Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execute arbitrary SQL queries against the site's database. This can lead to unauthorized extraction of sensitive data (such as user credentials) and potential denial of service through resource exhaustion. No active exploitation or public proof-of-concept has been reported at the time of analysis.
SQL injection in the Relevanssi Light WordPress plugin (≤1.2.2) allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, leading to exposure of sensitive information and limited data corruption. The vulnerability carries a critical CVSS score of 9.3 due to low attack complexity and high confidentiality impact. No public exploit or CISA KEV listing was identified at the time of analysis.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
Username enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows unauthenticated attackers to enumerate valid usernames and bypass brute-force protections via distinct responses on front-end credential checks. Publicly available exploit code exists, though no active exploitation has been reported. The medium-severity flaw, while not directly exposing passwords, facilitates credential-stuffing and further attacks against identified accounts.
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggregator import records as failed and insert arbitrary content into a hidden comment. Public exploit code is available, and the vulnerability is automatable via the REST API, increasing the risk beyond the moderate CVSS score.
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract sensitive data from the Joomla database via crafted order parameters in the Dynamic Content endpoint. The vulnerability, assigned CVE-2026-65766, has a CVSS 4.0 score of 9.2 but is not listed in CISA's KEV and has no known public exploits at time of analysis.
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by the client, bypassing certificate validation and enabling full traffic decryption and manipulation. This affects OTP versions 17.0 through prior to 27.3.4.15, 28.5.0.4, and 29.0.4. The vulnerability is resolved in patched releases; no active exploitation or public proof-of-concept is known at this time.
Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.
Server-side request forgery in Plack::App::Prerender before 0.3.0 allows unauthenticated remote attackers to proxy requests to arbitrary internal hosts by crafting a request URI starting with '@'. The application appends the raw REQUEST_URI to a plain string rewrite base without validating the path, enabling an attacker to change the destination authority and access restricted resources. No public exploit is known, and active exploitation has not been observed.
Uninitialized kernel memory disclosure in the Linux kernel SCTP stack allows a remote peer to leak stale kernel heap/stack bytes by sending a malformed ERROR chunk carrying a STALE_COOKIE cause. When an association is in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads a 4-byte 'Measure of Staleness' from the first cause in the chunk without verifying that the field is actually present, and echoes that value back to the peer in the Cookie Preservative of the reply INIT. It is reachable by any peer - including an unprivileged local process using a raw SCTP socket inside a user+network namespace - and there is no public exploit identified at time of analysis (EPSS 0.18%, not in CISA KEV).
Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject JavaScript via the Reply Ticket field, which executes when staff or administrators view the support ticket detail page. A public proof-of-concept is available, but no active exploitation has been reported. The flaw can expose privileged users to session theft or credential phishing.
An authenticated SQL injection in an API component of Arista's VeloCloud Orchestrator On-Prem allows a user holding valid credentials to manipulate backend queries, exposing data beyond their intended privileges and causing the orchestrator to initiate unintended outbound network connections. Only on-prem installations on the 5.2.0, 6.1.0 and 6.4.0 branches before 5.2.3.14, 6.1.3.4 and 6.4.2.4 are affected; exploitation requires a working authenticated session (CVSS vector PR:L), so anonymous attacks are not possible, and exposure is further narrowed because the orchestrator management plane is normally reachable only from admin or management networks. EPSS is 2.83% (85th percentile) with no public exploit code and no active exploitation reported, and while the vendor's CVSS 4.0 base score is 8.5, our independent assessment treats this as a moderate-priority rather than top-priority issue given the authentication prerequisite and the on-prem-only, restricted-reachability attack surface.
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.
Use-after-free in SQLite 3.41's JSON parser allows remote code execution. A remote attacker can deliver a crafted JSON payload; if a user or application processes it with SQLite, the vulnerability triggers memory corruption, potentially enabling full system compromise. A proof-of-concept advisory is publicly available, though no active exploitation has been confirmed.
An authentication-handling weakness in JFrog Artifactory's internal request processing lets an attacker who already holds a low-privileged account elevate to a higher access level, potentially reaching administrative control of the artifact repository. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High) with CWE-287 as the root cause class, the flaw affects six self-managed release branches and is fixed in 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34 and 7.161.15. There is no CISA KEV listing or public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), so this reads as a patching-hygiene issue rather than an emergency zero-day.
Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain tokens or credentials, leading to full compromise of the instance. The flaw stems from an event-handling weakness and can be triggered under specific, undisclosed conditions. No public exploit or active exploitation has been reported.
Heap-based buffer overflow in LibRaw 0.21 allows remote code execution when a user opens a maliciously crafted RAW image file. The flaw resides in the stretch() and fuji_rotate() functions and requires user interaction, enabling a complete compromise of confidentiality, integrity, and availability. Proof-of-concept code exists, but no active exploitation has been confirmed.
Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Use-after-free write in the Linux kernel's bridge netfilter IPv6 fragmentation path (br_ip6_fragment) lets an adjacent attacker corrupt kernel memory and crash the host. The flaw affects systems acting as bridges with connection-tracking (nf_conntrack_bridge) forwarding IPv6 traffic, where a stale prevhdr pointer is dereferenced after skb_checksum_help() reallocates the skb head for a cloned packet. There is no public exploit identified at time of analysis and it is not in CISA KEV; the reported KASAN trace demonstrates a reliable kernel panic (denial of service), with memory-corruption escalation theoretically possible.
Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).
Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.
Guest-to-host state corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) support arises because kvm_hyp_handle_mops() writes an untranslated synthetic CPSR value directly into hardware when rewinding single-step state after a MOPS (FEAT_MOPS memory copy/set) exception. On systems running a nested guest at virtual EL2, this bypasses the vEL2-to-hardware translation, leaving SPSR_EL2 with an invalid exception-return state that the host later consumes. The fix modifies SPSR_EL2 directly and defers resynchronization to the next full exit. There is no public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV.
Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%).
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.
Arbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to compromise the server. The attacker can execute arbitrary code as the Cribl server process by importing a crafted Git repository containing a symbolic link in the pack's functions directory. No public exploit is known, and there is no evidence of active exploitation at this time.
Stored cross-site scripting in Smart Manager for WordPress before version 8.92.0 enables authenticated attackers with at least Contributor role to inject JavaScript that executes in an administrator's browser via the management grid. A publicly available proof-of-concept exists, though no active exploitation is confirmed. The vendor has released patched version 8.92.0.
Arbitrary JavaScript execution in Cribl Stream before 4.18.2 allows authenticated attackers with edit privileges to run arbitrary code on the server via crafted database connection identifiers or pack configuration values. The vulnerability stems from improper code generation in the JSON Pointer-to-accessor compiler. No public exploit or active exploitation has been reported.
Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows remote attackers to exhaust memory and crash the BEAM node. Affects OTP versions 23.2 to before 27.3.4.15, 28.5.0.4, 29.0.4 (ssl 10.2 to before 11.2.12.11, 11.6.0.4, 11.7.4). No user interaction or authentication required, making this a pre-authentication denial-of-service risk for any TLS
Denial of service in Erlang/OTP's TLS handshake allows remote unauthenticated attackers to crash the BEAM VM by sending a crafted X.509 certificate chain. The vulnerability affects OTP versions 26.2 through 29.0.3 and specific patch releases of 27 and 28, exploiting unbounded growth of the policy tree during path validation. No active exploitation or public exploit code is known at this time, but the attack is automatable and has a high CVSS score.
Missing authentication in Ghost Robotics' Vision 60 quadruped robot - specifically in the mobile app (APK v5.5.0) exposing its web administration interface and HTTP API - lets an unauthenticated attacker who is associated to the robot's own internal Wi-Fi network take full control of the platform (CWE-306). From that position the attacker can view live camera feeds, command movement, manage the GPS, RTK, SAM and LIDAR sensor suite, and issue critical operational commands including Play, Pause, Stop and E-Stop, resulting in complete loss of confidentiality, integrity and physical safety. Exploitation is bounded by the requirement to be within and joined to the robot's private Wi-Fi (CVSS 4.0 AV:A, PR:N, score 8.7), it is assessed as not automatable, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.19% (10th percentile), consistent with a technically severe but narrowly reachable flaw.
Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to intercept and manipulate communications, disconnect legitimate operators, and take unauthorized control of the quadruped robot, completely compromising confidentiality, integrity, and availability of operations. No active exploitation has been reported in CISA KEV, and no public exploit code was identified at time of analysis.
