Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed.
Arbitrary file write in NitroShare Desktop 0.3.4 allows unauthenticated attackers on the same network to plant malicious files on a target system by sending a crafted filename with directory traversal sequences in the JSON item header name field. The vulnerability can be exploited to write to the Windows Startup folder, achieving persistent code execution when the user next logs in. Publicly available exploit code exists but it is not listed in CISA KEV.
Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash the server by sending a negative chunk size. Affected versions 0.7.5 through 0.7.6; a public proof-of-concept exploit exists, but no active exploitation (not in CISA KEV) is confirmed. Attackers can trigger the vulnerability without authentication, causing an out-of-bounds read and server crash.
Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the server by sending a specially crafted multipart/form-data request with a partial closing boundary. The flaw triggers an infinite loop in the multipart parser, consuming 100% CPU on all worker processes and requiring a manual restart to recover. A public proof-of-concept is available, though no active exploitation has been confirmed by CISA KEV.
Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by sending a crafted POST request with an empty Content-Disposition header field name. A public proof-of-concept exploit exists. The integer underflow in http_mime_parser.h causes an out-of-bounds memory read and bus fault, resulting in immediate server disruption.
Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying.
Unauthenticated server-side request forgery (SSRF) and arbitrary local file read in Printcart Designer for WooCommerce versions prior to 2.5.3 allows attackers to exfiltrate sensitive configuration files and probe internal network resources. Public exploit code is available, and the patch has been released by the vendor.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
An unauthenticated user registering on a WordPress site with the Custom Fields Account Registration for WooCommerce plugin before version 1.4 can exploit improperly protected custom fields to overwrite the user capabilities meta key, granting themselves the administrator role. This occurs on sites using a non-default database table prefix where a correspondingly named field has been configured. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV.
MainWP Child plugin before 6.1.2 on WordPress allows unauthenticated attackers to hijack any account, including administrators, by sending a crafted site-registration request when password authentication is disabled for the targeted account. A publicly available exploit exists, but no active exploitation has been confirmed by CISA KEV.
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability, a path handling flaw in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, enables a low-privileged application to traverse directories and elevate its permissions. No user interaction is required, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Unauthorized order completion in Clover Payment Gateway for WooCommerce prior to 1.3.6 allows unauthenticated attackers to mark any WooCommerce order as paid by replaying a previously approved payment reference, such as one from their own minimal purchase. Public proof-of-concept code exists, and while not listed in CISA's Known Exploited Vulnerabilities, the vulnerability is automatable with partial technical impact according to SSVC analysis.
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
An authenticated SQL injection in an API component of Arista's VeloCloud Orchestrator On-Prem allows a user holding valid credentials to manipulate backend queries, exposing data beyond their intended privileges and causing the orchestrator to initiate unintended outbound network connections. Only on-prem installations on the 5.2.0, 6.1.0 and 6.4.0 branches before 5.2.3.14, 6.1.3.4 and 6.4.2.4 are affected; exploitation requires a working authenticated session (CVSS vector PR:L), so anonymous attacks are not possible, and exposure is further narrowed because the orchestrator management plane is normally reachable only from admin or management networks. EPSS is 2.83% (85th percentile) with no public exploit code and no active exploitation reported, and while the vendor's CVSS 4.0 base score is 8.5, our independent assessment treats this as a moderate-priority rather than top-priority issue given the authentication prerequisite and the on-prem-only, restricted-reachability attack surface.
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.
Use-after-free in SQLite 3.41's JSON parser allows remote code execution. A remote attacker can deliver a crafted JSON payload; if a user or application processes it with SQLite, the vulnerability triggers memory corruption, potentially enabling full system compromise. A proof-of-concept advisory is publicly available, though no active exploitation has been confirmed.
An authentication-handling weakness in JFrog Artifactory's internal request processing lets an attacker who already holds a low-privileged account elevate to a higher access level, potentially reaching administrative control of the artifact repository. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High) with CWE-287 as the root cause class, the flaw affects six self-managed release branches and is fixed in 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34 and 7.161.15. There is no CISA KEV listing or public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), so this reads as a patching-hygiene issue rather than an emergency zero-day.
Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain tokens or credentials, leading to full compromise of the instance. The flaw stems from an event-handling weakness and can be triggered under specific, undisclosed conditions. No public exploit or active exploitation has been reported.
Heap-based buffer overflow in LibRaw 0.21 allows remote code execution when a user opens a maliciously crafted RAW image file. The flaw resides in the stretch() and fuji_rotate() functions and requires user interaction, enabling a complete compromise of confidentiality, integrity, and availability. Proof-of-concept code exists, but no active exploitation has been confirmed.
Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Use-after-free write in the Linux kernel's bridge netfilter IPv6 fragmentation path (br_ip6_fragment) lets an adjacent attacker corrupt kernel memory and crash the host. The flaw affects systems acting as bridges with connection-tracking (nf_conntrack_bridge) forwarding IPv6 traffic, where a stale prevhdr pointer is dereferenced after skb_checksum_help() reallocates the skb head for a cloned packet. There is no public exploit identified at time of analysis and it is not in CISA KEV; the reported KASAN trace demonstrates a reliable kernel panic (denial of service), with memory-corruption escalation theoretically possible.
Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Guest-to-host state corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) support arises because kvm_hyp_handle_mops() writes an untranslated synthetic CPSR value directly into hardware when rewinding single-step state after a MOPS (FEAT_MOPS memory copy/set) exception. On systems running a nested guest at virtual EL2, this bypasses the vEL2-to-hardware translation, leaving SPSR_EL2 with an invalid exception-return state that the host later consumes. The fix modifies SPSR_EL2 directly and defers resynchronization to the next full exit. There is no public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV.
Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%).
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
Arbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to compromise the server. The attacker can execute arbitrary code as the Cribl server process by importing a crafted Git repository containing a symbolic link in the pack's functions directory. No public exploit is known, and there is no evidence of active exploitation at this time.
Arbitrary JavaScript execution in Cribl Stream before 4.18.2 allows authenticated attackers with edit privileges to run arbitrary code on the server via crafted database connection identifiers or pack configuration values. The vulnerability stems from improper code generation in the JSON Pointer-to-accessor compiler. No public exploit or active exploitation has been reported.
Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows remote attackers to exhaust memory and crash the BEAM node. Affects OTP versions 23.2 to before 27.3.4.15, 28.5.0.4, 29.0.4 (ssl 10.2 to before 11.2.12.11, 11.6.0.4, 11.7.4). No user interaction or authentication required, making this a pre-authentication denial-of-service risk for any TLS
Denial of service in Erlang/OTP's TLS handshake allows remote unauthenticated attackers to crash the BEAM VM by sending a crafted X.509 certificate chain. The vulnerability affects OTP versions 26.2 through 29.0.3 and specific patch releases of 27 and 28, exploiting unbounded growth of the policy tree during path validation. No active exploitation or public exploit code is known at this time, but the attack is automatable and has a high CVSS score.
Missing authentication in Ghost Robotics' Vision 60 quadruped robot - specifically in the mobile app (APK v5.5.0) exposing its web administration interface and HTTP API - lets an unauthenticated attacker who is associated to the robot's own internal Wi-Fi network take full control of the platform (CWE-306). From that position the attacker can view live camera feeds, command movement, manage the GPS, RTK, SAM and LIDAR sensor suite, and issue critical operational commands including Play, Pause, Stop and E-Stop, resulting in complete loss of confidentiality, integrity and physical safety. Exploitation is bounded by the requirement to be within and joined to the robot's private Wi-Fi (CVSS 4.0 AV:A, PR:N, score 8.7), it is assessed as not automatable, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.19% (10th percentile), consistent with a technically severe but narrowly reachable flaw.
Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to intercept and manipulate communications, disconnect legitimate operators, and take unauthorized control of the quadruped robot, completely compromising confidentiality, integrity, and availability of operations. No active exploitation has been reported in CISA KEV, and no public exploit code was identified at time of analysis.
Unauthenticated attackers can gain access to live video snapshots from CP PLUS EZ-P21 IP Camera (v4.8.8.1 and prior) by brute‐forcing the HTTP authentication endpoint. The vulnerability stems from a missing brute‐force protection mechanism, allowing remote password guessing without rate limiting or account lockout. Successful exploitation reveals high‐confidentiality video data. No active exploitation or public exploit code is known at this time.
