Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis.
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).
Unauthorized role assignment in MemberGlut WordPress plugin versions below 1.1.5 allows unauthenticated attackers to register accounts with arbitrary roles, including administrator, leading to complete site takeover. Publicly available exploit code exists. CVSS 9.8 indicates critical severity with low complexity and no required privileges.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Remote code execution in vBulletin 5.x and 6.x allows unauthenticated attackers to execute arbitrary PHP code via a crafted request to the ajax/render endpoint. The vulnerability resides in the vB5_Template_Runtime::runMaths() method, where an insufficient regex filter can be bypassed using phpfuck-style encoding to inject and evaluate arbitrary PHP. Publicly available exploit code exists, and no CISA KEV listing was identified at the time of analysis, but the lack of authentication makes unpatched instances critically exposed.
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via the order_by parameter of /customers/search. Under certain MySQL configurations, the flaw can escalate to remote code execution by writing a PHP webshell using INTO OUTFILE. Public exploit code exists, though no active exploitation has been reported to CISA KEV.
Authentication bypass in the 微信二维码登陆 WordPress plugin through 1.3 allows unauthenticated attackers to log in as any existing user, including administrators, by forging webhook requests and intercepting leaked login codes. A publicly available proof-of-concept exists, the attack is fully automatable, and the technical impact is total, making this a critical priority for any site using the plugin.
Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2.3.1 allows remote attackers to log out any site user, including administrators, via an insecure AJAX action. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The high CVSS score from NVD likely overstates impact, as the flaw only disrupts sessions without exposing data.
Remote code execution in FacturaONE for WooCommerce plugin before version 5.37 allows unauthenticated attackers to write arbitrary files to a web-accessible directory and achieve code execution, because a request handler relies on an empty default cryptographic key and lacks authentication. Public exploit code is available.
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed.
Arbitrary file write in NitroShare Desktop 0.3.4 allows unauthenticated attackers on the same network to plant malicious files on a target system by sending a crafted filename with directory traversal sequences in the JSON item header name field. The vulnerability can be exploited to write to the Windows Startup folder, achieving persistent code execution when the user next logs in. Publicly available exploit code exists but it is not listed in CISA KEV.
Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash the server by sending a negative chunk size. Affected versions 0.7.5 through 0.7.6; a public proof-of-concept exploit exists, but no active exploitation (not in CISA KEV) is confirmed. Attackers can trigger the vulnerability without authentication, causing an out-of-bounds read and server crash.
Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the server by sending a specially crafted multipart/form-data request with a partial closing boundary. The flaw triggers an infinite loop in the multipart parser, consuming 100% CPU on all worker processes and requiring a manual restart to recover. A public proof-of-concept is available, though no active exploitation has been confirmed by CISA KEV.
Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by sending a crafted POST request with an empty Content-Disposition header field name. A public proof-of-concept exploit exists. The integer underflow in http_mime_parser.h causes an out-of-bounds memory read and bus fault, resulting in immediate server disruption.
Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying.
Unauthenticated server-side request forgery (SSRF) and arbitrary local file read in Printcart Designer for WooCommerce versions prior to 2.5.3 allows attackers to exfiltrate sensitive configuration files and probe internal network resources. Public exploit code is available, and the patch has been released by the vendor.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
An unauthenticated user registering on a WordPress site with the Custom Fields Account Registration for WooCommerce plugin before version 1.4 can exploit improperly protected custom fields to overwrite the user capabilities meta key, granting themselves the administrator role. This occurs on sites using a non-default database table prefix where a correspondingly named field has been configured. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV.
MainWP Child plugin before 6.1.2 on WordPress allows unauthenticated attackers to hijack any account, including administrators, by sending a crafted site-registration request when password authentication is disabled for the targeted account. A publicly available exploit exists, but no active exploitation has been confirmed by CISA KEV.
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability, a path handling flaw in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, enables a low-privileged application to traverse directories and elevate its permissions. No user interaction is required, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Unauthorized order completion in Clover Payment Gateway for WooCommerce prior to 1.3.6 allows unauthenticated attackers to mark any WooCommerce order as paid by replaying a previously approved payment reference, such as one from their own minimal purchase. Public proof-of-concept code exists, and while not listed in CISA's Known Exploited Vulnerabilities, the vulnerability is automatable with partial technical impact according to SSVC analysis.
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Server-side request forgery (SSRF) in the ip-address JavaScript library allows bypass of security checks on IPv4-mapped and NAT64 IPv6 addresses. Versions 10.1.1 through 10.2.0 misclassify these addresses as global unicast instead of recognizing their embedded IPv4 addresses, enabling potential SSRF attacks against internal networks. No public exploit is identified, but the fix is available in version 10.2.1.
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time.
Stored cross-site scripting (XSS) in the Calendar WordPress plugin prior to version 1.3.18 allows authenticated users with Contributor-level access to inject arbitrary JavaScript into an event field. The script executes in the browsers of any user viewing the calendar page, potentially leading to session hijacking or privilege escalation. A public exploit is available, increasing the immediate risk despite the privilege requirement.
Authorization bypass in Apache ActiveMQ 5.x before 5.19.9 and 6.x before 6.2.8 allows authenticated low-privilege users to publish messages to any queue without proper write ACLs by abusing temporary composite destinations. This enables unauthorized message injection into restricted queues, potentially disrupting message integrity and business logic. No active exploitation or public exploit code has been identified.
