Cross-site scripting in Pivotick via the per-node style.svgIcon property allows an attacker who can influence graph data to execute arbitrary JavaScript in the context of the embedding application. Affects Pivotick versions up to 1.4.0. No active exploitation or public exploit reported at time of analysis, but the CVSS 4.0 base score is 8.2.
Uncontrolled recursion in Pivotick's graph traversal and JSON viewer allows remote attackers to crash the user's browser tab by supplying crafted graph data with long paths, deep nesting, or circular references. No confidentiality or integrity impact exists - only client-side denial of service. A patch replaces recursive algorithms with iterative implementations and adds depth/cycle guards.
Silent traffic redirection in Appium Java Client 8.2.1 to 10.1.0 allows an unauthenticated rogue Appium server to redirect all session commands to an attacker-controlled endpoint when directConnect is enabled. The client does not validate the destination host, enabling network pivoting and credential theft. Publicly available exploit code exists, and a vendor-released patch (version 10.1.1) is available.
Improper session expiration in IBM Aspera Faspex 5 allows remote unauthenticated attackers to access sensitive data. The vulnerability, tracked as CVE-2026-14996, affects versions 5.0.0 through 5.0.15.4 and stems from insufficient session invalidation (CWE-613). Attackers who obtain a valid session token can reuse it after the intended lifetime, compromising confidentiality of file transfer data with limited integrity impact.
Server-side request forgery in the `datamodel-code-generator` Python package (versions >= 0.9.1 and <= 0.60.2) allows an attacker who controls or influences a `--url` schema source to make the codegen host fetch arbitrary internal addresses - loopback, RFC1918, link-local `169.254.169.254` cloud metadata, and unique-local IPv6 - and have the response body reflected into the generated `.py` file as schema titles, property names, and `Field(description=...)` strings. The issue only affects installations that include the optional `[http]` extra; the fetcher applies no allow-list or IP/host validation and follows redirects unconditionally, with `text/html` rejection as its only filter, so non-HTML JSON/YAML endpoints (IAM credential metadata, internal admin APIs) pass through and leak into artifacts commonly committed to repositories or surfaced in CI output. Publicly available exploit code exists (a self-contained one-file PoC), but the flaw is not confirmed actively exploited (not in CISA KEV); EPSS is low at 0.21% (11th percentile), and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2) reflects high confidentiality impact tempered by required victim interaction and AC:H.
Arbitrary code execution in Adobe Bridge 16.x (through 16.0.5) and 15.x (through 15.1.6) stems from an untrusted search path (CWE-426): when a victim opens a crafted file, Bridge resolves and loads a library from a location an attacker can control, executing code under the victim's own account. The vendor's CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (8.2), while our independent assessment scores the same 8.2 band with PR:N and S:U, underscoring that the attack is strictly local, requires mandatory user interaction, and is bounded by the current user's privilege level rather than SYSTEM or root. Exploitation pressure is currently low: there is no public exploit identified at time of analysis, the issue is not in CISA KEV, CISA's SSVC decision framework rates Exploitation 'none' and Automatable 'no', and EPSS is only 0.15% (5th percentile).
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Denial of service and information disclosure in NVIDIA DCGM Exporter allows remote unauthenticated attackers to consume server resources and potentially read runtime profiling data. The vulnerability resides in the /debug/pprof endpoints, which lack resource limits, enabling concurrent profiling requests to exhaust CPU and memory. No active exploitation has been observed, but the attack vector is network-accessible without credentials, earning a CVSS 8.2 score.
Privilege escalation in Pterodactyl Wings allows authenticated subusers to upload arbitrary files without the required file.create permission by reusing lower-privilege panel-signed JWTs (e.g., from websocket authentication or file downloads). A public proof-of-concept demonstrates how a subuser with only websocket.connect can upload files to the server, potentially compromising its container. Patches introduce JWT scoping in Panel 1.12.3 and Wings 1.12.2.
Password overwrite and administrative unavailability on an unspecified
SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify, or delete database contents. Affects versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation (KEV) known at time of analysis.
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.
Open redirect in MISP installation scripts allows unauthenticated remote attackers to craft malicious URLs that leverage a missing trailing slash in the Apache HTTP-to-HTTPS redirect directive. When a user follows a crafted link on the legitimate MISP domain, the redirect appends attacker-controlled path content directly to the hostname, causing the browser to interpret the attacker’s domain as the destination host. This can lead to phishing and credential collection, though no active exploitation has been identified and a vendor patch is available.
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Opening a malicious file in Adobe Format Plugins can trigger a heap-based buffer overflow, allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported at this time.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code in generated model files, leading to arbitrary command execution when the module is imported. Affected versions 0.51.0 through 0.60.1 lack proper validation of the `x-python-type` extension, making the attack possible with default tool settings. No public exploit is identified at time of analysis, but the vulnerability is patched in version 0.60.2.
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL schema to execute arbitrary Python code when a developer generates and imports the resulting model. The flaw exists because carriage return (\r) characters in Union type descriptions are not neutralized before being placed inside Python line comments, letting the rest of the description escape the comment and run as module‑level code upon import. A fix is available in version 0.60.1; no active exploitation is reported, and no public exploit is known.
