Server-side request forgery (SSRF) in the ip-address JavaScript library allows bypass of security checks on IPv4-mapped and NAT64 IPv6 addresses. Versions 10.1.1 through 10.2.0 misclassify these addresses as global unicast instead of recognizing their embedded IPv4 addresses, enabling potential SSRF attacks against internal networks. No public exploit is identified, but the fix is available in version 10.2.1.
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time.
Stored cross-site scripting (XSS) in the Calendar WordPress plugin prior to version 1.3.18 allows authenticated users with Contributor-level access to inject arbitrary JavaScript into an event field. The script executes in the browsers of any user viewing the calendar page, potentially leading to session hijacking or privilege escalation. A public exploit is available, increasing the immediate risk despite the privilege requirement.
Authorization bypass in Apache ActiveMQ 5.x before 5.19.9 and 6.x before 6.2.8 allows authenticated low-privilege users to publish messages to any queue without proper write ACLs by abusing temporary composite destinations. This enables unauthorized message injection into restricted queues, potentially disrupting message integrity and business logic. No active exploitation or public exploit code has been identified.
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. JFrog has published advisories but patch version details are not specified in the CVE record.
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.
Reflected XSS in the Sina Extension for Elementor WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability exists in an unauthenticated AJAX handler that fails to escape user input before reflecting it. Public exploit code is available, and the vendor has released a patch in version 3.10.2.
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.
Reflected cross-site scripting (XSS) in the WordPress Document Gallery plugin before version 5.1.1 allows unauthenticated attackers to inject malicious scripts via an unsanitized parameter in an AJAX action. A publicly available proof-of-concept exploit exists, increasing the immediate risk for sites running affected versions.
Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.
Sandbox escape in macOS allows a malicious app to read files outside its sandbox. Affects macOS Sonoma prior to 14.8.8, Sequoia prior to 15.7.8, and Tahoe prior to 26.6. No active exploitation or public exploit
Username enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows unauthenticated attackers to enumerate valid usernames and bypass brute-force protections via distinct responses on front-end credential checks. Publicly available exploit code exists, though no active exploitation has been reported. The medium-severity flaw, while not directly exposing passwords, facilitates credential-stuffing and further attacks against identified accounts.
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggregator import records as failed and insert arbitrary content into a hidden comment. Public exploit code is available, and the vulnerability is automatable via the REST API, increasing the risk beyond the moderate CVSS score.
Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject JavaScript via the Reply Ticket field, which executes when staff or administrators view the support ticket detail page. A public proof-of-concept is available, but no active exploitation has been reported. The flaw can expose privileged users to session theft or credential phishing.
Stored cross-site scripting in Smart Manager for WordPress before version 8.92.0 enables authenticated attackers with at least Contributor role to inject JavaScript that executes in an administrator's browser via the management grid. A publicly available proof-of-concept exists, though no active exploitation is confirmed. The vendor has released patched version 8.92.0.
Open redirect vulnerability in Contact Form 7 WordPress plugin prior to version 2.5 allows unauthenticated attackers to redirect victims to arbitrary external sites after the Stripe checkout flow. Publicly available exploit code exists, but no active exploitation has been confirmed. With a CVSS score of 4.7 (medium) and low EPSS not provided, the risk is moderate due to required user interaction and limited impact.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Audit log disclosure in Honeywell S35 Series cameras allows unauthenticated remote attackers to retrieve audit logs, potentially exposing sensitive operational information. Affected are all firmware versions up to HC5.26.1.14.20260207. No public exploit or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notifications by manipulating the ID parameter in the /notification/delete/{id} endpoint. Sequential notification IDs enable systematic deletion across the system, disrupting user awareness of critical business events. A vendor fix is available in version 5.5.3, and no active exploitation has been reported.
Cross-site scripting (XSS) in Pivotick's sidebar property-list component allows an attacker to execute JavaScript in a victim's browser session by injecting a malicious URI (e.g., javascript:) into node or edge property values. Affects all versions prior to the patch. No public exploit or active exploitation has been reported, and EPSS data is not available.
Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.
Information disclosure in Ericsson Packet Core Controller (PCC) prior to version 1.39 allows high-privileged attackers on adjacent networks to extract system secrets via error messages triggered by crafted Configuration Management commands. No public exploit or active exploitation has been identified at analysis time.
Server-side request forgery in Arista VeloCloud Orchestrator On-Prem lets an authenticated tenant account with at least the Enterprise Standard Admin role induce the Orchestrator to issue requests to internal services that are otherwise unreachable, because a VCO feature fails to sufficiently validate caller-supplied input. Impact is scoped to subsequent systems rather than the Orchestrator itself (low confidentiality/integrity, no availability effect), so real risk depends on what internal services a given deployment can route to. No public exploit code or active exploitation is known - Arista discovered the issue internally and confirms no malicious use in customer networks - although EPSS places it around the 82nd percentile, and vendor patches are available for the affected release trains.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
Denial of service vulnerability in Mattermost allows authenticated users to exhaust server resources by uploading crafted animated GIFs as custom emoji. Affects versions 10.11.x, 11.6.x, 11.7.x, and 11.8.x up to certain patch levels. No active exploitation or public exploit is known, but patches are available from the vendor.
