Authenticated remote code execution in Camaleon CMS 2.1.1 through 2.9.1 lets users who hold the custom_fields manage permission store an arbitrary Ruby expression in the 'command' option of a select_eval custom field, which is then evaluated via instance_eval inside an ERB view whenever a post edit page is rendered, yielding code execution with web-server process privileges. Publicly available exploit code exists (including a public proof-of-concept repository and writeup), but the flaw is not listed in CISA KEV and EPSS is modest at 0.74% (51st percentile), so practical risk concentrates on installations that delegate custom-field management to non-administrative roles. The vulnerability requires an authenticated principal with that permission (CVSS vector PR:L), and is not reachable by anonymous users.
Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server's filesystem by injecting ../ sequences into the URL path, which are concatenated without normalization in HttpBuilder::buildResponse(). Publicly available exploit code exists, yet no active exploitation is recorded in CISA KEV; the risk is elevated when the server runs as root, exposing credential stores and private keys.
Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause denial of service by sending ordinary HTTP requests. A memory leak in the request parser allocates objects without freeing them, consuming approximately 20–28 kB per request until the worker process is killed. Publicly available exploit code exists, but no active exploitation has been confirmed via CISA KEV.
Remote file disclosure in openhole-server v0.1.1 and earlier allows unauthenticated attackers to read arbitrary files from tunneled local services. The server forwards URL-decoded request paths, causing percent-encoded dot-segments (%2e%2e) and slashes to be decoded into path traversal sequences (../) before reaching the backend. Exploitation requires a tunneled local service that resolves paths without canonicalization, and the vulnerability is fixed in v0.1.2 by preserving raw percent-encoding.
Bearer token leak in the OAuth2 Ruby gem (ruby-oauth/oauth2) versions 0.4.0 through 2.0.
QTI Neon's relay service amplifies RECONNECT_REQUEST packets to the host, enabling unauthenticated attackers to cause denial of service on the host. The vulnerable handleReconnectRequest function in all three implementations (Java, Python, TypeScript) forward every request without bounding or deduplication, bypassing per-source rate limiting via spoofed IPs. No public exploit or KEV listing exists, but the attack is trivial to execute if a valid session ID is known.
Server-side request forgery in datamodel-code-generator 0.9.1 through 0.60.x lets a malicious JSON Schema, OpenAPI, or GraphQL document cause the code generator to silently fetch attacker-chosen HTTP/HTTPS $ref URLs - including internal, loopback, and link-local addresses - and reflect the fetched content into the generated Python source. Exploitation requires the optional HTTP extra (pip install 'datamodel-code-generator[http]') and a developer or automated codegen/CI job to run datamodel-codegen against the tainted document; the default configuration (--allow-remote-refs unset) only emits a deprecation warning before fetching, and only an explicit --allow-remote-refs=false blocks the request. Publicly available exploit code exists (a Gist proof-of-concept), and EPSS is low at 0.21% (11th percentile), with no confirmed active exploitation (not in CISA KEV); fixed in 0.61.0.
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitrary Python code execution when a generated Pydantic v2 model is imported. Affects versions 0.52.1 through 0.60.1, with a fix in 0.60.2. Publicly available exploit code exists, though no active exploitation has been reported to CISA KEV.
Authentication bypass in pytonapi 2.2.0 allows unauthenticated remote attackers to trigger webhook handlers when a custom path is configured via the documented `path=` argument. The TonapiWebhookDispatcher fails to store bearer tokens for custom paths, causing the token check to be skipped entirely. Publicly available exploit code exists but no active exploitation in the wild has been confirmed.
Arbitrary local file read in datamodel-code-generator before 0.62.0 lets unauthenticated attackers who control or can submit a JSON-Schema/OpenAPI input exfiltrate any file readable by the codegen process, because JSON-Schema $ref targets using a file:// URI or a ../ traversal are resolved without containment and even bypass the documented --no-allow-remote-refs control. Exploitation requires the tool to be run against an attacker-supplied schema (for example a hosted 'paste your schema' service, a CI job generating models from submitted specs, or a multi-tenant codegen platform); a local developer running the CLI only on their own schemas has no untrusted-input path and is not remotely triggerable. Publicly available exploit code exists (a public gist, tracked by SSVC as Exploitation: PoC and Automatable: yes), but the issue is not in CISA KEV and EPSS is low at 0.36% (29th percentile), so mass exploitation has not been observed.
