License setting overwrite in ProfileGrid WordPress plugin versions before 5.9.9.7 allows authenticated users with Subscriber-level access or higher to overwrite premium license settings due to a missing capability check. Publicly available exploit code exists but active exploitation has not been confirmed. The flaw stems from relying solely on a nonce exposed to any logged‑in user, bypassing proper authorization.
Heap-buffer-overflow READ in ONNX's Gemm version converter adapter (gemm_7_6.h:41) allows an attacker who can supply a crafted model file to trigger a 16-byte out-of-bounds read when convert_version() downgrades an opset-7 Gemm node whose input tensor B has fewer than 2 dimensions. The vulnerability affects onnx pip package versions 1.3.0 through 1.21.0 and any pipeline that calls onnx.version_converter.convert_version() on untrusted model files. On Release builds the OOB read is silent and the leaked heap bytes propagate into the converted model's output shape metadata, enabling information disclosure; on instrumented builds ASan confirms the 16-byte overread 0 bytes past a 48-byte allocation. No public exploitation confirmed at time of analysis (EPSS 0.17%), though a functional 186-byte PoC is publicly available in the advisory.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.