SQL injection in @hypequery/clickhouse before version 2.0.2 allows unauthenticated remote attackers to inject arbitrary SQL commands through a trailing backslash in a query parameter. All users passing user-controlled input are affected, and the vulnerability can lead to full disclosure, modification, or destruction of the database. A vendor patch is available, and there is no evidence of active exploitation in the wild.
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
An incomplete fix for CVE-2026-40884 in goshs v2.1.3 allows unauthenticated attackers to bypass SFTP authentication and gain full file read, write, and delete access when the server is started with `-b 'user:' -sftp` and without the `-fkf` flag. Publicly available exploit code exists, and the root cause is a logic flaw in the password handler registration that was not fully addressed in the prior patch.
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. The `MOVE` handler incorrectly treats the verb as write-only without checking the delete restriction, permitting remote attackers using WebDAV clients to bypass the `--no-delete` boundary via a `MOVE` request with `Overwrite: T`. A public proof-of-concept exists, and the vendor has patched this in version 2.1.4.
We need to produce a JSON object with the specified fields. All fields are plain text strings. The input includes CVE-2026-66748 description, CVSS 4.0 vector (base only, no temporal/environmental), CWE-94, tags, POC publicly available, Patch available from vendor, CPE, SSVC, references, release notes with more details. Need to synthesize. Key points from description: Camaleon CMS versions 2.1.1 through 2.9.1, authenticated remote code execution, users with custom_fields manage permission can execute arbitrary Ruby code via select_eval custom field type. They supply a malicious expression in the field options command parameter, evaluated via instance_eval in ERB view when post edit page is rendered, achieving code execution with web process privileges. CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This is a v4 vector. Note the PR:L (low privileges). So authenticated as low privilege? Description says "users with custom_fields manage permission" - that's a specific permission, might be low or high? Typically custom_fields manage is not admin-level, maybe low. PR:L is consistent. AC:L, AV:N, UI:N. Total technical impact. So high CVSS 8.7 (not sure if that's computed score or base? CVSS 4.0 base score with those metrics would be 9.3? Wait, the given score is 8.7, maybe includes some environmental? But vector does not have environmental. Let's compute: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N -> base score: impact subscore: VC,H=0.56? Actually CVSS 4.0 formula: base score = max( ( (Impact_subscore * Exploitability_subscore)^? No, need to recall. But not necessary, just given score. We'll assess our own vector (both 3.1 and 4.0) based on description. Key: Authentication required (PR:L). Exploitation requires custom_fields manage permission (PR:L). The vulnerability is in how select_eval custom field type is evaluated. This field type was meant for advanced usage, but now they restrict it with a new permission. So prior to 2
Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server's filesystem by injecting ../ sequences into the URL path, which are concatenated without normalization in HttpBuilder::buildResponse(). Publicly available exploit code exists, yet no active exploitation is recorded in CISA KEV; the risk is elevated when the server runs as root, exposing credential stores and private keys.
Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause denial of service by sending ordinary HTTP requests. A memory leak in the request parser allocates objects without freeing them, consuming approximately 20–28 kB per request until the worker process is killed. Publicly available exploit code exists, but no active exploitation has been confirmed via CISA KEV.
Remote file disclosure in openhole-server v0.1.1 and earlier allows unauthenticated attackers to read arbitrary files from tunneled local services. The server forwards URL-decoded request paths, causing percent-encoded dot-segments (%2e%2e) and slashes to be decoded into path traversal sequences (../) before reaching the backend. Exploitation requires a tunneled local service that resolves paths without canonicalization, and the vulnerability is fixed in v0.1.2 by preserving raw percent-encoding.
Bearer token leak in the OAuth2 Ruby gem (ruby-oauth/oauth2) versions 0.4.0 through 2.0.
