HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.
Unauthenticated remote attackers can extract sensitive information from the igloohome Smart Lock Mobile App source code to bypass authentication and access backend services. This affects version 3.2.3 and earlier, with a CVSS score of 5.3 (medium) and no known exploits or active exploitation.
Authenticated customers of the FluentCart WordPress plugin can manipulate other users' subscriptions by exploiting missing ownership verification in payment-method endpoints. The vulnerability affects versions before 1.4.0 and allows an attacker with low privileges to change payment methods or cancel subscriptions if they know the target subscription identifier. Publicly available exploit code exists, but EPSS probability is low (0.13%) and no active exploitation in CISA KEV has been reported.
Resource exhaustion in Ninenines Cowboy's HTTP/1.1 handler allows unauthenticated remote attackers to cause denial of service by sending many header lines with the same name, bypassing the max_headers limit due to counting distinct names instead of total lines. Affects Cowboy versions 2.0.0-pre.4 to 2.17.x; fixed in 2.18.0. No public exploit or active exploitation has been reported at this time.
Cross-site scripting in Pivotick's inspect and edit node modals allows attackers who can inject malicious node labels or descriptions into graph data to execute arbitrary JavaScript when a victim opens the affected modal. This can lead to theft of session cookies, sensitive information exposure, or unauthorized actions on behalf of the victim. The fix, available in a GitHub commit, switches from unsafe HTML interpolation to safe textContent assignment.
Memory exhaustion in Lookyloo 1.40.0 and earlier allows attackers to crash web or worker processes by submitting a crafted ZIP capture archive or gzip-compressed HAR payload that expands to an enormous size when decompressed in memory, degrading or taking the instance offline until processes are restarted. Both the full capture-archive import path and the API submission path that accepts gzip-compressed HAR data are affected, and although authentication requirements are not confirmed for every entry point, the published CVSS:4.0 vector records PR:N for the API path. The vulnerability is vendor-patched via upstream commit 96589da (a 1 GB uncompressed ceiling plus size-bounded zlib/gzip decompression), there is no CISA KEV listing, no public exploit code identified at time of analysis, and the EPSS score is a low 0.25% (17th percentile); this is a genuine but modest-priority denial-of-service issue rather than a high-urgency threat.
Privilege escalation in Quick.Cart via hard-coded, plaintext admin credentials stored in a configuration file allows local attackers with file system access to retrieve authentication details and gain administrative control. The vendor considers exploitation unlikely and has not released a fix; all versions are believed vulnerable, with version 6.7 confirmed. No public exploit or active exploitation has been reported.
Weak cryptography in CasfID NFC wristbands allows attackers with physical access to clone credentials and impersonate attendees. The wristbands use MIFARE Classic technology (FM11RF08S) vulnerable to the Backdoored Nested Attack, enabling full readout and cloning of wallet data. No active exploitation is confirmed, but the attack technique is well-documented and can lead to financial fraud at events.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.8 when the restConnector-2.0 feature is enabled, allowing authenticated remote attackers with low privileges to exhaust server resources via uncontrolled recursion (CWE-674). The attack does not require user interaction and can be conducted over the network, resulting in high availability impact and potential partial confidentiality disclosure. No public exploit or active exploitation has been confirmed at time of analysis.
SQL injection in the Taskbuilder WordPress plugin version 5.0.9 and earlier allows authenticated users with subscriber-level access or higher to extract sensitive database information via the 'wppm_proj_filter' parameter. The vulnerability stems from improper sanitization and parameterization, where user input is concatenated into a prepared statement without proper quoting. No active exploitation or public exploit code has been confirmed at the time of analysis, and the CVSS score is 6.5 (Medium).
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.
Improper access control in IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privilege users to view sensitive data restricted to privileged users. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity) and affects specific version ranges of both products. No public exploit or active exploitation has been identified, and IBM has released a patch.
SQL injection in the Plugin Organizer WordPress plugin (<=10.2.4) allows authenticated attackers with subscriber-level access to extract sensitive information from the web server's database. The vulnerability arises from improper escaping in the perform_plugin_search() AJAX handler, where esc_sql() output is mishandled by preg_replace(), permitting arbitrary SQL query injection. No public exploit or active exploitation reported; the patch is available in version 10.2.5.
Race condition in Xen's grant table version switching (v2 to v1) allows remote unauthenticated attackers to cause low confidentiality impact and denial of service under specific conditions. The vulnerability arises when hypervisor code drops and re-acquires the grant table lock during a version switch, creating a window where status frame properties can change inconsistently. No public exploit has been identified at time of analysis, and the CVSS network attack vector may be misleading as exploitation likely requires a guest domain to initiate the switch.
Race condition in Xen Grant Table version switching from v1 to v2 allows a malicious guest VM to cause low confidentiality impact and limited denial of service. The vulnerability occurs when hypervisor code drops and reacquires the grant table lock during the version transition, creating a window where reference counts become inconsistent. No active exploitation or public exploit code has been identified at time of analysis.
