusterIssuer DNS credentials - notably acme-dns X-Api-User and X-Api-Key headers - enabling cross-tenant credential theft in multi-tenant clusters. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local code execution in Lenovo Legion Zone and the Lenovo App Store (China-market Windows builds) allows an authenticated local user to run arbitrary code when either application is installed on a non-system partition. The flaw stems from insecure directory/file permissions (CWE-277) that a low-privileged user can abuse to plant or modify executable content later run with higher privilege. No public exploit is identified at time of analysis and it is not listed in CISA KEV; impact is confined to systems where these Chinese-market Lenovo utilities are deployed to a non-default drive.
Stored cross-site scripting in the RPB Chessboard WordPress plugin (all versions through 8.1.2) lets unauthenticated attackers plant persistent JavaScript through comment content that executes in the browser of anyone who later views the affected page. The novel aspect, per Wordfence, is that WordPress's normal save-time kses sanitization is bypassed because the payload uses only kses-allowed tags/attributes (an <a> element with title and href) and the dangerous attribute-breaking markup is assembled entirely at render time by the plugin's own comment_text filter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, no-interaction entry point makes it a practical drive-by injection risk.
Stored cross-site scripting in the Breakdance WordPress page-builder plugin (versions through 2.7.1) lets unauthenticated attackers inject persistent JavaScript through the 'fields' parameter, which then runs in the browser of any user who views the affected page. The flaw carries a CVSS 3.1 score of 7.2, elevated by a scope change (S:C) because the payload executes in visitors' browser sessions rather than the server context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Wordfence discovered and reported it.
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 allows a malicious repository or pull request to place files outside the workspace root on a developer or CI host. The tool trusts the checked-in .kiota/workspace.json and honors attacker-controlled per-client and per-plugin outputPath values during 'kiota client generate' and 'kiota plugin generate' without validating them. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but exploitation is realistic in CI/pull-request workflows since it only requires a developer to run generation against poisoned config.
Path traversal in Manyfold's file-rename functionality (versions 0.96.0 through 0.139.x) lets an authenticated user move or write files outside the configured 3D-model library directory. The flaw stems from app/models/model_file.rb passing a user-controlled filename straight into File.join(model.path, filename) without stripping '..' sequences, giving low-privileged users write/overwrite primitives on the host filesystem. No public exploit identified at time of analysis, but the upstream fix commit and its test cases plainly demonstrate the traversal, and the issue is resolved in 0.140.0.
Code injection in remorses/genql (the @genql/cli TypeScript GraphQL client generator) before 6.3.4 lets an actor who controls the GraphQL schema fed to genql smuggle arbitrary TypeScript/JavaScript into the generated schema.ts file, which then executes when a downstream consumer bundles and imports the client. The flaw stems from GraphQL type/field descriptions containing a `*/` sequence that breaks out of the generated JSDoc comment block. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue was responsibly disclosed (issue #197) and reported by CISA (cisa-cg), with a vendor patch in 6.3.4.
Server-Side Request Forgery and arbitrary local file read in ArcadeDB before 26.6.1 let any authenticated user with SQL command/query access - not just root/administrators - abuse the SQL `IMPORT DATABASE` statement, whose source URL was passed to the importer unchecked. Because it required no administrative privileges, a low-privileged user could force the server to fetch arbitrary HTTP(S) endpoints (including cloud metadata at 169.254.169.254 and internal-only services) and ingest the responses as queryable records, or read local files such as `/etc/passwd` and credential files via `file://` paths. No public exploit identified at time of analysis; the flaw was privately reported and fixed in release 26.6.1.
Local privilege escalation in the Windows Backup Engine affects Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1), where a race condition (CWE-362) lets an already-authenticated low-privileged user win a timing window to elevate to higher privileges. The CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L), reflecting local access and high attack complexity but full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; a vendor patch is available from Microsoft.
Privilege escalation in Zoom Workplace VDI Plugin for Windows (all versions prior to 6.6.14) is achievable by an authenticated local user exploiting a TOCTOU race condition during the product's installation or uninstallation process. The attack targets the narrow window between the installer's security check and its subsequent resource use, allowing a local attacker to substitute a controlled file or symlink and have it processed under elevated installer privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 4th percentile signals very low real-world exploitation probability, though SSVC rates the technical impact as total if the race is won.
Local privilege escalation in certain Zoom Clients for Windows lets an authenticated local user exploit a time-of-check to time-of-use (TOCTOU) race during install/uninstall to gain higher privileges (likely SYSTEM). The flaw was reported by Zoom's own security team and is documented in bulletin ZSB-26012; no public exploit identified at time of analysis and it is not on CISA KEV. The high-complexity race window and local-access requirement temper an otherwise high-impact (C:H/I:H/A:H) issue.
Local privilege escalation to arbitrary code execution affects Lenovo App Store, a software-distribution client shipped exclusively on Lenovo devices in the Chinese market. A local authenticated user who can interact with the application can leverage its excessive privileges (CWE-250) to run arbitrary code at an elevated privilege level, with high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a path traversal weakness to write or load files outside intended directories and run arbitrary code. The flaw was self-reported by Lenovo and carries a CVSS 4.0 base score of 7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality, integrity, and availability of the local system, but exploitation requires existing low-privilege local access plus user interaction.
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are issued without the 'secure' attribute, permitting the browser to transmit them over unencrypted HTTP. A network-positioned attacker able to observe or coerce cleartext traffic can capture session tokens or credentials and impersonate the victim. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC records no known exploitation.
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedded within the application's server responses, allowing a remote unauthenticated attacker to enumerate internal infrastructure for reconnaissance. The issue was reported by HCL and carries a vendor CVSS of 8.2, though it maps to a CWE-200 information exposure with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and CISA SSVC rates exploitation as none and non-automatable.