QTI Neon's relay service amplifies RECONNECT_REQUEST packets to the host, enabling unauthenticated attackers to cause denial of service on the host. The vulnerable handleReconnectRequest function in all three implementations (Java, Python, TypeScript) forward every request without bounding or deduplication, bypassing per-source rate limiting via spoofed IPs. No public exploit or KEV listing exists, but the attack is trivial to execute if a valid session ID is known.
We need to construct a JSON object that synthesizes data from multiple sources about CVE-2026-54690. The input includes description, CVSS, CWE, patch info, CPE, references, tags, etc. The output must be plain text strings, no arrays or objects, each field a coherent paragraph. Let's analyze the data. CVE ID: CVE-2026-54690 Description: datamodel-code-generator generates Pydantic v2 models, etc., from various schemas. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP/HTTPS URLs via _get_ref_body, and --allow-remote-refs gate can warn instead of blocking, allowing SSRF. Fixed in 0.61.0. CVSS: 8.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. So network, low complexity, no privileges, user interaction required, scope changed, high confidentiality, low integrity, no availability. CWE-918: Server-Side Request Forgery (SSRF). Tags: SSRF, Datamodel Code Generator. Patch: Available from vendor. Fix in version 0.61.0, commit. CPE: cpe:2.3:a:koxudaxi:datamodel-code-generator:*:*:*:*:*:*:*:* (asterisk, so all versions? Actually range is before fix, so vulnerable <=0.60.2? The description says from 0.9.1 until 0.61.0, with fix in 0.61.0, so vulnerable is >=0.9.1, <0.61.0. CPE * indicates all versions, but advisory says >=0.9.1. Probably better to specify version range. The EUVD affected versions: "datamodel-code-generator 0.9.1, < 0.61.0". References: GitHub advisory, commit, release tag. GHSA advisory from GitHub: summary says vulnerable to SSRF via JSON-Schema $ref to HTTP URL. It details that remote refs are fetched with no validation; --allow-remote-refs defaults to None which warns but then fetches; only explicit false blocks. Fetched body is parsed as sub-schema and reflected into generated code, leading to leakage. Only affects users who installed [http] extra. PoC available. Patch: commit adds --allow-private-network flag to block private network targets by default, and modifies behavi
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitrary Python code execution when a generated Pydantic v2 model is imported. Affects versions 0.52.1 through 0.60.1, with a fix in 0.60.2. Publicly available exploit code exists, though no active exploitation has been reported to CISA KEV.
Authentication bypass in pytonapi 2.2.0 allows unauthenticated remote attackers to trigger webhook handlers when a custom path is configured via the documented `path=` argument. The TonapiWebhookDispatcher fails to store bearer tokens for custom paths, causing the token check to be skipped entirely. Publicly available exploit code exists but no active exploitation in the wild has been confirmed.
We need to produce a JSON object with the specified fields. We'll synthesize data from the input. CVE ID: CVE-2026-55389 Description: datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0. CVSS Score: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE: CWE-22 Tags: Path Traversal, Datamodel Code Generator CPE: cpe:2.3:a:koxudaxi:datamodel-code-generator:*:*:*:*:*:*:*:* Multi-source intelligence from GitHub Advisory: summary confirms arbitrary local file read via JSON-Schema $ref using file:// or ../ traversal, bypassing --no-allow-remote-refs. Details show code branches that handle local file reads without containment checks. Fixed in 0.62.0. POC? Not explicitly stated, but the issue is described with code fragments and test cases that demonstrate the vulnerability. No KEV mention. EPSS not provided. CWE-22 is path traversal. We need to analyze and fill all fields. product_name: "datamodel-code-generator" (the specific product name, 1-3 words) summary: Synthesize original summary, not copy description. Must start with impact verb and product. "Arbitrary local file read in datamodel-code-generator prior to 0.62.0 allows unauthenticated attackers to read any file on the system via crafted JSON Schema $ref references (file:// or ../ traversal), bypassing the --no-allow-remote-refs control. This is fixed in version 0.62.0. Exploit code exists (public test cases) but no active exploitation reported." Wait, "Arbitrary local file read" is the impact. So summary: "Arbitrary loc
Remote denial of service in gotd/td versions before 0.145.1 allows unauthenticated attackers to exhaust memory and CPU by sending a crafted MTProto unencrypted packet with a maliciously inflated dataLen field, causing excessive allocation before length validation. No authentication or session is required, and the vulnerability is reachable during the handshake phase. There is no evidence of active exploitation and no public exploit has been identified.
