Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative privileges to Quantum Security Management and Multi-Domain Security Management servers (CWE-287, CVSS 4.0 9.3). Once authenticated, the attacker can rewrite security policies and configurations across managed gateways. It is confirmed actively exploited (CISA KEV) with publicly available exploit code, though Check Point reports only a very small number of affected customers, and the EPSS score is a modest 1.07% (61st percentile), consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the Product Addons and Product Options With Custom Fields WordPress plugin (all versions before 1.6.15) lets an unauthenticated attacker abuse an unrestricted file-upload endpoint to plant a malicious SVG that is stored and served inline; its embedded script then runs in the browser session of any user who opens it, including administrators, enabling account takeover. Publicly available exploit code exists and WPScan disclosed the issue, but no public exploit has been identified as used in active attacks. The CVSS 8.8 rating reflects the high impact of hijacking a privileged WordPress session despite the requirement that a victim open the crafted file.
Broken object-level authorization in Onlook through version 0.2.32 allows authenticated attackers to read, modify, and delete other users' projects, members, and chat conversations by passing arbitrary projectId or conversationId UUIDs to tRPC procedures such as project.get, member.remove, and chat.conversation.delete. Because the affected procedures trusted client-supplied identifiers without verifying the caller's ownership, any logged-in user could reach cross-tenant data. Publicly available exploit material exists (VulnCheck advisory and a GitHub issue), and the vendor has shipped a fix in commit 423e2e9, though there is no public exploit identified as being used in active attacks.
Authentication bypass in Eclipse Jetty's HTTP Digest authentication implementation allows an unauthenticated attacker who knows a target username to authenticate as any user whose password contains non-Latin-1 characters (CJK, Cyrillic, Arabic, Greek, emoji, etc.) by substituting those characters with literal '?' characters. The root defect is in DigestAuthentication.java, which uses ISO-8859-1 encoding at three points when computing H(A1), H(A2), and the final MD5 response hash - silently collapsing all code points above U+00FF to 0x3F, making collision credentials cryptographically indistinguishable from the original. A publicly available proof-of-concept demonstrates hash collision across Chinese, Korean, Cyrillic, and Greek passwords; no active exploitation has been confirmed by CISA KEV at time of analysis.
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malicious serialized PHP object through a booking-registration field on sites running No-User-Account Booking Mode. When the stored booking is later loaded, the object is deserialized without a class allow-list, triggering a gadget chain that reaches an unparameterised SQL query and exposes sensitive data such as user password hashes and secret keys. Publicly available exploit code exists (WPScan) and SSVC rates exploitation as PoC and automatable, though it is not listed in CISA KEV.
Certificate revocation bypass in the Netty netty-handler-ssl-ocsp module (versions before 4.1.136.Final, and 4.2.0.Final through 4.2.15.Final) lets an on-path attacker replay a stale, expired-but-GOOD OCSP response to make OcspServerCertificateValidator accept a certificate that has since been revoked. A missing return statement after the freshness check causes execution to fall through and still fire a VALID OcspValidationEvent even after flagging the response as out-of-date. Publicly available exploit code exists (a PoC unit test is embedded in the GHSA advisory); the issue is not listed in CISA KEV and no EPSS score was provided.
TLS certificate-revocation bypass in Netty's OcspServerCertificateValidator (netty-handler-ssl-ocsp, versions <4.1.136.Final and 4.2.0.Final-4.2.16.Final) allows a malicious server presenting a revoked certificate to receive sensitive client data during a race window. The validator forwards the SslHandshakeCompletionEvent to downstream handlers before the asynchronous OCSP check finishes, so client applications treat the connection as trusted and may transmit or process application data before the revoked channel is closed. Publicly available exploit code exists (PoC in the GHSA advisory); no public active exploitation has been reported and the vulnerability is not in CISA KEV.
CRLF injection in Netty's HttpPostRequestEncoder allows authenticated network attackers to inject arbitrary MIME headers into multipart HTTP request bodies by embedding CR/LF characters in user-controlled filenames. Affected are all Netty 4.1.x releases before 4.1.136.Final and 4.2.x releases before 4.2.16.Final that use the codec-http multipart encoder. Publicly available exploit code has been verified against 4.2.12.Final; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the PoC lowers the bar considerably for Content-Type spoofing, stored XSS, and multipart boundary confusion attacks.