Unauthenticated attackers can gain access to live video snapshots from CP PLUS EZ-P21 IP Camera (v4.8.8.1 and prior) by brute‐forcing the HTTP authentication endpoint. The vulnerability stems from a missing brute‐force protection mechanism, allowing remote password guessing without rate limiting or account lockout. Successful exploitation reveals high‐confidentiality video data. No active exploitation or public exploit code is known at this time.
Open redirect vulnerability in Contact Form 7 WordPress plugin prior to version 2.5 allows unauthenticated attackers to redirect victims to arbitrary external sites after the Stripe checkout flow. Publicly available exploit code exists, but no active exploitation has been confirmed. With a CVSS score of 4.7 (medium) and low EPSS not provided, the risk is moderate due to required user interaction and limited impact.
Stored cross-site scripting in Prospero Flow CRM before 5.4.4 allows low-privileged authenticated users to inject JavaScript into email bodies that execute when viewed by administrators, leading to session hijacking and account takeover. The vulnerability stems from unsanitized email content rendered unescaped via {!! ... !!}. A patch is available and no public exploit or active exploitation has been identified.
Path traversal in phpMyFAQ's category image deletion allows authenticated attackers to delete arbitrary files, leading to superadmin account creation. Versions before 4.1.6 fail to sanitize the existing_image parameter, permitting deletion of critical files like database.php, which disables the installation gate and exposes the setup wizard. Publicly available exploit code exists, and the issue has been verified by the vendor.
Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.
OS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges and adjacent network access to execute arbitrary commands through the management interface, leading to full system compromise. No active exploitation or publicly available exploit has been reported at the time of analysis.
Privilege escalation in phpMyFAQ before 4.1.6 allows administrators with only group-management permissions to add themselves to existing groups holding user-management rights without verification of required privileges, enabling unauthorized modification or deletion of user accounts. The vulnerability stems from missing authorization checks in GroupController::updateMembers(). No public exploit or active exploitation has been identified at the time of analysis.
OS command injection in the backup-restore functionality of Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated administrator to execute arbitrary operating-system commands on the appliance, resulting in complete system compromise (CWE-78, CVSS 8.4). Exploitation requires a high-privilege session (PR:H) and adjacent-network reachability to the management interface (AV:A), where a crafted or manipulated backup causes shell metacharacters to be interpreted by the OS command the restore process runs. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and not automatable, and EPSS is low at 0.72% (50th percentile); Progress has published patched builds for all affected products.
OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execute arbitrary operating system commands via the Geo Location management interface, resulting in complete system compromise. Affected products include LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. No public exploit or active exploitation was identified at the time of analysis.
Command injection in Ericsson Packet Core Controller (PCC) prior to version 1.38 allows authenticated high-privilege attackers with adjacent network access to execute arbitrary code as root. The vulnerability stems from improper sanitization of special elements (CWE-78) in OS command execution. No public exploit or active exploitation reported.
Privilege escalation in Lenze C430, C520, C550, and i950 series devices allows low-privileged local attackers to bypass SSH enablement signature verification. This enables unauthorized SSH access, leading to complete system compromise. The vulnerability is tracked under CVE-2026-14837 and was reported by CERTVDE; no public exploit or active exploitation (KEV) has been confirmed at this time.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Remote code execution and denial of service are possible against Erlang/OTP nodes that run the megaco application with the optional flex C-driver scanner, because a single text-encoded H.248/Megaco message carrying an oversized property parm name overflows a fixed 512-byte error buffer and corrupts live pointers inside the scanner driver struct. Affected are OTP releases from 17.0 up to the 29.0.4, 28.5.0.4 and 27.3.4.15 fixes (megaco 3.17.1 through 4.9.1, 4.8.3.1 and 4.7.2.2) where {scanner, flex} is configured; exploitation requires only network reachability to the megaco transport port, with no authentication or user interaction (vendor CVSS:4.0 8.3; independent assessment CVSS:3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:H). Reliable code execution is not confirmed and depends on struct/heap-layout grooming, builds compiled with _FORTIFY_SOURCE abort with SIGABRT (denial of service only), no public exploit code was identified at time of analysis, EPSS is 0.73% (51st percentile), and CISA SSVC rates exploitation as none with automatable as no.