Remote denial of service in gotd/td versions before 0.145.1 allows unauthenticated attackers to exhaust memory and CPU by sending a crafted MTProto unencrypted packet with a maliciously inflated dataLen field, causing excessive allocation before length validation. No authentication or session is required, and the vulnerability is reachable during the handshake phase. There is no evidence of active exploitation and no public exploit has been identified.
An authorization bypass in goshs’s bulk zip-download route allows unauthenticated attackers to read any file protected solely by a per-folder .goshs ACL, circumventing both folder-based authentication and per-file block lists. The vulnerability affects goshs v2.x up to 2.1.0 and all v1.x versions. A proof-of-concept is publicly available, demonstrating the bypass against a patched version that had addressed a related ACL gap on write/delete routes but left the read path unprotected.
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the default `allow_private_network=False` restriction and reach internal services. The vulnerability affects versions prior to 0.63.0, where a time-of-check/time-of-use gap between URL validation and connection enables rebinding to private IPs. A public proof-of-concept exists, though no active exploitation in the wild is reported at this time.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Denial-of-service in Xen's Xenstore component allows unprivileged guest domains to crash the host by triggering a bitmap teardown in an error path of the XEN_DOMCTL_get_domain_state operation. Exploit code is publicly available, though no active exploitation is confirmed. The attack is automatable, requiring no user interaction or guest authentication.
Reflected cross-site scripting in the WordPress plugin 'Database for Contact Form 7, WPForms, Elementor Forms' (Database for CF7) before version 1.5.3 allows an unauthenticated remote attacker to inject script into an administrative page via a request parameter that is echoed back without sanitisation or escaping. Exploitation is not automatic: the attacker must deliver a crafted URL and a logged-in WordPress administrator must click it, but because the CVSS vector assigns S:C the script executes in the admin's privileged context, enabling session abuse, malicious admin-side actions, or further compromise of the site. Publicly available exploit code exists and the vendor has released version 1.5.3 as the fix; EPSS is low at 0.15% (5th percentile), SSVC rates the issue as POC-based but non-automatable with partial technical impact, and it is not confirmed as actively exploited (not listed in CISA KEV).
Brute-force vulnerability in MikroTik RouterOS allows adjacent network attackers to gain full administrative access by repeatedly guessing API credentials without effective lockout or rate-limiting. The absence of source-based restrictions and the ability to bypass a weak per-connection delay through concurrent sessions make high-volume password attacks practical. Successful exploitation grants complete control over the device, compromising confidentiality, integrity, and availability.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value to inject arbitrary Python expressions into generated models, achieving remote code execution when the target imports the poisoned module. The vulnerability affects all supported input types (JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, XSD) and output model types (Pydantic v2, dataclass, msgspec). Public exploit code exists; the issue is fixed in version 0.60.2.
Directory traversal during archive extraction in zip-lib (npm) before 1.1.0 lets an attacker-crafted zip archive write files outside the intended destination folder. The root cause is the library's cached path validation: isOutsideTargetFolder only evaluates and caches a path's status when the first directory symlink is created during extraction, so subsequent archive entries that resolve through that symlink bypass the "outside target folder" check (CWE-22). The realistic impact is arbitrary file write / integrity loss rather than data disclosure, consistent with the fix commit that adds a symlinkFolders tracking list and a regression test named unzipArbitraryFileWrite. Exploitation requires the consuming application to extract an attacker-supplied archive with an affected version; there is no authentication or user-interaction gate beyond the extraction itself (PR:N/UI:N). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.78% (52nd percentile), and the vendor fix is publicly available in 1.1.0.
Missing authorization in the insert path of an unspecified product's configuration table enables a low-privileged remote attacker to gain administrator privileges, leading to full system access. The specific affected product and version are not disclosed in the limited advisory information; no data on active exploitation or patch availability is provided.
Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.
Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.