Header injection in Netty's StompSubframeEncoder allows low-privileged network attackers to embed arbitrary STOMP headers into CONNECT and CONNECTED frames by supplying newline characters in header values. Affecting netty-codec-stomp prior to 4.1.136.Final and 4.2.x before 4.2.16.Final, the encoder deliberately skips the escape() function for CONNECT frames per STOMP 1.2 backward-compatibility requirements but neglects to reject raw newline characters, conflating 'no escaping' with 'no validation.' A fully functional proof-of-concept is publicly available and confirmed against Netty 4.2.12.Final; no public exploitation in the wild (CISA KEV) has been confirmed at time of analysis.
Dompdf's chroot filesystem restriction is bypassed by embedding SVG content as a base64-encoded data-URI, enabling any external user who controls HTML input to read arbitrary image files from the server filesystem and exfiltrate them via the rendered PDF output. The attack exploits a two-stage validation gap: dompdf's data:// protocol handler applies no chroot rules, and the downstream php-svg-lib dependency - invoked with allowExternalReferences forced to true - calls file_get_contents() with zero chroot awareness. A complete working proof-of-concept is published in the GitHub security advisory (GHSA-cx96-42px-69fm); no public exploit identified beyond the advisory PoC, and no active exploitation confirmed at time of analysis.
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Unauthenticated directory enumeration in InvokeAI before 6.13.7 exposes arbitrary server filesystem paths via the GET /api/v2/models/scan_folder endpoint, which accepts attacker-controlled scan_path parameters without requiring authentication. Beyond path traversal and file existence probing, the vendor's own release notes confirm a closely related attack path capable of recovering full contents of invokeai.yaml and api_keys.yaml - files that may contain API tokens for HuggingFace, Civitai, Alibaba, and OpenAI services. A publicly available exploit exists (GitHub issue #9365); no active exploitation is confirmed in CISA KEV.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Filesystem existence oracle in Dompdf allows attackers who can supply arbitrary HTML content for PDF rendering to enumerate files and directories on the backend server. By embedding a data-URI encoded SVG containing an `<image>` element with a `file://` URI reference, an attacker exploits differential rendering behavior - files and directories that exist cause a different visual output than paths that do not exist - creating a binary oracle for filesystem probing. A publicly available proof-of-concept is included in the GitHub Security Advisory GHSA-j8qw-6jw8-r297; no KEV listing or confirmed active exploitation has been reported at time of analysis.
Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.
Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.
Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
SQL injection in Xpoda No Code Platform (versions 4.3.1.0 through build 20260722) allows remote unauthenticated attackers to inject arbitrary SQL commands, per the CVSS PR:N/UI:N vector. Full read/write access to the backing database is achievable, threatening data confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; notably, the vendor was contacted by TR-CERT but did not respond, so no fixed version exists.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-50329 from multiple intelligence sources. The output must be a single JSON object with specific fields. We must use all data provided: description, CVSS, EPSS, tags, SSVC, CPE, references, etc. And follow precision rules. Let's review the input data: - CVE ID: CVE-2025-50329 - Description: "An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe." - CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-693 (Protection Mechanism Failure) - EPSS: 0.36% (percentile 28%) - low - Tags: RCE, N A (maybe "N/A"?) - SSVC: Exploitation: none, Automatable: yes, Technical Impact: total - CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* - this is weird, maybe placeholder. - Affected versions EUVD: ["n/a n/a"] - References: - https://www.powerarchiver.com/ (vendor site) - https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md (a GitHub reference, likely a PoC/advisory) - https://github.com/OV-0-VO/Public-references/commit/20437207859288ad1502fed2caebc38be27a3450 (commit diff) - Source code evidence from GitHub: shows a diff in CVE-2025-50329.md. The diff shows a fix: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - the original line had a trailing space? Actually the diff shows a line change on line 15+4: the original had a space at end? It's unclear. But the important part is the description in the diff context: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - suggests the vulnerability is related to Mark-of-the-Web handling during extraction, leading to code execution? The commit just removed a trailing space, but the file content itself might have more info. We can view the GitHub file to see the full description. But we only have this diff snippet. We'll infer from the CVE description and tags. Additional info: The CVE description mentions "escalate privileges and execute arbitrary code via the powerarc.exe". No explicit mention of authentication, but CVSS says PR:N so unauthenticated. No mention of KEV, so no active exploitation. No POC tag? Tags include "RCE, N A" - maybe "N A" means "not applicable"? Possibly "no auth"? Not sure. The