Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.
Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
Local privilege escalation in macOS Sonoma 14.x before 14.8.8 and Sequoia 15.x before 15.7.8 allows a malicious app to gain elevated system privileges via a race condition. Apple has released patches, and no active exploitation or public proof-of-concept has been identified at this time.
Privilege escalation in macOS via race condition allows a low-privileged local app to gain root privileges. The issue, tracked as CVE-2026-43693, was addressed with improved state handling and is fixed in the latest OS updates. No active exploitation has been reported and exploitation requires a local user account with high attack complexity, limiting immediate risk.
Local privilege escalation in Apple macOS allows a low-privileged application to gain root privileges by exploiting a race condition in system state management. The issue is resolved in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. No active exploitation has been reported, but the local attack vector limits remote risk.
Physical exploitation of an insecure debug feature in CP PLUS EZ-P21 IP Camera firmware allows attackers to execute arbitrary code with elevated privileges. Firmware versions v4.8.8.1 and earlier are affected. Exploitation requires physical access to insert removable media containing a malicious payload, but no authentication or user interaction is needed.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Audit log disclosure in Honeywell S35 Series cameras allows unauthenticated remote attackers to retrieve audit logs, potentially exposing sensitive operational information. Affected are all firmware versions up to HC5.26.1.14.20260207. No public exploit or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notifications by manipulating the ID parameter in the /notification/delete/{id} endpoint. Sequential notification IDs enable systematic deletion across the system, disrupting user awareness of critical business events. A vendor fix is available in version 5.5.3, and no active exploitation has been reported.
Cross-site scripting (XSS) in Pivotick's sidebar property-list component allows an attacker to execute JavaScript in a victim's browser session by injecting a malicious URI (e.g., javascript:) into node or edge property values. Affects all versions prior to the patch. No public exploit or active exploitation has been reported, and EPSS data is not available.
Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.
Information disclosure in Ericsson Packet Core Controller (PCC) prior to version 1.39 allows high-privileged attackers on adjacent networks to extract system secrets via error messages triggered by crafted Configuration Management commands. No public exploit or active exploitation has been identified at analysis time.
Server-side request forgery in Arista VeloCloud Orchestrator On-Prem lets an authenticated tenant account with at least the Enterprise Standard Admin role induce the Orchestrator to issue requests to internal services that are otherwise unreachable, because a VCO feature fails to sufficiently validate caller-supplied input. Impact is scoped to subsequent systems rather than the Orchestrator itself (low confidentiality/integrity, no availability effect), so real risk depends on what internal services a given deployment can route to. No public exploit code or active exploitation is known - Arista discovered the issue internally and confirms no malicious use in customer networks - although EPSS places it around the 82nd percentile, and vendor patches are available for the affected release trains.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
Denial of service vulnerability in Mattermost allows authenticated users to exhaust server resources by uploading crafted animated GIFs as custom emoji. Affects versions 10.11.x, 11.6.x, 11.7.x, and 11.8.x up to certain patch levels. No active exploitation or public exploit is known, but patches are available from the vendor.
Server-Side Request Forgery (SSRF) in JFrog Artifactory’s support for Terraform remote repositories allows an authenticated user—or an unauthenticated user if anonymous access is enabled on the repository—to make the Artifactory instance issue outbound HTTP requests to arbitrary destinations and return the response content. This can lead to disclosure of sensitive internal resources and is rated 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No active exploitation or public exploit is known at the time of analysis.
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows an authenticated user with read access to Cargo remote repositories to force the server to request unintended URLs and return the response, potentially exposing internal services and sensitive data. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery (SSRF) in JFrog Artifactory allows authenticated attackers to make unauthorized requests to internal services, potentially exposing internal network resources and cached response data. The vulnerability arises from improper URL validation when handling specific URLs. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS score of 6.5 reflects moderate risk with a requirement for authentication.
Broken access control in the Ad Invalid Click Protector (AICP) WordPress plugin up to version 1.3.0 allows unauthenticated attackers to manipulate plugin settings or disrupt its click-protection functionality. No active exploitation or public proof-of-concept is currently known, but the vulnerability is easily triggered over the network with no user interaction.
Unauthenticated remote attackers can partially read and modify data in Apache Wicket versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0 due to a protection mechanism that relies on insufficiently random values. The vulnerability is automatable with low attack complexity and no user interaction, though no active exploitation or public exploit code has been observed at this time. While the technical impact is limited to partial confidentiality and integrity compromise, the widespread enterprise use of Wicket makes it a moderate priority for patching.
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Unauthorized file read via a sandbox escape vulnerability in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious app to access files outside its designated sandbox. Exploitation requires user interaction to install and launch a malicious app, but no active exploitation or public exploit code is currently known. CVSS medium severity (6.5) is offset by a very low EPSS score (0.17%), indicating low real-world exploitation probability.
