An authenticated SQL injection flaw in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin (≤2.10.22) allows administrators to execute arbitrary SQL queries, potentially exposing sensitive database content. The vulnerability arises from improper input neutralization (CWE-89) and, while requiring high privileges, enables reading of the entire WordPress database due to a scope change. No public exploit or active exploitation has been reported.
Memory corruption in SQLite 3.41's ORDER BY parsing allows remote attackers to crash the database process or leak sensitive data via crafted SQL queries. A use-after-free in ExprList handling, triggered by an ORDER BY clause with many items, can also lead to arbitrary code execution under specific memory conditions. A public advisory exists, but no active exploitation (KEV) or EPSS data is available.
Remote denial of service in ESP32-audioI2S 3.4.5 allows unauthenticated network attackers to crash ESP32 devices by sending crafted MP3 audio data that triggers a buffer overflow in the UnpackFrameHeader() function. Public proof-of-concept code is available, enabling automated exploitation. The vulnerability does not impact confidentiality or integrity.
Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.
Remote denial-of-service in Apple macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows unauthenticated attackers to disrupt system availability through an input validation weakness. No active exploitation or public exploit code has been identified; EPSS indicates low probability of widespread attacks.
SQL injection in Dede CMS 5.7.118 via the sqlquery parameter of sys_sql_query.php allows unauthenticated remote attackers to extract arbitrary database contents, including sensitive information. A publicly available proof-of-concept exploit exists, although no active exploitation has been confirmed.
Information disclosure in Dede CMS 5.7.118 allows remote unauthenticated attackers to retrieve sensitive data via the 'str' parameter in the file_manage_control.php component. No active exploitation has been confirmed, but a public write-up with exploit details is available on a Gitee repository.
Remote denial of service and heap memory leak in SQLite 3.41 via the json_remove() function allows attackers with the ability to execute SQL queries to crash the database process or leak sensitive heap data. A use-after-free in jsonRemoveFunc is triggered by malformed JSON and a deep path parameter; publicly available proof-of-concept code exists, and low EPSS risk indicates limited exploitation likelihood.
Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.
Denial of service in the Linux kernel XDP generic receive path allows a NULL pointer dereference and kernel panic when a bond slave interface is released while XDP redirect processing is in flight. The affected code, xdp_master_redirect() in net/core/filter.c, guards only on netif_is_bond_slave() but dereferences the master device that bond_upper_dev_unlink() has already cleared, faulting on master->flags at offset 0xb0. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the issue is a race-window crash rather than a memory-disclosure or code-execution bug.
Integrity modification in macOS Keychain allows remote unauthenticated attackers to modify Keychain state via a race condition. This vulnerability (CVE-2026-43728) is fixed in macOS Tahoe 26.6, with no known active exploitation but automatable according to SSVC. While CVSS rates it high severity, EPSS indicates very low likelihood of near-term exploitation.
Denial of service in OpenSBI 1.3 allows remote, unauthenticated attackers to crash the system via crafted requests to the SBI PMU extension's counter configuration function (SBI function #2). The flaw, classified as uncontrolled resource consumption (CWE-400), can be triggered without user interaction and is rated high severity (CVSS 7.5). While no active exploitation is confirmed (not in CISA KEV) and EPSS remains very low (0.14%), a proof-of-concept crash is publicly available, making it a concern for RISC-V platforms in multi-tenant or exposed firmware environments.
Unauthenticated remote attackers can inject arbitrary events into mTLS-protected event streams in Event-Driven Ansible (EDA) server by spoofing the Subject HTTP header, bypassing mTLS authentication. The vulnerability arises from permissive access controls on the ExternalEventStreamViewSet and reliance on an untrusted Subject header, combined with leakage of the expected Distinguished Name in error responses. No active exploitation or public exploit is confirmed at this time, but the high integrity impact and low attack complexity make it a significant risk.
Sensitive information disclosure in the Byteflows Travel & Hotel Booking plugin for WordPress allows unauthenticated remote attackers to read sensitive system data. The vulnerability affects plugin versions up to 1.0.0 and exposes information that could aid further attacks. No public exploit or active exploitation has been reported at time of analysis.
Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified.
Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.
An unauthenticated broken access control flaw in the Post My CF7 Form WordPress plugin up to version 6.2.0 allows remote attackers to modify data handled by the plugin. No active exploitation has been confirmed and no public exploit code is known at the time of analysis; however, the vulnerability is trivial to exploit due to its network accessibility and lack of required privileges.
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attackers to modify booking prices due to improper validation of input quantities (CWE-1284). The vulnerability enables remote attackers to alter pricing without authentication or user interaction, potentially leading to financial loss or fraudulent bookings. No evidence of active exploitation or publicly available exploit code exists at time of analysis.