GitHub repo "Public-references" could contain a proof-of-concept or at least a reference. Given that there's a GitHub reference, likely a public PoC exists. The SSVC says exploitation=none, but automatable=yes, which could mean it's easy to automate. EPSS is 0.36% (low) suggests low likelihood of exploitation in the wild right now. However, the CVSS is critical 9.8, so there is a tension: high CVSS, low EPSS. No KEV listing. We need to construct the JSON. Let's break down each field: product_name: "Power Archiver" (from ConeXware, Inc Power Archiver version 22.00.11 and before). So simply "Power Archiver". summary: Must be original synthesis, not copying description. Start with impact verb and product. So: "Remote code execution in Power Archiver 22.00.11 and earlier allows unauthenticated attackers to escalate privileges and execute arbitrary code via the powerarc.exe executable." Mention EPSS low, no KEV, PoC possibly available? The references suggest a GitHub advisory with details, so likely PoC. Should mention "publicly available exploit code exists" if we infer that. But precision rule: "If POC=YES but no KEV: 'publicly available exploit code exists'". We don't have explicit POC=YES, but the GitHub reference likely is a PoC repo. The commit message doesn't reveal exploit code, just a diff of the markdown file. But the file itself might contain PoC. Since it's from a repository named "Public-references" and the CVE ID is in the title, it's reasonable that the public reference includes exploit details. However, we must be careful: we only have the diff snippet, which just shows a change to the markdown file. The full file might describe the vulnerability and maybe a PoC. But we can't be certain there's a functional exploit. The SSVC says "Exploitation: none", meaning no evidence of exploitation. So I'll assume no active exploitation, but there might be a public technical write-up with possibly PoC details. The precision rule for "publicly available exploit code exists" would be if POC=YES. The input doesn't explicitly say POC=YES. I'll instead say "A technical write-up is publicly available; no exploit code has been confirmed" or something. But the instruction says: "If POC=YES but no KEV: 'publicly available exploit code exists'". Since POC flag isn't given, I'll use "no public exploit identified at time of analysis" as per rule: "If neither: 'no public exploit identified at time of analysis'". That would be conservative. However, the GitHub reference might be a PoC; the file name "CVE-2025-50329.md" could contain steps to reproduce. But the diff only shows a line about Mark-of-the-Web extraction. It's not a functional exploit. So I'll stick with "no public exploit identified at time of analysis". But we can note the existence of a technical write-up. The summary can mention "A proof-of-concept may be available" but the precision rule forbids speculation. I'll avoid claiming exploit code exists. So summary: "Remote code execution in Power Archiver 22.00.11 and earlier allows remote attackers to escalate privileges and execute arbitrary code. The flaw is reachable over the network without authentication. EPSS predicts low exploitation probability, but the vulnerability is easily automatable and has total technical impact." I'll incorporate that. technical_context: Underlying technology: Power Archiver is a file compression utility. The vulnerability likely stems from improper handling of Mark-of-the-Web when extracting archive files, leading to a protection mechanism failure (CWE-693) that allows arbitrary code execution. The CPE string is cpe:2.3:a:n/a:n/a, which seems generic, so we'll note that specific product CPE is missing but the affected product is Power Archiver versions up to 22.00.11. The exact root cause: When extracting files from archives that bear Mark-of-the-Web, PowerArchiver fails to apply proper security restrictions, allowing unsigned code to execute with elevated privileges. The attack vector is through the powerarc.exe executable. Since it's a remote attack (AV:N), the method likely involves sending a malicious archive to a user or a server that processes archives with PowerArchiver, leading to code execution. So educational: Mark-of-the-Web is a Windows mechanism that flags files downloaded from the internet; bypassing it can lead to arbitrary code execution. risk_assessment: Use all signals. CVSS 9.8: network, low complexity, no privileges, no user interaction, scope unchanged, high impact. EPSS 0.36% (28th percentile) suggests low likelihood of exploitation in the wild currently. No KEV listing, so not actively exploited. SSVC: exploitation none, automatable yes, technical impact total. The low EPSS despite high CVSS indicates that while theoretically critical, real-world exploitation is not widespread, perhaps due to limited deployment footprint or other factors. The SSVC automatable=yes with exploitation=none suggests that it could be exploited automatically if motivated attackers target it. The missing CPE data (n/a) indicates no precise product matching, which may affect vulnerability scanners' ability to detect it. POC status unknown. The risk assessment should contrast CVSS with EPSS and mention that it's a critical-severity but not actively exploited, so prioritize based on asset exposure. I'll state that the vulnerability is severe but currently low-risk due to no known exploitation; organizations should still patch. affected_products: Write paragraph listing product, version, and advisory. From description: "ConeXware, Inc Power Archiver v.22.00.11 and before". So version 22.00.11 and earlier. The CVE references include vendor site powerarchiver.com and a GitHub advisory. I'll link to the GitHub advisory as the reference. So: "Power Archiver by ConeXware, Inc, version 22.00.11 and all prior versions are affected. The vendor advisory or confirmation is available at the GitHub reference: https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md. The CPE identifier is reportedly cpe:2.3:a:n/a:n/a, which does not precisely identify the product, but the vendor's website is https://www.powerarchiver.com." That should work. remediation: Start with primary fix: upgrade to a version later than 22.00.11, but the specific fixed version is not provided in the data. I'll check references: no mention of a patch version. The vendor site may have updates, but not given. So I'll state "Vendor-released patch: exact fix version not confirmed in the advisory; update to the latest version of Power Archiver beyond 22.00.11 as provided by ConeXware." If no patch, suggest workarounds: Disable automatic extraction of archives from the internet, ensure Mark-of-the-Web protections are enforced, or avoid opening untrusted archives. Since the vulnerability involves Mark-of-the-Web bypass, ensuring Windows security settings are enabled and not using PowerArchiver for untrusted archives could mitigate. Actionable: "Until a patched version is applied, users should avoid extracting archives from untrusted sources with PowerArchiver, and ensure that the 'Unblock' option is not used for files flagged with Mark-of-the-Web." Or use alternative extraction tools. I'll write: "Upgrade to the latest version of Power Archiver (beyond 22.00.11) as soon as a fix is available. In the interim, disable automatic extraction when downloading archives, avoid opening archives from untrusted sources with PowerArchiver, and consider using Windows built-in extraction tools that enforce Mark-of-the-Web properly. Monitor the vendor's website for an official advisory." I can cite the GitHub advisory as a reference for details. But the GitHub reference is not an official advisory, it's a public reference. The vendor website powerarchiver.com is the official source. I'll say: "No official patch version specified; refer to the vendor's website (https://www.powerarchiver.com) for updated versions." I'll note that the GitHub reference contains technical details. So remediation paragraph: "Upgrade Power Archiver to a patched version beyond 22.00.11 once released by ConeXware. As no fixed version number is confirmed in the vulnerability disclosure, consult the vendor's website for the latest update. For immediate mitigation, cease using Power Archiver to extract files from untrusted archives, particularly those bearing the Mark-of-the-Web, and rely on Windows' built-in extraction tools or other archivers that enforce security markings. Alternatively, block PowerArchiver's network access if feasible, but note this may impair legitimate functionality." exploit_scenario: "An attacker crafts a malicious archive file containing executable content and sends it to a victim, perhaps via email or a download link. When the victim extracts the archive using a vulnerable version of PowerArchiver, the Mark-of-the-Web is ignored, allowing the executable to run with elevated privileges, leading to code execution and system compromise." That's a realistic scenario. No PoC confirmed, but the description implies. exploitation_conditions: The CVE description says "via the powerarc.exe". The diff snippet mentions "extracting files from an archive that bears Mark-of-the-Web". So the condition is: user must extract a specially crafted archive using PowerArchiver on a Windows system where Mark-of-the-Web is present. No authentication required. So specific conditions: "Victim must extract a malicious archive file using Power Archiver 22.00.11 or earlier on a Windows system where the archive carries the Mark-of-the-Web. No authentication or special configuration is required." The limiting factor: requires user interaction (UI:N, but actually the user must open the archive). Wait, CVSS says UI:N, which means no user interaction is required. That seems contradictory to the extraction process. Possibly the attack can be triggered automatically when PowerArchiver processes an archive without user interaction, e.g., as a service? The description just says "via the powerarc.exe" — maybe it's a network-accessible service
Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8.
Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an unvalidated teamId, enabling exfiltration of sensitive booking data including organizer/attend
CRLF injection in Netty's HAProxy codec enables PROXY protocol header injection and client IP spoofing when AF_UNIX socket addresses are used with the V1 text protocol. The `HAProxyMessageEncoder.encodeV1()` method writes source and destination addresses into the CRLF-terminated header without sanitization, while `HAProxyMessage.checkAddress()` enforces only a length limit for AF_UNIX addresses - unlike IPv4/IPv6 paths whose format validators incidentally block CRLF. A fully functional, author-verified proof-of-concept was confirmed on Netty 4.2.12.Final; no public exploit identified at time of analysis maps to CISA KEV, but the PoC lowers the bar for exploitation in applications that forward attacker-influenced data into AF_UNIX address fields. Vendor-released patches are available as 4.1.136.Final and 4.2.16.Final.