Information disclosure in Xen's vNUMA configuration handling allows low-privileged authenticated attackers to read sensitive guest data during domain destruction. A race condition between the device model retrieving configuration and the simultaneous cleanup of that data permits unauthorized access to memory layout or other confidential information. No public exploit is identified, and the vulnerability is not known to be actively exploited at this time.
Unauthenticated disabling of the ACME service in Dogtag PKI allows persistent denial of service via URL manipulation. By appending a trailing slash to admin-only enable/disable endpoints, an attacker can bypass the Tomcat authentication constraint while RESTEasy routes the request, enabling unauthorized toggling. No public exploit or active exploitation has been reported.
Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting in the Cozy Blocks plugin for WordPress allows authenticated attackers with contributor-level access to inject arbitrary scripts via the 'postMeta.font.size' block attribute. The script executes whenever a user views an infected page, potentially leading to session hijacking, defacement, or phishing. Versions up to and including 2.2.11 are affected; no active exploitation or public exploit has been reported.
Stored cross-site scripting in the Paid Memberships Pro WordPress plugin allows authenticated attackers with subscriber-level access to inject arbitrary web scripts via the readonly user field rendered by the [pmpro_member_profile_edit] shortcode. The vulnerability affects all plugin versions up to and including 3.8.1. Upon successful exploitation, injected scripts execute when any user accesses a page containing the malicious payload, potentially leading to session hijacking or other browser-based attacks.
HTTP request smuggling vulnerability in Rouille's proxy implementation allows remote attackers to desynchronize HTTP message boundaries using a CL.TE attack. Affected versions 0.3.3 through 3.6.2. Publicly available exploit code exists, but no active exploitation has been reported.
Stored cross-site scripting in Pivotick’s Markdown node-reference renderer allows JavaScript execution when a victim opens a crafted graph or note. The root cause is missing HTML escaping of attacker-controlled node names before interpolation into HTML attributes and element bodies. A patch is available from the vendor; no public exploit or active exploitation has been reported.
HTTP request smuggling in tiny-http versions through 0.12.0 allows remote attackers to desynchronize request processing between a front-end proxy and the vulnerable backend. By sending a Transfer-Encoding header with an arbitrary value, the library unconditionally switches to chunked decoding and discards the Content-Length, enabling request smuggling and connection exhaustion. Public exploit code exists, but active exploitation remains unconfirmed.
SMTP header injection in SuperPlane allows unauthenticated attackers to inject arbitrary SMTP headers via CRLF sequences in webhook event payload titles, enabling email spoofing (bypassing SPF/DKIM), content manipulation, and data exfiltration via Bcc. No public exploit identified at time of analysis; patch available in v0.30.0.
Header injection vulnerability in tiny-http through version 0.12.0 allows attackers to inject CRLF bytes into HTTP header values, enabling response splitting, cache poisoning, and session fixation. No active exploitation reported, but proof-of-concept code is publicly available in a GitHub repository. The library's insufficient validation of header values enables this injection primitive against line-feed-tolerant backends.
Payment response replay fraud in pretix-girosolution allows an unauthenticated network attacker to reuse a legitimate GiroCheckout payment confirmation from one order to fulfill multiple additional orders without payment, effectively obtaining valid event tickets at no cost beyond a single real transaction. The affected package pretix-girosolution versions prior to 1.0.1 fails to bind payment status responses to specific order identifiers, enabling this cross-order token reuse. No public exploit has been identified at time of analysis, and CISA KEV does not list active exploitation; however, the financial fraud potential makes this a priority for event operators relying on GiroCheckout.
SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the backend database via crafted network requests. The vulnerability affects all versions prior to the vendor-released patch identified in advisory TAN-2026-019. No public exploit code or active exploitation has been reported.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
An open redirect in the post-login redirect feature of an unspecified web UI allows unauthenticated remote attackers to trick users into visiting malicious websites, leading to potential credential theft and loss of service. The vulnerability has a CVSS score of 6.1 and is classified under CWE-601. No information about active exploitation, public exploits, or fixes is currently available.
Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.
Reflected cross-site scripting in the News Theme V8 WordPress theme by THEWP Digital Solutions up to version 16.06.2026 allows unauthenticated remote attackers to inject and execute arbitrary web script in a victim's browser. A user clicking a maliciously crafted link can lead to session hijacking, content spoofing, or redirection to harmful sites. No active exploitation or public exploit code has been identified.
Authentication bypass in Cosmos-Server 0.22.18 and earlier allows any holder of a valid Constellation device API key to impersonate any user (including admin) to backend applications by sending crafted x-cosmos-user headers. The tokenMiddleware prematurely returns before stripping these headers when the request originates from the Constellation tunnel, bypassing JWT authentication, MFA, and the AdminOnly access gate. Publicly available exploit code exists but no active exploitation has been reported.