Cleartext transmission of sensitive data in Apple iOS 26.6 and earlier allows an app to access sensitive user data over the network. The issue is fixed by enforcing HTTPS in iOS and iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit has been identified and EPSS risk is low (0.16%).
An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.
Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.
macOS authorization bypass allows an app to access sensitive user data without proper permission, potentially triggered via malicious website in Safari
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
Cross-site scripting (XSS) in the AcyChecker WordPress plugin allows attackers with low-privileged access (e.g., subscriber) to inject malicious scripts into admin pages. No public exploit code or active exploitation has been reported, and the absence of KEV and EPSS data suggests low current risk.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Stored cross-site scripting (XSS) in Open User Map WordPress plugin versions up to 1.4.46 allows authenticated contributor-level users to inject arbitrary JavaScript into map marker content, which executes when other users view the affected map. No active exploitation has been reported (SSVC: exploitation none), and no public exploit code is identified.
Stored cross-site scripting in the Photonic Gallery & Lightbox plugin for WordPress allows authenticated attackers with Contributor-level privileges to inject arbitrary web scripts. When an administrator or other higher-privilege user views a crafted gallery or album configuration, the malicious script executes in their browser, potentially leading to session hijacking or account takeover. This affects all versions up to and including 3.33.
Stored cross-site scripting in the Location Weather WordPress plugin (≤ 3.0.6) allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When a higher-privileged user (such as an administrator) views the malicious content, the script executes in that user’s browser, potentially leading to session hijacking, site defacement, or other client-side attacks. No active exploitation or public proof-of-concept is reported, and the EPSS probability is not available.
Stored Cross-Site Scripting (XSS) in the BetterDocs WordPress plugin version 4.6.2 and earlier allows authenticated users with Contributor-level access to inject arbitrary web scripts. When an administrator views the crafted content, the script executes in their session, potentially leading to session hijacking or content manipulation. No active exploitation has been publicly reported.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.
Unauthenticated attackers can exploit broken access control in the Thrive Leads WordPress plugin (versions ≤10.9.2) to perform unauthorized modifications or disrupt functionality, with low integrity and availability impact. No public exploit or active exploitation has been reported at the time of analysis.
Sensitive data exposure in the Yukassa for WooCommerce plugin allows authenticated subscribers to access sensitive payment information, potentially including transaction details or customer data. The vulnerability affects plugin versions up to 2.16.1. No public exploit or active exploitation has been identified at the time of analysis.
Broken access control in RT Mega Menu plugin for WordPress ≤1.5.1 allows authenticated subscribers to modify mega menu settings without proper authorization checks. This could lead to unauthorized changes to navigation structures, potentially facilitating phishing or content tampering. No public exploit or active exploitation reported at time of analysis.
Cross-site scripting in RT Mega Menu <=1.5.1 allows authenticated attackers with subscriber-level access to inject malicious JavaScript into menu items. The injected script executes in the context of any user visiting a page with the corrupted mega menu, enabling session token theft, site defacement, or redirection. No active exploitation or public exploit code is currently confirmed.
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.
Denial-of-service in Erlang OTP's epmd daemon due to improper handling of file descriptor exhaustion allows an unauthenticated remote attacker to terminate the daemon. The vulnerability arises from calling epmd_cleanup_exit() on EMFILE/ENFILE errors instead of recovering, and can lead to permanent service failure on Debian/Ubuntu systems using systemd. No active exploitation identified (SSVC exploitation none, EPSS 0.39%) and no public exploit code is known.
Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Cross-site scripting in Milk Admin versions up to 0.9.8 enables remote attackers to inject arbitrary web scripts or HTML via the action parameter of the Docs module. A public proof-of-concept exploit is available, though active exploitation has not been reported. The vulnerability requires user interaction and could lead to session hijacking or other browser-based attacks.
Cross-site scripting (XSS) in Apache Wicket versions 9.0.0-9.23.0 and 10.0.0-10.9.0 allows attackers to inject client-side scripts into pages rendered by the affected application, potentially compromising user sessions or redirecting victims. The vulnerability arises from insufficient neutralization of user input during HTML generation, enabling script injection via crafted URLs or form submissions. No public exploit is known, but upgrading to version 10.10.0 eliminates the issue.
Incorrect authorization in AstrBot up to 4.25.5 allows remote authenticated users to bypass persona-based tool restrictions and execute unauthorized function tools. A public exploit exists, and a patch is available from the vendor. No active exploitation has been reported via CISA KEV, but the public exploit increases risk for deployments using persona tool controls.