Unauthenticated configuration manipulation and information disclosure in Arris BGW210‑700 gateways running firmware 2.7.7 and earlier arises because the server fails to enforce authentication on /cgi-bin/*.ha management endpoints, relying only on client‑side JavaScript gating. Any LAN‑adjacent attacker can read sensitive configuration data, modify persistent device settings, or invoke diagnostic operations. No active exploitation or public proof‑of‑concept is known, but the missing server‑side checks make exploitation trivial once network adjacency is gained.
Unfair, non-queued acquisition of Xen's system-wide sysctl operation lock lets a domain with hypercall access starve competing management sysctl operations, potentially blocking administrative control-plane work on the hypervisor. The realistic exposure is narrow: in a default configuration only the trusted control domain (dom0) can issue these hypercalls, and the meaningful risk appears when XSM/Flask is enabled and some sysctl operations are delegated to a less-privileged domain, where the lock is taken before the XSM permission check. Independent assessment rates this as availability-only with local, low-privilege prerequisites (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), which is materially lower than NVD's 8.8 high/high/high vector; EPSS is low at 0.23% (14th percentile), SSVC reports no exploitation and no automatable exploitation, and no public exploit has been identified at time of analysis. A companion issue for platform operations with the same lock-ordering defect is tracked separately as CVE-2026-62427.
Missing authentication in Universal Software Inc. UKBS through version 28072026 allows adjacent network attackers to access restricted critical functionality without credentials, resulting in complete compromise of confidentiality, integrity, and availability. The vendor has confirmed the product is no longer supported, leaving all installations permanently vulnerable. No active exploitation or public exploit code has been reported.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
Authenticated OS command injection in ELECOM WAB series routers and access points allows authenticated attackers to execute arbitrary OS commands via the Restore Settings function. Full device compromise is possible, but no active exploitation or public exploit code is known at this time. The vulnerability is rated high severity (CVSS 8.6) but requires administrative credentials to exploit.
Authenticated OS command injection in ELECOM wireless LAN routers and access points allows an attacker with administrative credentials to execute arbitrary operating system commands on the device. Exploitation requires logging into the product's WebUI; no public exploit or active exploitation has been reported at this time. The vulnerability is confirmed by the vendor and JPCERT/CC, with a CVSS 4.0 score of 8.6 (High).
Privilege escalation in Xen hypervisor due to lock acquisition unfairness in platform operations allows authenticated control-domain users to bypass XSM/Flask permission checks. An attacker with low-privileged authenticated access can exploit the race condition to execute privileged operations, potentially gaining full control of the system. The vulnerability carries a CVSS 8.8 rating but has no known active exploitation or public exploit code.
We are tasked with synthesizing data about CVE-2026-14328 into a comprehensive analysis. The user provided a description, CVSS, CWE, tags, references, and multi-source intelligence note. Our output must be a JSON object with specific fields. Let's go step by step. First, I need to extract product name. The CVE is about "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress". That's a complex name. The product_name should be 1-3 words, specific. The plugin is called "Eazy Plugin Manager" (maybe the slug is "plugins-on-steroids"? from references, the plugin folder is "plugins-on-steroids", but the description says "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress". So the product is the Eazy Plugin Manager WordPress plugin. I'll use "Eazy Plugin Manager" as the product name. Confirm: references show paths like "plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/...", so the plugin slug is "plugins-on-steroids" but the marketed name is "Eazy Plugin Manager". For product_name, use "Eazy Plugin Manager" (or "Eazy Plugin Manager for WordPress"? The requirement says 1-3 words, so likely "Eazy Plugin Manager". I'll use "Eazy Plugin Manager". Summary: Must not copy description, but original synthesis. Include impact, affected product, attacker capabilities. Mention if actively exploited, POC, EPSS. Input doesn't have KEV status or EPSS score explicitly. The user didn't provide EPSS or KEV. The description says "authenticated attackers, with Subscriber-level access and above". That's PR:L per CVSS vector (PR:L). So it requires a low-privileged user. No mention of exploitation in the wild, no KEV. POC? Not explicitly, but maybe from Wordfence advisory they might have details. The references are code links and the Wordfence threat intel page. I can't assume POC exists unless stated. The input just says "Tags: WordPress, Privilege Escalation". So I'll state "no public exploit identified at time of ana
Heap-based buffer overflow in ESP32-audioI2S 3.4.5’s ID3v2 APIC frame parser lets remote attackers execute arbitrary code or crash vulnerable devices by supplying a crafted MP3 file. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in the connecttospeech() function of schreibfaul1 ESP32-audioI2S version 3.4.5 allows remote attackers to achieve arbitrary code execution by supplying an overly long speech text string. The flaw arises because the library performs URL encoding of attacker-controlled input and appends it to a fixed-size heap buffer without length validation, leading to a heap overflow. A public proof-of-concept exploit is available, but active exploitation has not been confirmed.