Reflected cross-site scripting (XSS) in the Joomdle Joomla extension before version 3.1.1 allows remote attackers to inject arbitrary web scripts via the 'goto' URL parameter of the Moodle wrapper endpoint. When a victim clicks a crafted link, the attacker can execute script in the victim's browser, potentially stealing session cookies or performing actions on behalf of the user. The vulnerability requires user interaction and has no publicly known exploit code or active exploitation at this time.
Out-of-bounds read in libfsimage’s iso9660 directory walk allows local attackers with a crafted disk image to leak memory or crash the host when the image is mounted. The flaw arises from unvalidated record lengths read directly from attacker-controlled on-disk fields. No known active exploitation or public exploit code exists.
Improper input validation in the BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier, and 12.22.1 QF7 and earlier) enables unauthenticated remote attackers to trigger arbitrary file download operations and a potential denial of service condition against the console when a Management Console user interacts with attacker-influenced content. The CVSS 4.0 vector reflects high availability impact on the vulnerable system (VA:H) with residual integrity and availability effects on subsequently managed systems (SI:L/SA:L), though the vendor rates confidentiality impact as none (VC:N) - a notable discrepancy given the 'Arbitrary File Download' language in the description that warrants vendor clarification. No public exploit code or active exploitation has been identified; EPSS places this at the 11th percentile (0.21%) and SSVC independently assesses exploitation as none with a non-automatable attack path.
Improper TLS certificate validation in IBM TS4500 CLI tool versions 0.1.31 through 1.12.0.0 allows man-in-the-middle attackers to obtain sensitive information. The attack is remotely exploitable with high complexity but requires no authentication or user interaction. No public exploit or active exploitation has been identified at the time of analysis.
Information disclosure in alibabacloud-rds-openapi-mcp-server due to default exposure of MCP tools allows remote unauthenticated attackers to invoke tools via network access to a listener on all interfaces. No public exploit or active exploitation has been identified at the time of analysis, but the default configuration makes exploitation trivial for network-accessible instances.
Path traversal in Mattermost allows an admin user with SAML system-console write permissions to delete arbitrary files outside the intended directory, causing high availability impact. Affected versions include 10.11.x through 10.11.20, 11.6.x through 11.6.5, 11.7.x through 11.7.3, and 11.8.0. No public exploit is identified at time of analysis, but the required high privileges limit the immediate risk.
Denial of service in Xen libfsimage's iso9660 driver can be triggered by a local attacker mounting a crafted ISO image, crashing the Xen host. The vulnerability arises from insufficient validation of size and offset fields in Rock Ridge Continuation Entry (CE) records, leading to out-of-bounds memory access. Although the CVSS score is only 5.5 (Medium), the attack requires user interaction (mounting the ISO), and no patch version is specified in the provided data; active exploitation status is unknown.
Denial of service in libfsimage's iso9660 driver via crafted ISO image with a malformed Rock Ridge NM record entry length, causing crash of tools that use the library. Affects libfsimage from Xen Project; no public exploit or active exploitation identified.
Denial of service in the iso9660 driver of libfsimage when parsing Rock Ridge extensions. The vulnerability affects the Xen hypervisor's toolstack and potentially other software using this library. A crafted ISO image can trigger an infinite loop or memory corruption due to failure to validate record lengths, resulting in a crash. This issue is not known to be exploited publicly and requires local user interaction.
Integer underflow in the System Use area calculation of libfsimage's ISO 9660 driver allows denial of service via a crafted ISO image. An unauthenticated local attacker can cause the driver to crash when a user or process mounts or accesses a malicious ISO file, resulting in high availability impact. No active exploitation or public exploit has been identified at this time, and CVSS 5.5 with local attack vector and user interaction limits real-world risk.
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing a user to interact with malicious content. Exploitation requires user interaction and results in low confidentiality and integrity impact, with no availability loss. No public exploit or active exploitation is known; an official vendor patch is available.
Unauthenticated arbitrary file copy in the WordPress plugin Demi - One Click Demo Import, Backup & Site Migration (all versions up to and including 0.0.8) lets a remote attacker redirect file copies to a destination of their choosing inside the server filesystem, potentially exposing or relocating sensitive files. The flaw is conditional: the plugin only writes its .restore_key and .restore_step_token secrets into the world-readable wp-content/uploads/demi-backup-state/ directory while a restore or migration operation is actively running, so an attacker must time the request to that window, harvest the exposed key, and then forge a signed restore-state envelope to reach the unauthenticated handle_restore_step AJAX handler (CVSS vector PR:N, so no credentials are required). Risk is assessed as low-to-moderate: EPSS is only 0.32% (24th percentile), CISA SSVC records no known exploitation, and no public exploit code has been identified at time of analysis, with the active-restore prerequisite being the hard limiter.
Uncontrolled resource consumption in Apache Tomcat's default WebSocket chat example allows remote attackers to cause denial of service. Affected versions include 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120; users who have removed the examples web application as recommended are not impacted. No public exploit code or active exploitation is reported.
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.