SQL injection in @hypequery/clickhouse before version 2.0.2 allows unauthenticated remote attackers to inject arbitrary SQL commands through a trailing backslash in a query parameter. All users passing user-controlled input are affected, and the vulnerability can lead to full disclosure, modification, or destruction of the database. A vendor patch is available, and there is no evidence of active exploitation in the wild.
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
An incomplete fix for CVE-2026-40884 in goshs v2.1.3 allows unauthenticated attackers to bypass SFTP authentication and gain full file read, write, and delete access when the server is started with `-b 'user:' -sftp` and without the `-fkf` flag. Publicly available exploit code exists, and the root cause is a logic flaw in the password handler registration that was not fully addressed in the prior patch.
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. The `MOVE` handler incorrectly treats the verb as write-only without checking the delete restriction, permitting remote attackers using WebDAV clients to bypass the `--no-delete` boundary via a `MOVE` request with `Overwrite: T`. A public proof-of-concept exists, and the vendor has patched this in version 2.1.4.
Unauthenticated remote code execution in 3DEXPERIENCE Station Launcher App from Release R2023x through R2026x allows attackers to execute arbitrary commands on affected systems without any authentication. The flaw stems from deserialization of untrusted data (CWE-502) and carries a maximum CVSS 10.0 score. No active exploitation or public exploit code is reported at time of analysis, though the network‑accessible attack surface presents significant risk.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on behalf of other users. The vulnerability affects versions prior to 1.1.0 when the server is run in streamable-HTTP stateless transport mode. No public exploit code is known, but the critical CVSS score and network attack vector indicate high potential risk.
Remote code execution in Apache Axis2/Java through 2.0.0 arises from unsafe deserialization of Java objects in the optional Tribes clustering component, allowing unauthenticated remote attackers with network access to the clustering port to execute arbitrary code via crafted serialized payloads. The vulnerability is only exploitable when clustering is explicitly enabled, which is off by default. No active exploitation or public exploit code has been observed; the issue is resolved by upgrading to version 2.0.1, which removes the entire clustering feature.
Remote code execution in Balbooa Forms prior to version 2.4.3 allows unauthenticated attackers to execute arbitrary PHP code on the Joomla server. Exploitation requires forms that include the signature field type, where insecure processing logic can be triggered via a crafted submission. No public exploit or active exploitation has been identified at the time of analysis.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenticated network attackers to execute arbitrary code when the collectiveController-1.0 feature is enabled. Rooted in a missing-authentication weakness (CWE-306) on collective controller management functions, the flaw carries a 9.8 CVSS score and total technical impact per CISA's SSVC framework. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the network-reachable, unauthenticated nature makes it a high-priority patch where the collective feature is in use.
Heap buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls the audio stream host or URL corrupt memory on the ESP32 microcontroller. The dismantle_host() parser feeds attacker-supplied host, request-host, extension, and query-string segments into clone_from(), which copies them into fixed-size heap buffers without length checks, enabling potential remote code execution or device crash. Rated CVSS 9.8 with SSVC marking technical impact as total and exploitation as automatable, though EPSS is only 0.18% and there is no public exploit identified at time of analysis.
Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote attackers to execute arbitrary code, disclose information, crash the service, or escalate privileges by sending a malicious URL with an oversized path and query string to the vulnerable urlencode function. No active exploitation has been confirmed by CISA KEV, and no EPSS score is available at this time.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to overflow a heap buffer via crafted HTTP request headers. Public exploit code is available, enabling arbitrary code execution on vulnerable ESP32 devices. No official patch has been released.
A heap-based buffer overflow in ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to crash or potentially execute arbitrary code on vulnerable ESP32 devices. The flaw exists in the Audio::openai_speech function, which manually constructs JSON/HTTP payloads by concatenating user input without length checks. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in schreibfaul1 ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to corrupt PSRAM memory, leading to denial of service and potential arbitrary code execution. An unchecked unsigned integer overflow when allocating a buffer for audio processing results in an undersized allocation; subsequent read/write operations overrun the heap. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to fully compromise a device by sending a malicious MP3 file or stream. The flaw lies in the MP3Decoder::UnpackSFMPEG1 function, which lacks input validation on attacker-controlled MP3 metadata, triggering a classic buffer overflow (CWE-120). A publicly available proof-of-concept exists, although no active exploitation has been confirmed via CISA KEV.
Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote code execution, information disclosure, denial of service, or privilege escalation when processing a malicious WAV file. The flaw resides in the read_WAV_Header() function due to lack of bounds checking on chunk size and bytes-to-skip values, enabling heap corruption. A public proof-of-concept exists (CISA SSVC 'poc'), but no active exploitation has been confirmed in CISA KEV.
Unauthenticated read and write access to sensitive filesystem areas in SICK AppEngine's file access feature allows remote attackers to extract customer-defined passwords, modify application settings, and execute arbitrary Lua code within the sandboxed environment. The vulnerability stems from improper access restrictions on an HTTP-based file access endpoint, which exposes a critical directory without requiring credentials. At the time of analysis, no public exploit or active exploitation (KEV) has been confirmed, but the CVSS 9.4 score reflects the ease of exploitation and high impact.
SQL injection in the Giving Reports functionality of Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases. All versions of both products are affected; the class credit field is the injection point. A detailed technical write-up with exploit details is publicly available, though no active exploitation has been reported through CISA KEV.
Remote heap buffer overflow in the ESP32-audioI2S library 3.4.5 allows unauthenticated attackers to corrupt heap memory, potentially leading to arbitrary code execution or denial of service on affected ESP32 devices. The flaw arises from an unsafe memcpy in AudioBuffer::writeSpace() that copies a full UINT16_MAX bytes without validating the destination buffer size. A public proof-of-concept exists, elevating the urgency for IoT devices using this library.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.
SQL injection in PROCON-WEB SCADA's GetGridData endpoint allows remote unauthenticated attackers to execute arbitrary SQL commands, compromising the SCADA system's confidentiality, integrity, and availability. No evidence of active exploitation or public exploit code was found at time of analysis, but the vulnerability's network-accessible, low-complexity nature makes exploitation trivial once exposed.
We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON object with specific fields. We must use all provided data, cross-reference, and produce original synthesis. Every field must be a plain text string, not arrays or objects. Let's extract the relevant information: - CVE ID: CVE-2026-67174 - Description: DOM-based XSS in Pivotick's generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement` function treated resolved strings as HTML markup via `innerHTML`, allowing untrusted data to inject arbitrary HTML/SVG. Used by headers, property panels, extra panels, tooltips. `createIcon` inserted unsanitized `svgIcon` markup. Attack vector: unauthenticated attacker can provide crafted graph, property value, rendering result, or SVG icon to execute JS in another user's browser when content is displayed/interacted with. Impact: access victim's info, manipulate graph data/state, perform actions with victim's privileges. - CVSS Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N). Note: It says UI:N but description involves user interaction (displayed/interacted with). CVSS 4.0 has UI:N meaning no user interaction? Actually in CVSS 4.0, UI (User Interaction) measures whether the vulnerability can be exploited solely at the initiative of the attacker, or whether a separate user must perform some action. Here UI:N suggests exploitation requires no user interaction beyond the attacker sending a malicious payload and the victim simply viewing the page. However, the description says "when the affected content is displayed or interacted with" — this could be interpreted as the victim viewing the page, which is passive and counts as UI:N in CVSS 3.1 (R) but in CVSS 4.0 UI:N is for no user interaction at all? I need to check: In CVSS 4.0, UI:N means the vulnerability can be exploited without any action from any user other than the attacker. If the victim just views a p
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.