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. JFrog has published advisories but patch version details are not specified in the CVE record.
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.
Reflected XSS in the Sina Extension for Elementor WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability exists in an unauthenticated AJAX handler that fails to escape user input before reflecting it. Public exploit code is available, and the vendor has released a patch in version 3.10.2.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Reflected cross-site scripting (XSS) in the WordPress Document Gallery plugin before version 5.1.1 allows unauthenticated attackers to inject malicious scripts via an unsanitized parameter in an AJAX action. A publicly available proof-of-concept exploit exists, increasing the immediate risk for sites running affected versions.
Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.
Use-after-free in SQLite 3.41 allows remote attackers supplying crafted SQL to trigger memory corruption during parsing, leading to denial of service, sensitive information leakage, and potential arbitrary code execution.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Kernel memory corruption in Apple macOS allows a remote, unauthenticated attacker to crash the system or corrupt kernel memory on hosts running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Apple's advisory attributes the flaw to insufficient bounds checking (CWE-120), and although the vendor rates it 9.8 with full confidentiality, integrity, and availability impact, our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - the demonstrated outcome is denial of service through kernel termination or memory corruption, with code execution not proven and the triggering service, protocol, or listener undisclosed. No public exploit has been identified at time of analysis, EPSS is low (0.26%, 18th percentile), and CISA's SSVC records exploitation as 'none'; vendor-released patches are available, so remediation should be prioritized on network-exposed macOS hosts rather than treated as an emergency active-exploitation event.
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a remote user to trigger unexpected system termination (denial of service) or corrupt kernel memory, potentially leading to arbitrary code execution in kernel context. Apple addressed the flaw with improved memory handling and credited its own security team. There is no public exploit identified at time of analysis and EPSS probability is low (0.25%), but the CVSS 9.8 rating and CISA SSVC 'total' technical-impact assessment mark it as a high-severity kernel bug.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected application termination or heap corruption via unspecified vectors. Given a CVSS score of 9.8, successful exploitation could lead to full system compromise. Patches are available from Apple in multiple OS updates, and no public exploit or active exploitation has been identified.
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sources: CVE description, CVSS, EPSS, CPE, tags, references, ENISA data. The output must be plain text paragraphs, not arrays/objects. Let's analyze the input: - CVE-2026-64774 - Description: "An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption." - CVSS Score: 9.8, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-190 (Integer Overflow) - EPSS: 0.24%, percentile 16% (low) - Patch: Available from vendor (confirmed by description listing fixed versions) - Reported by: apple - CPE: multiple Apple products: iOS and iPadOS, macOS, tvOS, visionOS - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Integer Overflow (note "Buffer Overflow" tag but it's integer overflow leading to heap corruption, maybe buffer overflow is a result) - ENISA EUVD: affected versions listed: macOS 0 <26.6, macOS 0 <15.7.8, iOS and iPadOS 0 <26.6, macOS 0 <14.8.8, visionOS 0 <26.6, tvOS 0 <26.6. It's weird: "macOS 0 <26.6" maybe means all macOS before 26.6? But they also mention specific Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6. So the affected versions are those prior to these specific fixed versions? - References: many Apple support URLs (128066 to 128072), likely each for a product. Given the description, the integer overflow exists in some component (maybe kernel, a library) across Apple operating systems. It can be triggered remotely by an attacker, leading to unexpected application termination (DoS) or heap corruption (potentially code execution). CVSS says complete confidentiality, integrity, availability impact, but EPSS is low, KEV not mentioned. No POC mentioned. Tags include "Buffer Overflow" which might
Kernel memory corruption vulnerability in Apple macOS allows a remote unauthenticated attacker to cause unexpected system termination or potentially execute arbitrary code with kernel privileges. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Although EPSS indicates low exploitation likelihood and no active exploitation or public exploit is reported, the critical CVSS score and network attack vector make patching a priority.
Remote exploitation of a buffer overflow in the macOS kernel allows unauthenticated attackers to corrupt kernel memory or unexpectedly terminate the system, potentially leading to
Kernel memory-handling faults in Apple macOS can let a remote attacker cause unexpected system termination or corrupt kernel memory on unpatched systems - macOS Tahoe before 26.6, Sonoma before 14.8.8, and Sequoia before 15.7.8. Apple addressed the flaw with improved memory handling in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, so fully updated builds are remediated; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the EPSS score remains low at 0.24% (15th percentile). Apple's own wording that 'a remote user' may trigger the issue, combined with the published CVSS vector (PR:N) versus our assessed vector (PR:L, AC:H), leaves the authentication prerequisite ambiguous, but the realistically demonstrated outcome is denial of service via kernel panic, with memory-corruption-driven code execution or data disclosure possible in principle but unconfirmed.
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation
Unexpected system termination and kernel memory corruption in macOS allows remote attackers to fully compromise a machine. The race condition (CWE-362) is triggered without authentication or user interaction, and Apple has released fixes in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is confirmed, and EPSS indicates a low probability of real-world attacks.
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, watchOS, and visionOS, when processing a malicious accessory. The vulnerability stems from a buffer overflow (CWE-120) addressed with improved bounds checking in the latest updates. No active exploitation or public proof-of-concept is reported; EPSS score is low (0.18%), though the provided CVSS vector implies a critical network-based attack that does not align with the accessory requirement.
Buffer overflow in macOS versions prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to escape its