Stored cross-site scripting in Prospero Flow CRM before 5.4.4 allows low-privileged authenticated users to inject JavaScript into email bodies that execute when viewed by administrators, leading to session hijacking and account takeover. The vulnerability stems from unsanitized email content rendered unescaped via {!! ... !!}. A patch is available and no public exploit or active exploitation has been identified.
Path traversal in phpMyFAQ's category image deletion allows authenticated attackers to delete arbitrary files, leading to superadmin account creation. Versions before 4.1.6 fail to sanitize the existing_image parameter, permitting deletion of critical files like database.php, which disables the installation gate and exposes the setup wizard. Publicly available exploit code exists, and the issue has been verified by the vendor.
Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.
OS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges and adjacent network access to execute arbitrary commands through the management interface, leading to full system compromise. No active exploitation or publicly available exploit has been reported at the time of analysis.
Privilege escalation in phpMyFAQ before 4.1.6 allows administrators with only group-management permissions to add themselves to existing groups holding user-management rights without verification of required privileges, enabling unauthorized modification or deletion of user accounts. The vulnerability stems from missing authorization checks in GroupController::updateMembers(). No public exploit or active exploitation has been identified at the time of analysis.
OS command injection in the backup-restore functionality of Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated administrator to execute arbitrary operating-system commands on the appliance, resulting in complete system compromise (CWE-78, CVSS 8.4). Exploitation requires a high-privilege session (PR:H) and adjacent-network reachability to the management interface (AV:A), where a crafted or manipulated backup causes shell metacharacters to be interpreted by the OS command the restore process runs. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and not automatable, and EPSS is low at 0.72% (50th percentile); Progress has published patched builds for all affected products.
OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execute arbitrary operating system commands via the Geo Location management interface, resulting in complete system compromise. Affected products include LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. No public exploit or active exploitation was identified at the time of analysis.
Command injection in Ericsson Packet Core Controller (PCC) prior to version 1.38 allows authenticated high-privilege attackers with adjacent network access to execute arbitrary code as root. The vulnerability stems from improper sanitization of special elements (CWE-78) in OS command execution. No public exploit or active exploitation reported.
Privilege escalation in Lenze C430, C520, C550, and i950 series devices allows low-privileged local attackers to bypass SSH enablement signature verification. This enables unauthorized SSH access, leading to complete system compromise. The vulnerability is tracked under CVE-2026-14837 and was reported by CERTVDE; no public exploit or active exploitation (KEV) has been confirmed at this time.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Remote code execution and denial of service are possible against Erlang/OTP nodes that run the megaco application with the optional flex C-driver scanner, because a single text-encoded H.248/Megaco message carrying an oversized property parm name overflows a fixed 512-byte error buffer and corrupts live pointers inside the scanner driver struct. Affected are OTP releases from 17.0 up to the 29.0.4, 28.5.0.4 and 27.3.4.15 fixes (megaco 3.17.1 through 4.9.1, 4.8.3.1 and 4.7.2.2) where {scanner, flex} is configured; exploitation requires only network reachability to the megaco transport port, with no authentication or user interaction (vendor CVSS:4.0 8.3; independent assessment CVSS:3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:H). Reliable code execution is not confirmed and depends on struct/heap-layout grooming, builds compiled with _FORTIFY_SOURCE abort with SIGABRT (denial of service only), no public exploit code was identified at time of analysis, EPSS is 0.73% (51st percentile), and CISA SSVC rates exploitation as none with automatable as no.
Kernel memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor able to load a BPF sk_msg program to trigger an out-of-bounds write via an integer overflow in bpf_msg_push_data(). A crafted u32 'len' argument (typed ARG_ANYTHING) wraps the 'copy + len' page-allocation size to a small value, producing an undersized allocation followed by an oversized memcpy that corrupts kernel heap memory, enabling denial of service and potential privilege escalation. There is no public exploit identified at time of analysis and the EPSS score is low (0.18%), but the flaw is confirmed and patched upstream by kernel maintainers.