Authenticated arbitrary file upload in the Page Builder CK extension for Joomla (vendor joomlack.fr) allows a low-privileged authenticated user to upload a malicious file and achieve remote code execution on the host. The flaw (CWE-434) carries a CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus subsequent-system impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route author to attach unauthorized Traefik Middleware objects from foreign namespaces by exploiting incorrect namespace resolution in HTTPRoute extensionRef handling. An attacker holding an existing ReferenceGrant for a cross-namespace Service can leverage the flaw to inject trusted reverse-proxy identity headers into downstream requests - without a separate ReferenceGrant authorizing the Middleware - potentially bypassing authorization controls in backend services that trust those headers. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released fix is version 3.7.7.
Stored cross-site scripting in Froiden TableTrack through version 1.3.10 enables unauthenticated attackers to plant persistent JavaScript payloads via the customer order notes field, which execute in the admin's browser session when order details are reviewed. The attack vector is entirely unauthenticated - any visitor can submit an order containing a crafted payload - while the impact lands on the privileged admin context, enabling session token theft or unauthorized administrative actions. A publicly available proof-of-concept exploit exists; no CISA KEV listing has been confirmed at time of analysis.
Authorization bypass in Traefik's IngressRouteTCP handler (versions 3.6.0-3.6.22 and 3.7.0-3.7.6) allows a low-privileged Kubernetes user to reference file-provider TCPServersTransport configurations across namespace boundaries that the crossProviderNamespaces allowlist should block. The allowlist was enforced for HTTP serversTransport references but silently omitted from the equivalent TCP code path, creating an inconsistent and exploitable access boundary. By crafting an IngressRouteTCP resource with serversTransport: foo@file, an attacker causes Traefik to apply privileged backend settings - including mTLS client certificates, SPIFFE workload identities, or PROXY-protocol configuration - belonging to namespaces they are not authorized to access. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available in 3.6.23 and 3.7.7.
Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remote users to generate fully-approved appointments for priced services without completing any payment. The plugin fails to validate booking status when the chosen payment method falls outside its recognized gateway list, effectively treating unverified payment submissions as completed transactions. A public proof-of-concept is available (reported by WPScan), and SSVC assessment confirms the flaw is automatable with partial technical impact, though EPSS remains low at 0.14%, suggesting exploitation is opportunistic rather than widespread.
Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a high-severity but not-yet-weaponized issue.
Remote code execution in Fujitsu openFT managed file transfer software (Linux and Oracle Solaris variants) before version 12.1D00 lets remote attackers run arbitrary code without authentication (pre-auth RCE) over the network. The flaw is a CWE-94 code injection carrying a CVSS 4.0 base score of 9.3, and the CVSS vector confirms it needs no privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-auth, network-reachable nature makes it a high-priority patch target.
DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.
Persistent authentication bypass in Question2Answer through 1.8.8 lets an attacker holding a stolen 'Remember me' (qa_session) cookie keep authenticated access to an account even after its password is reset via the forgot-password flow. The reset handler qa_finish_reset_user() fails to clear the user's sessioncode field, so previously issued persistent cookies remain valid - defeating the primary account-recovery defense used after a compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is an upstream GitHub pull request rather than a tagged release.
Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible.
Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling unauthenticated remote attackers to view restricted or unpublished articles and modules. The vulnerability stems from improper authorization enforcement when ignore
Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.
OS command injection in the SMASH (Systems Management Architecture for Server Hardware) service of Supermicro X14DBG-DAP and X14DBI platforms lets an authenticated attacker inject operating-system commands through SMASH's input handling on the Baseboard Management Controller (BMC). Successful exploitation yields arbitrary code execution on the BMC, enabling data-integrity tampering or a denial-of-service of the management controller. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.
Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.
Remote code execution in Franco Corbelli ZPAQFRANZ v.61.3 and earlier allows an attacker to bypass the Mark-of-the-Web (MotW) protection mechanism, potentially leading to arbitrary code execution with the user's privileges. The vulnerability requires user interaction, such as extracting a malicious ZPAQ archive, and no credentials are needed. Exploitation has not been confirmed in the wild, and EPSS estimates a low 0.35% probability, though public proof-of-concept details may exist.
Remote code execution in ZipGenius 6.3.2.3116 and earlier allows attackers to trick users into opening malicious ZIP files, leading to arbitrary code execution with user privileges. No active exploitation or CISA KEV listing exists; EPSS indicates low exploitation probability, but the CVSS base score of 8.8 reflects potential total system compromise.
Remote code execution in OneCommander v3.96.0.0 allows attackers to execute arbitrary code via the main executable component when a user interacts with malicious content. The vulnerability (CWE-693) has a high CVSS score but low EPSS exploitation probability and no known active exploitation. A public GitHub reference exists, suggesting disclosure of technical details, though exploit availability is unconfirmed.
Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.