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, references, GHSA advisory with detailed description, PoC, patch commit details, CPE. Need to produce JSON fields as instructed. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Let's extract key info: - Product: "datamodel-code-generator" (pip package, from koxudaxi). Product name should be 1-3 words: "datamodel-code-generator". - Description: Code injection via unescaped carriage return in `--extra-template-data` comment field, fixed in 0.60.2. - CVSS: 7.8, vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE-94: Code Injection. - Tags: Python, RCE, Code Injection, Datamodel Code Generator. - KEV: not mentioned, assume not in KEV. POC: mentioned in advisory (secret gist). But we can't confirm if it's public or private secret gist; the advisory says "Complete self contained POC is available at my secret gist", so the reporter likely privately shared with maintainers? Or the link is there? Since the GHSA description says "PoC available at my secret gist: https://...", but the URL is there. It's a public gist? Might be public. But we don't have explicit POC=YES flag. The tags don't say POC available. Advisory text includes PoC section but the URL is given. Could be public. We'll treat as "publicly available exploit code exists" since the gist URL is embedded in the advisory and likely accessible to anyone who reads it. However, we must be careful: the description says "Complete self contained POC is available at my secret gist" - "secret" might indicate private. But it's in a public security advisory, so it's exposed. It's not a standard public POC, but I'll note it as possible public POC. The instructions say: if POC=YES but no
Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.
A local time-of-check/time-of-use (TOCTOU) race in the Xen hypervisor's grant-table copy handling lets a provisioned guest domain subvert the permission check that is supposed to gate a grant-copy operation, so the check can be performed against one guest frame while the actual copy targets a different frame. Only guests able to issue GNTTABOP_copy operations - a standard capability for PV/HVM guests doing grant-based I/O - are affected, and the attacker must win a narrow timing window in which the referenced grant is simultaneously pinned by another mapping or copy (reflected in the CVSS AC:H rating); it is not remotely reachable and requires guest-level privilege. Given the local attack vector, the required race, and an EPSS score of 0.10% (1st percentile), this is a genuine hypervisor-level confidentiality and integrity flaw but not an urgent widespread-exploitation priority; no public exploit has been identified at time of analysis and CISA SSVC records exploitation as 'none'.
We are tasked with producing a comprehensive JSON analysis for CVE-2026-51273. We have multiple intelligence sources: mitre (CVE description, CVSS, CWE, references), tags, SSVC, ENISA EUVD. The input provides the CVE ID, description, CVSS score, vector, CWE, and multi-source intel including CPE, references, tags, SSVC, and EUVD data. We must synthesize all this into a JSON object with the specified fields, each a plain text string. First, let's parse all the given data: - CVE ID: CVE-2026-51273 - Description: "In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file." - CVSS Score: 7.8 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-122 (Heap-based Buffer Overflow) - Reported by mitre. - CPE (affected products): cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (this is a placeholder; the real product is schreibfaul1 ESP32-audioI2S, but CPE string is given as "n/a:n/a"). So product is "ESP32-audioI2S" by schreibfaul1. But the CPE doesn't provide a proper string; we'll note that in confidence_notes. - Tags: RCE, Buffer Overflow, N A, Heap Overflow - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. So a proof-of-concept exists, but exploitation is not automatable. - ENISA EUVD: EUVD-2026-49928, affected versions: ["n/a n/a"] (again placeholder). So no specific version range from EUVD, but description says version 3.4.5 is affected. - References: 1. (None) https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp (source code link) 2. (None) https://github.com
An integer underflow in the MP3 decoder of ESP32-audioI2S v3.4.5 allows potential arbitrary code execution via a specially crafted MP3 file. The vulnerability, caused by unchecked bit reading operations in the MP3Decoder::GetBits() function, can lead to invalid bit manipulation, application crash, or code execution. Exploitation requires a user to open a malicious MP
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Arbitrary command execution as root via udev property injection in sg3_utils when sg_inq --export parses a SCSI device with a crafted name string. Affects multiple Red Hat Enterprise Linux versions shipping sg3_utils. Publicly available exploit code exists as a proof-of-concept in the upstream fix; no active exploitation has been reported.
Remote denial-of-service in the SIPSorcery NuGet library (≤10.0.8) allows an unauthenticated attacker to terminate an active RTP or WebRTC media session by sending a single malformed UDP packet to the RTP/ICE socket. The flaw combines insufficient length checks on inbound packets with a catch-all exception handler that closes the entire channel instead of dropping the offending packet, causing immediate session teardown. There is no confidentiality or integrity impact, and a vendor‑released patch is available in version 10.0.9.
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
Unauthenticated SQL injection in the TrueBooker WordPress plugin allows remote attackers to extract sensitive database information. The vulnerability resides in the 'alldata[truebooker_user]' parameter and affects versions up to and including 1.2.2. Although a nonce is used, it is exposed on front-end booking pages, enabling unauthenticated exploitation if the required booking fields are present.
