DOMPurify before 3.4.12 fails to invoke the afterSanitizeElements hook for custom elements permitted via CUSTOM_ELEMENT_HANDLING.tagNameCheck, enabling attackers to retain
Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. This results in privilege escalation to perform restricted operations, though the EPSS exploitation probability is low (0.15%) and no active
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
Information disclosure through SQL injection in Ninja Forms for WordPress versions 3.14.9 and earlier enables authenticated administrators to extract sensitive database data. The vulnerability originates from unsanitized keys in the 'settings' object when importing form files, allowing SQL payload injection via two distinct sinks. No active exploitation is confirmed, and EPSS indicates low exploitation probability.
Information disclosure in the Keycloak Admin REST API allows a delegated administrator with view-only permissions to retrieve the resolved client secret from a secure vault instead of the vault placeholder, exposing sensitive credentials. Affected Red Hat builds include Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP expansion pack. No active exploitation or public exploit is known; EPSS probability is low (0.21%).
Authentication bypass in OpenStack Zaqar through version 22.0.0 allows network-reachable attackers without credentials to circumvent access controls by supplying a crafted EXTRA-SPEC HTTP header paired with a known queue UUID. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning the service fails to enforce credential validation on certain request paths when this header is present. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-accessible nature of Zaqar's REST API makes this a meaningful risk for deployments where queue UUIDs may be discoverable through logs or enumeration.
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
Denial of service in Zephyr RTOS versions before 4.5.0 occurs when mounting a crafted ext2 filesystem with zero values in superblock fields s_blocks_per_group or s_inodes_per_group. An attacker with physical access via removable media can trigger a division-by-zero fault on ARM Cortex-M targets, causing a system crash. No other impact beyond availability; no active exploitation or public exploit is known.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.
Path traversal in Cloudreve's WOPI PUT_RELATIVE handler permits authenticated attackers with a WOPI access token to write files to arbitrary locations within the same user account, bypassing the token's single-file scope. A crafted X-WOPI-SuggestedTarget header with directory traversal sequences (e.g., a/../../evil.docx) resolves outside the source
Information disclosure in Cloudreve allows any logged-in user to enumerate and harvest email addresses of inactive and banned accounts via the user search API. The `SearchActive` method in v4 and v3 omits the required status filter, exposing basic profile metadata to authenticated attackers. No account credentials are compromised, but the leaked PII enables user enumeration across the platform.
Metadata leakage in Cloudreve single-file shares allows an authenticated recipient to observe file activity (rename, create, delete) of unshared siblings in the owner's parent folder via the event stream endpoint, exposing file names and operation types but not file contents.
Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL pointer dereference in the LE Long Term Key Request event handler. Exploitation requires the host to be built with assertions disabled and a bogus or misbehaving BLE controller. No active exploitation or public exploit code has been identified; the vendor rates severity as low.
Denial of service in Apache Neethi versions before 3.2.3 allows remote attackers to exhaust resources by manually retrieving an oversized remote policy via the API. The vulnerability is unauthenticated and network exploitable, but no active exploitation has been reported. A patch is available in version 3.2.3, which enforces a maximum size on remote policy references.
Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malicious or compromised Bluetooth controller to execute arbitrary code on the host by sending an oversized HCI event. Exploitation requires either a misconfigured event pool size or control of the controller on the HCI link, not over-the-air Bluetooth access. No active exploitation or public exploit code is known, and the real-world risk is low despite a CVSS 7.5 rating.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.