Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.
Cross-project subnet mutation in OpenStack Neutron's subnetpool onboarding feature allows an authenticated tenant to modify subnets belonging to other projects, breaking multi-tenancy isolation. Affected releases span 2025.1/epoxy through the in-development 2026.2/hibiscus branch. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the multi-tenant nature of the affected deployments elevates real-world impact for shared cloud environments.
Arbitrary file read in the Vacron VIN-DS783E-E6 device allows authenticated remote attackers to download arbitrary files from the underlying system by abusing relative path traversal (CWE-23). Any user with valid low-privilege credentials can escape the intended file-serving directory and retrieve sensitive system files such as configuration, credential, or password stores. No public exploit identified at time of analysis; the CVSS 4.0 score of 7.1 reflects network reachability, low attack complexity, and high confidentiality impact without integrity or availability effects.
Denial of service in Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 lets any authenticated IMAP user crash the imapd process by sending a single SEARCH command containing deeply nested parenthesized groups. Because the SEARCH parser recurses without a depth limit and Courier enforces no command-line length cap, roughly 2500 nested parentheses exhaust the 8MB default stack and trigger a SIGSEGV. There is no public exploit identified at time of analysis, but the vendor commit and advisory describe exploitation as trivial, and it affects availability only (no data exposure or code execution).
SQL injection in Frappe's ERPNext (ERPNext 15.107.0, Frappe framework 15.107.2) lets an authenticated low-privilege user run arbitrary SQL by placing SQL metacharacters in the name (docname) of a Supplier record, which is later interpolated into a query via str.format() instead of being parameterized. Because the injected query runs with the application's database privileges, an attacker can bypass Frappe's DocPerm access controls and read data they should not see, including fragments of the administrator's password hash, stored credentials, integration tokens, and financial records. Per the CVSS 4.0 vector the flaw is network-reachable with low attack complexity and only low privileges (PR:L), and there is no public exploit identified at time of analysis.
Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Plaintext password storage in Streamsoft Business Intelligence (BI) exposes every user's credential in recoverable form within the application database, meaning anyone able to read the database obtains working passwords directly rather than hashes. The flaw (CWE-256) affects all versions prior to 6.8.0.0, where the vendor introduced proper storage and forced a password change on first login after upgrade. There is no public exploit identified at time of analysis and it is not in CISA KEV; impact is confidentiality of credentials, amplified by likely password reuse across systems.
Cluster-wide ingress denial of service in Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) lets a tenant holding only namespace-scoped Secret creation rights halt all ingress configuration changes across the entire cluster. Because the embedded KIC gathers CA-certificate Secrets from every watched namespace using only a label selector - with no ingress-class or namespace scoping - an attacker can plant a Secret whose user-controlled CA-certificate ID collides with an existing one, causing Kong Gateway to reject the whole configuration document. This is a missing-authorization (CWE-862) flaw reported by Kong; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cluster-wide ingress denial of service in Kong Kubernetes Ingress Controller (KIC) allows a tenant holding only namespace-scoped Secret creation rights to halt all ingress configuration changes across every watched namespace. Because KIC gathers CA-certificate Secrets by label selector alone - ignoring ingress-class and namespace boundaries - and derives the CA-certificate primary key from a user-supplied Secret field, a low-privileged user can create a duplicate CA-certificate ID that forces Kong Gateway to reject the entire configuration document. Reported by Kong; no public exploit identified at time of analysis and not listed in CISA KEV.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView 2027.0.0 exposes users to application crashes and sensitive memory disclosure when parsing maliciously crafted DWG or DXF files. Exploitation requires a local user to open a weaponized file, making social engineering the primary delivery mechanism targeting CAD operators in AEC and manufacturing environments. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at a negligible 0.12% (2nd percentile), and a vendor patch is available via ADSK-SA-2026-0009.
Missing authorization in MWDB Core's Remote Instances proxy API (versions >=2.2.0 to <2.19.0) lets an unauthenticated remote attacker relay arbitrary requests to a linked remote MWDB instance, executing them with the identity and permissions of the API key configured for that remote link. This effectively impersonates the API-key owner on the remote instance and enables unauthorized actions there. No public exploit identified at time of analysis; the flaw was reported by CERT-PL and is fixed in 2.19.0.
Access control bypass in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to defeat IP-based access restrictions, both on Unix Domain Socket (UDS) listeners and through faulty ACL matching logic. Because ATS commonly fronts internal origin servers and management endpoints, bypassing these IP allow/deny lists can expose protected backend resources that operators believed were network-restricted. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the fix is vendor-confirmed in the Apache advisory.
Request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to desynchronize the proxy from backend origin servers by sending malformed chunked-transfer-encoded messages, per Apache advisory and NVD. Successful exploitation lets an attacker poison caches, bypass access controls, or disclose another client's information as tagged by the reporting source. No public exploit identified at time of analysis and the flaw is not in CISA KEV.
Access control bypass in Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3 lets remote unauthenticated attackers subvert authorization enforcement at the proxy, tagged by Apache as an authentication bypass (CWE-284). Because Traffic Server acts as a caching/reverse proxy, the flaw's impact lands on backend systems it fronts rather than on the proxy process itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High).
Arbitrary code execution and denial of service in BlackBerry QNX Software Development Platform arises from the traceparser library (libtraceparser), where the decode() function fails to properly validate input from kernel trace event log (.kev) files. A local attacker who supplies a maliciously corrupted .kev file can crash - or potentially run code within - any host or target process that parses it with libtraceparser. Reported by BlackBerry with no public exploit identified at time of analysis; the CVSS 7.0 (AC:H, UI:R) reflects that exploitation requires a victim to process the attacker's crafted file.
Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.