An authorization bypass in goshs’s bulk zip-download route allows unauthenticated attackers to read any file protected solely by a per-folder .goshs ACL, circumventing both folder-based authentication and per-file block lists. The vulnerability affects goshs v2.x up to 2.1.0 and all v1.x versions. A proof-of-concept is publicly available, demonstrating the bypass against a patched version that had addressed a related ACL gap on write/delete routes but left the read path unprotected.
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the default `allow_private_network=False` restriction and reach internal services. The vulnerability affects versions prior to 0.63.0, where a time-of-check/time-of-use gap between URL validation and connection enables rebinding to private IPs. A public proof-of-concept exists, though no active exploitation in the wild is reported at this time.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Denial-of-service in Xen's Xenstore component allows unprivileged guest domains to crash the host by triggering a bitmap teardown in an error path of the XEN_DOMCTL_get_domain_state operation. Exploit code is publicly available, though no active exploitation is confirmed. The attack is automatable, requiring no user interaction or guest authentication.
We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.15% (percentile 5%) POC/Exploit: Publicly available Patch: Available from vendor Reported by: WPScan CPE: cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* Tags: XSS, WordPress, Database For Contact Form 7 Wpforms Elementor Forms SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49701 Affected versions (EUVD): ["Database for Contact Form 7, WPforms, Elementor forms 0 <1.5.3"] References: [cveorg] (exploit) https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-14870 Now, construct each field as a paragraph string. product_name: The plugin name is "Database for Contact Form 7, WPforms, Elementor forms". So product_name: "Database for Contact Form 7, WPforms, Elementor forms" – but that's long, but permissible as a product name. The task says "1-3 words ONLY." That's problematic because the product name is longer. I need to pick a short name. The plugin's main purpose: it's a database plugin for those form plugins. Maybe "WordPress Forms Database" or "Database for CF7, WPforms, Elementor Forms"? But I must keep it 1-3 words. The plugin name as per WPScan: "Database for Contact Form 7, WPforms, Elementor forms". I could shorten to "Database for Contact Form 7, WPforms, Elementor forms plugin"? No, that's too long. The instruction says: "product_name": "1-3 wor
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Brute-force vulnerability in MikroTik RouterOS allows adjacent network attackers to gain full administrative access by repeatedly guessing API credentials without effective lockout or rate-limiting. The absence of source-based restrictions and the ability to bypass a weak per-connection delay through concurrent sessions make high-volume password attacks practical. Successful exploitation grants complete control over the device, compromising confidentiality, integrity, and availability.
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.
Unauthenticated remote code execution in 3DEXPERIENCE Station Launcher App from Release R2023x through R2026x allows attackers to execute arbitrary commands on affected systems without any authentication. The flaw stems from deserialization of untrusted data (CWE-502) and carries a maximum CVSS 10.0 score. No active exploitation or public exploit code is reported at time of analysis, though the network‑accessible attack surface presents significant risk.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on behalf of other users. The vulnerability affects versions prior to 1.1.0 when the server is run in streamable-HTTP stateless transport mode. No public exploit code is known, but the critical CVSS score and network attack vector indicate high potential risk.
Remote code execution in Apache Axis2/Java through 2.0.0 arises from unsafe deserialization of Java objects in the optional Tribes clustering component, allowing unauthenticated remote attackers with network access to the clustering port to execute arbitrary code via crafted serialized payloads. The vulnerability is only exploitable when clustering is explicitly enabled, which is off by default. No active exploitation or public exploit code has been observed; the issue is resolved by upgrading to version 2.0.1, which removes the entire clustering feature.