Authentication denial of service in Pterodactyl Panel 1.7.0–1.12.4 allows an unauthenticated remote attacker to lock out all users from login and two-factor authentication by exhausting a single shared rate-limit bucket with approximately 10 requests per minute. The attacker can sustain the lockout indefinitely, preventing legitimate access including administrative login. A proof-of-concept is publicly available, though no active exploitation has been reported via CISA KEV.
Denial of service in GitHub MCP Server versions below 1.1.0 allows any unauthenticated attacker to crash the server by sending a malformed completion/complete JSON-RPC request with missing parameters. The nil pointer dereference occurs before authentication checks, making exploitation trivial. Publicly available exploit code exists, enabling immediate termination of the process.
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows unauthenticated attackers who control an input XML Schema to read any file readable by the generator process, with the contents reflected into generated models. A public proof-of-concept exploit exists, and the issue is fixed in version 0.62.0.
Information disclosure in IBM WebSphere Liberty ND Collective Controller, versions 17.0.0.3 through 26.0.0.8, allows remote unauthenticated attackers to read arbitrary files via path-segment injection in the collective routing mechanism. Successful exploitation exposes sensitive configuration data without user interaction or authentication. No public exploit or active exploitation (CISA KEV) has been reported at this time.
We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field. First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory. Now we need to fill fields. product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes. summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h
Unauthenticated SQL injection in the WordPress Premium Packages - Sell Digital Products Securely plugin (wpdm-premium-packages) allows any remote attacker to extract sensitive data from the website’s database. The vulnerability exists in the coupon processing REST API endpoint and stems from user input being directly interpolated into a raw SQL query without any sanitization or prepared statements.
Remote unauthenticated SQL injection in the WordPress WP Fast Total Search plugin up to version 1.80.280 allows attackers to extract sensitive database information via the 'form_data[s]' parameter. The flaw requires no authentication or user interaction, making it easily exploitable over the network. No public exploit code or active exploitation has been confirmed at this time.
Unauthenticated SQL injection in the Bookly WordPress plugin permits remote extraction of database content. Attackers leverage a two-step chain—first carrying a malicious staff_ids parameter via a session-seeding AJAX call, then triggering the vulnerable query through a second endpoint—to append time-based blind SQL payloads. No public exploit code is known, but the full attack path is documented by Wordfence.
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when the generated model is imported. Affects versions from 0.11.6 to 0.63.0. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Denial of service in IBM WebSphere Application Server 9.0, 8.5 and Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to consume server resources via malicious HTTP requests exploiting unbounded resource allocation. This can render the service unavailable. No active exploitation or public exploit has been identified.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.
Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.
Sensitive information disclosure in IBM Cloud Pak System 2.3.5.0 allows local attackers to obtain credentials from log files. The CVSS score is 7.5 with a network vector, but the description explicitly states local access, creating ambiguity. No public exploit or active exploitation has been identified at the time of analysis.
Joomdle component for Joomla versions below 3.1.1 ships with an insecure default configuration that allows unauthenticated remote attackers to read CMS user account details and perform password resets, effectively enabling account takeover. The flaw is confirmed by the Joomla security team and tracked in ENISA EUVD, though no indicators of active exploitation are present at this time.
A divide-by-zero vulnerability in Xen's Viridian periodic STIMER handling allows an attacker with guest VM access to crash the hypervisor, causing denial of service. The issue arises from an unchecked user-controlled divisor that can be set to zero, triggering a #DE fault. No active exploitation is known per SSVC, though the attack is automatable and requires no guest-level privileges.
Information disclosure in Xen hypervisor's CMOS emulation allows a guest VM to exploit a race condition in the index caching mechanism, leading to an out-of-bounds read of hypervisor memory. A malicious guest can repeatedly manipulate the CMOS index port while the hypervisor processes an access, potentially leaking sensitive data from the host or other VMs. No active exploitation or public exploit code is known at this time.
Denial of service in Xen hypervisor running PV guests without hardware-assisted paging (HAP) or shim allows a malicious guest or remote attacker to monopolize CPU via long-running shadow paging operations, impacting host availability. This issue has been deprecated rather than patched, as modern alternatives (HAP, PVH, shim) eliminate
Information disclosure in the Uncanny Automator WordPress plugin up to version 7.3.2 allows authenticated subscribers to enumerate Google Contact labels and Mautic segments, tags, and contact fields via missing capability checks and nonce verification in AJAX handlers. This enables low-privileged users to access data retrieved through administrator-configured integration credentials and potentially exhaust third‑party API quotas. No public exploit or active exploitation is known at this time.
SQL injection in the Web Directory Free WordPress plugin up to version 1.7.13 allows unauthenticated attackers to extract sensitive database information via the 'levels' parameter. The vulnerability has a high CVSS score of 7.5, but no active exploitation (CISA KEV) or public proof-of-concept has been identified at this time.
SQL injection in PickPlugins Question Answer for WordPress up to 1.2.73 permits unauthenticated remote attackers to extract sensitive database information via the unsanitized 'id' GET parameter. The vulnerability is automatable, requires no user interaction, and exposes confidential data. No public exploit code or active exploitation is known at this time, but the high CVSS score and low attack complexity warrant prompt attention.