Server-Side Request Forgery (SSRF) in JFrog Artifactory’s support for Terraform remote repositories allows an authenticated user—or an unauthenticated user if anonymous access is enabled on the repository—to make the Artifactory instance issue outbound HTTP requests to arbitrary destinations and return the response content. This can lead to disclosure of sensitive internal resources and is rated 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No active exploitation or public exploit is known at the time of analysis.
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows an authenticated user with read access to Cargo remote repositories to force the server to request unintended URLs and return the response, potentially exposing internal services and sensitive data. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery (SSRF) in JFrog Artifactory allows authenticated attackers to make unauthorized requests to internal services, potentially exposing internal network resources and cached response data. The vulnerability arises from improper URL validation when handling specific URLs. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS score of 6.5 reflects moderate risk with a requirement for authentication.
Broken access control in the Ad Invalid Click Protector (AICP) WordPress plugin up to version 1.3.0 allows unauthenticated attackers to manipulate plugin settings or disrupt its click-protection functionality. No active exploitation or public proof-of-concept is currently known, but the vulnerability is easily triggered over the network with no user interaction.
Unauthenticated remote attackers can partially read and modify data in Apache Wicket versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0 due to a protection mechanism that relies on insufficiently random values. The vulnerability is automatable with low attack complexity and no user interaction, though no active exploitation or public exploit code has been observed at this time. While the technical impact is limited to partial confidentiality and integrity compromise, the widespread enterprise use of Wicket makes it a moderate priority for patching.
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Unauthorized file read via a sandbox escape vulnerability in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious app to access files outside its designated sandbox. Exploitation requires user interaction to install and launch a malicious app, but no active exploitation or public exploit code is currently known. CVSS medium severity (6.5) is offset by a very low EPSS score (0.17%), indicating low real-world exploitation probability.
Cleartext transmission of sensitive data in Apple iOS 26.6 and earlier allows an app to access sensitive user data over the network. The issue is fixed by enforcing HTTPS in iOS and iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit has been identified and EPSS risk is low (0.16%).
An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.
Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.
macOS authorization bypass allows an app to access sensitive user data without proper permission, potentially triggered via malicious website in Safari
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
Cross-site scripting (XSS) in the AcyChecker WordPress plugin allows attackers with low-privileged access (e.g., subscriber) to inject malicious scripts into admin pages. No public exploit code or active exploitation has been reported, and the absence of KEV and EPSS data suggests low current risk.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Stored cross-site scripting (XSS) in Open User Map WordPress plugin versions up to 1.4.46 allows authenticated contributor-level users to inject arbitrary JavaScript into map marker content, which executes when other users view the affected map. No active exploitation has been reported (SSVC: exploitation none), and no public exploit code is identified.
Stored cross-site scripting in the Photonic Gallery & Lightbox plugin for WordPress allows authenticated attackers with Contributor-level privileges to inject arbitrary web scripts. When an administrator or other higher-privilege user views a crafted gallery or album configuration, the malicious script executes in their browser, potentially leading to session hijacking or account takeover. This affects all versions up to and including 3.33.
Stored cross-site scripting in the Location Weather WordPress plugin (≤ 3.0.6) allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When a higher-privileged user (such as an administrator) views the malicious content, the script executes in that user’s browser, potentially leading to session hijacking, site defacement, or other client-side attacks. No active exploitation or public proof-of-concept is reported, and the EPSS probability is not available.
Stored Cross-Site Scripting (XSS) in the BetterDocs WordPress plugin version 4.6.2 and earlier allows authenticated users with Contributor-level access to inject arbitrary web scripts. When an administrator views the crafted content, the script executes in their session, potentially leading to session hijacking or content manipulation. No active exploitation has been publicly reported.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.
Unauthenticated attackers can exploit broken access control in the Thrive Leads WordPress plugin (versions ≤10.9.2) to perform unauthorized modifications or disrupt functionality, with low integrity and availability impact. No public exploit or active exploitation has been reported at the time of analysis.
Sensitive data exposure in the Yukassa for WooCommerce plugin allows authenticated subscribers to access sensitive payment information, potentially including transaction details or customer data. The vulnerability affects plugin versions up to 2.16.1. No public exploit or active exploitation has been identified at the time of analysis.
Broken access control in RT Mega Menu plugin for WordPress ≤1.5.1 allows authenticated subscribers to modify mega menu settings without proper authorization checks. This could lead to unauthorized changes to navigation structures, potentially facilitating phishing or content tampering. No public exploit or active exploitation reported at time of analysis.