Remote code execution in Balbooa Forms prior to version 2.4.3 allows unauthenticated attackers to execute arbitrary PHP code on the Joomla server. Exploitation requires forms that include the signature field type, where insecure processing logic can be triggered via a crafted submission. No public exploit or active exploitation has been identified at the time of analysis.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenticated network attackers to execute arbitrary code when the collectiveController-1.0 feature is enabled. Rooted in a missing-authentication weakness (CWE-306) on collective controller management functions, the flaw carries a 9.8 CVSS score and total technical impact per CISA's SSVC framework. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the network-reachable, unauthenticated nature makes it a high-priority patch where the collective feature is in use.
Heap buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls the audio stream host or URL corrupt memory on the ESP32 microcontroller. The dismantle_host() parser feeds attacker-supplied host, request-host, extension, and query-string segments into clone_from(), which copies them into fixed-size heap buffers without length checks, enabling potential remote code execution or device crash. Rated CVSS 9.8 with SSVC marking technical impact as total and exploitation as automatable, though EPSS is only 0.18% and there is no public exploit identified at time of analysis.
Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote attackers to execute arbitrary code, disclose information, crash the service, or escalate privileges by sending a malicious URL with an oversized path and query string to the vulnerable urlencode function. No active exploitation has been confirmed by CISA KEV, and no EPSS score is available at this time.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to fully compromise a device by sending a malicious MP3 file or stream. The flaw lies in the MP3Decoder::UnpackSFMPEG1 function, which lacks input validation on attacker-controlled MP3 metadata, triggering a classic buffer overflow (CWE-120). A publicly available proof-of-concept exists, although no active exploitation has been confirmed via CISA KEV.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to overflow a heap buffer via crafted HTTP request headers. Public exploit code is available, enabling arbitrary code execution on vulnerable ESP32 devices. No official patch has been released.
A heap-based buffer overflow in ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to crash or potentially execute arbitrary code on vulnerable ESP32 devices. The flaw exists in the Audio::openai_speech function, which manually constructs JSON/HTTP payloads by concatenating user input without length checks. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in schreibfaul1 ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to corrupt PSRAM memory, leading to denial of service and potential arbitrary code execution. An unchecked unsigned integer overflow when allocating a buffer for audio processing results in an undersized allocation; subsequent read/write operations overrun the heap. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote code execution, information disclosure, denial of service, or privilege escalation when processing a malicious WAV file. The flaw resides in the read_WAV_Header() function due to lack of bounds checking on chunk size and bytes-to-skip values, enabling heap corruption. A public proof-of-concept exists (CISA SSVC 'poc'), but no active exploitation has been confirmed in CISA KEV.
Unauthenticated read and write access to sensitive filesystem areas in SICK AppEngine's file access feature allows remote attackers to extract customer-defined passwords, modify application settings, and execute arbitrary Lua code within the sandboxed environment. The vulnerability stems from improper access restrictions on an HTTP-based file access endpoint, which exposes a critical directory without requiring credentials. At the time of analysis, no public exploit or active exploitation (KEV) has been confirmed, but the CVSS 9.4 score reflects the ease of exploitation and high impact.
SQL injection in the Giving Reports functionality of Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases. All versions of both products are affected; the class credit field is the injection point. A detailed technical write-up with exploit details is publicly available, though no active exploitation has been reported through CISA KEV.
Remote heap buffer overflow in the ESP32-audioI2S library 3.4.5 allows unauthenticated attackers to corrupt heap memory, potentially leading to arbitrary code execution or denial of service on affected ESP32 devices. The flaw arises from an unsafe memcpy in AudioBuffer::writeSpace() that copies a full UINT16_MAX bytes without validating the destination buffer size. A public proof-of-concept exists, elevating the urgency for IoT devices using this library.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.