Heap-based buffer overflow in ESP32-audioI2S 3.4.5 allows remote attackers to cause denial of service, information disclosure, or arbitrary code execution via a crafted MP3 file. Public exploit code is available but no active exploitation is confirmed.
SuperPlane before 0.27.0 allows authenticated viewers to bypass organization scoping via the CanvasService gRPC handler, accessing and manipulating resources across tenants without authorization. Attackers can read execution histories and event payloads containing secrets, inject queue items or canvas events, and delete canvases in other organizations. No public exploit is known and it is not reported in the CISA KEV catalog at this time.
Memory exhaustion in cowlib (from 2.0.0 up to but not including 2.19.0) lets an unauthenticated remote HTTP/2 or HTTP/3 peer drive the Erlang VM into memory exhaustion and a denial of service by supplying a header with a non-terminating HPACK or QPACK prefixed-integer continuation. The decoder in cow_hpack_common:dec_big_int/3 keeps consuming continuation octets while building ever-larger Erlang bignums, so a single maximal indexed representation carried in one HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the header-table index is rejected as invalid, with repeated or concurrent connections multiplying the pressure. Exploitation is availability-only, requires no authentication or user interaction, and is fully automatable against any default-configuration endpoint that accepts HPACK or QPACK from an untrusted peer, including Cowboy servers and the RabbitMQ management plugin; at time of analysis no public exploit code was identified and no confirmed active exploitation exists (EPSS is 0.29%, 21st percentile, and CISA SSVC records exploitation as none with partial technical impact).
Inadequate authorization
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.
Privilege escalation in Anchore Enterprise's user management API allows authenticated attackers to modify user permissions, granting write access to read-only users. Versions 5.11.0 through 5.27.1 and 6.0.0 are affected; patches are available in 5.27.2 and 6.0.1. No public exploit or active exploitation has been reported.
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
Cross-site scripting in the BlackBerry UEM Management Console lets an attacker supply malformed input that is rendered without proper neutralization, so script executes in the browser of a logged-in administrator viewing the affected console page. The injection point is reachable without authentication (CVSS vector PR:N), but the payload only fires when a privileged console user actively interacts with the crafted content (UI:A), which is why the independent assessment rates real-world risk MODERATE rather than critical despite the vendor's 8.6 CVSS 4.0 score. Affected builds are UEM 12.23.0 QF8 and earlier plus 12.22.1 QF7 and earlier; EPSS is only 0.26 percent (17th percentile), SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis.
Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.
Arbitrary code execution is possible in the Adobe Photoshop Installer through an uncontrolled search path element (CWE-427), where a malicious library planted in a directory the installer searches is loaded when the installer runs. Exploitation is local and requires user interaction - an attacker must first place a malicious library on the target system and then convince a victim to launch the installer, after which code runs in the context of that user rather than with elevated privileges. Public exploitation signals are weak: there is no confirmed active exploitation (not in CISA KEV), no public exploit identified at time of analysis, and EPSS is only 0.17% (7th percentile), although the CVSS base score of 8.6 and a 'total' technical impact rating keep it relevant for hardening. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) indicates a local, unauthenticated attack path that nonetheless depends on user initiation and a writable directory within the installer's search path.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privileges by injecting forged identity headers that upstream applications may trust. The oauth-proxy fails to strip underscore-variant headers, enabling WSGI and PHP frameworks to normalize them into the legitimate identity, potentially overriding the true authenticated user. No known active exploitation or public exploit code has been identified.
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.
Denial of service in rouille 0.1.6 through 3.6.2 allows remote unauthenticated attackers to crash the server