Unspecified vulnerability in the Falcon - WordPress Optimizations & Tweaks plugin up to version 2.10.0 allows remote, unauthenticated attackers to cause a denial of service due to improper input validation (CWE-1284). The high-severity flaw (CVSS 7.5) impacts availability with no user interaction required. No public exploit or active exploitation has been confirmed, and EPSS data is unavailable.
Unauthenticated broken access control in Stripe For WooCommerce plugin version 4.0.7 and below allows remote attackers to modify plugin data without any authentication. The vulnerability
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation.
Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.
Privilege escalation vulnerability in JFrog Artifactory allows an attacker with an admin-provisioned account to temporarily gain platform administrator access. The flaw, reported by JFrog, is rated high severity (CVSS 7.2) and requires high privileges to exploit. No active exploitation or public exploit code is known at this time.
Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.
Server-side request forgery in Simple Link Directory Pro plugin versions up to 15.0.6 allows unauthenticated remote attackers to force the WordPress server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal infrastructure and sensitive data. The vulnerability has a CVSS score of 7.2 with no user interaction required, but exploitation impact is limited to low confidentiality and integrity effects. No active exploitation or public exploit code is currently reported.
Unauthorized account access in Ekushey Project Manager CRM allows authenticated administrators to create duplicate client accounts with identical email and password credentials. An authenticated admin can exploit the missing email uniqueness enforcement to create conflicting account states, causing unpredictable authentication and potential unauthorized access to victim accounts. A proof-of-concept exploit is publicly available.
Authenticated users in Leantime 3.6.2 and earlier can bypass project access controls to read milestone data from any project on the instance. By supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint, an attacker can enumerate and retrieve sensitive project planning information, including titles, descriptions, and timelines, without membership. A fix is available; exploitation details are public but no active exploitation has been reported.
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.
Denial-of-service
Heap out-of-bounds read in the Linux kernel's DRM EDID parser (drm_parse_tiled_block in drivers/gpu/drm/drm_edid.c) lets a crafted DisplayID tiled-display block trigger a slab-out-of-bounds read past the exact-sized kmemdup()'d EDID buffer. The affected code casts the block to struct displayid_tiled_block and reads the fixed 22-byte layout up to topology_id[7] without validating num_bytes, so an EDID advertising a tiled block (DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for DisplayID v2.0) with an undersized payload at the end of a DisplayID extension reads out of bounds, causing kernel memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV; the fix is upstreamed and backported to multiple stable trees.
A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.
Local privilege escalation in macOS allows a malicious application to bypass network restrictions, potentially exposing sensitive data or manipulating network traffic. The vulnerability affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and requires user interaction (e.g., installing a rogue app). Apple has released patches; no active exploitation or public exploit code has been identified.
Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).
Denial-of-service in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to trigger an out-of-bounds read, causing app crashes or system instability. The
Privacy bypass in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious application to circumvent Transparency, Consent, and Control (TCC) protections, granting unauthorized access to sensitive data and system resources. The vulnerability stems from an authorization flaw resolved via improved state management. No public exploit or active exploitation is known at this time, and EPSS estimates a very low (0.16%) chance of exploitation.
Local kernel memory read in macOS via a buffer overflow, fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. A local user with low privileges can trigger the overflow to read sensitive kernel data, potentially leaking encryption keys or credentials. No active exploitation or public exploit code is known.
Out-of-bounds read in macOS allows an attacker to crash applications and potentially access sensitive memory by tricking a user into opening a maliciously crafted file. Affecting macOS Son
Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.
Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting in the BackWPup WordPress plugin (version 5
Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.
Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of
Unauthenticated cross-site scripting in the WordPress plugin Ultimate Addons for Contact Form 7 (versions 3.5.45 and earlier) allows remote attackers to inject client-side script into pages rendered by a vulnerable site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is needed to deliver the payload, but successful exploitation requires victim interaction - a user must be induced to click a crafted link or trigger rendering of attacker-influenced input that is reflected without proper sanitization - which keeps the impact confined to the victim's browser rather than the server. Only sites with the plugin installed and active at version 3.5.45 or below are exposed; there is no public exploit identified at time of analysis, CISA KEV does not list this CVE, EPSS is low at 0.15% (4th percentile), and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.
Unauthenticated cross-site scripting vulnerability in the CleanTalk Anti-Spam WordPress plugin (versions up to 6.82) allows remote attackers to inject arbitrary web scripts. A successful attack requires a victim user to click a malicious link, enabling the attacker to execute JavaScript in the user's browser session, which can lead to session hijacking or defacement. No active exploitation or public exploit code has been identified.
Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.