SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements verbatim to the primary read-write siyuan.db handle via the /api/search/searchEmbedBlock endpoint. Because the endpoint is gated only by CheckAuth, it is reachable with the low-privilege publish RoleReader token - and by fully anonymous users when publish authentication is disabled - and the driver's support for stacked statements allows both reading and modifying content across all opened cleartext notebooks. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a critical 9.9 CVSS 4.0 score; it is fixed in v3.7.3.
SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.
Remote code execution in the 'Insert or Embed Articulate Content into WordPress' plugin (versions up to and including 4.3000000027) allows an Editor-level user to upload a server-executable file by defeating a weak archive-content check, then have the web server run it from a public directory. Publicly available exploit code exists (WPScan), and the flaw carries a critical CVSS 9.8; however, EPSS is only 0.21% (11th percentile) and SSVC lists exploitation status as 'none', indicating no confirmed in-the-wild activity yet. The attack is fully automatable with total technical impact once an Editor account is available.
Account takeover in the ChamaWP WordPress plugin before 1.0.13 lets unauthenticated attackers reset the password of any user, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password-reset request (CWE-862, missing authorization). Publicly available exploit code exists, though EPSS remains low (0.15%) and it is not listed in CISA KEV - no public in-the-wild exploitation confirmed at time of analysis.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so that arbitrary PHP runs as the web server user. The flaw lives in library/classes/Tree.class.php, where an attacker chains SQL execution to change the categories table id column to VARCHAR and store a PHP payload that a later unsanitized eval() executes every time any page - including unauthenticated and low-privilege ones - instantiates CategoryTree, turning a one-time admin action into a persistent server-wide backdoor. Publicly available exploit code exists (documented by VulnCheck and Jiva Security), and CVSS 4.0 is 9.4; no active exploitation is confirmed in CISA KEV at time of analysis.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the primary admin account by POSTing to the installer's admin-config-setup endpoint with an X-Requested-With: XMLHttpRequest header that defeats the CanInstall middleware redirect. Reported by VulnCheck with a publicly available exploit, it carries a 9.3 CVSS 4.0 and grants full control over all CRM data. There is no public exploit identified as actively exploited in CISA KEV, but working exploit code exists.
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.8. Because the registration routine never checks whether user creation actually succeeded before treating the returned value as a valid user ID, an unauthenticated attacker can trigger a failed user creation and cause the plugin to overwrite the existing admin account's data - notably the email address - then seize the account through the standard password-reset flow. A vendor patch (4.7.8) and publicly available exploit details from WPScan exist, though EPSS remains low at 0.14% (4th percentile), indicating no measured mass exploitation yet.
Authentication bypass in Telenia Software TVox (versions 24.x ≤24.9.21 and 26.x ≤26.5.3) lets remote unauthenticated attackers reach every PHP script under the manager HTML directory by appending '/login_admin.php' to any target script's path. The flaw stems from set_env.php trusting the client-controllable PHP_SELF value when deciding whether to skip authentication. Publicly available exploit code exists (KarmaInSecurity KIS-2026-14, reported by VulnCheck), but there is no CISA KEV listing, so treat it as no public active exploitation confirmed despite a ready POC.
Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0 through 4.4.5) allows unauthenticated network-reachable attackers to execute arbitrary OS commands by supplying a crafted filename argument to the ovpn-client.check_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor confirmed the vulnerability's existence, and a public proof-of-concept exploit is published on GitHub (StrTzz123/iot_vul), materially lowering the bar for exploitation. The CVSS 4.0 score of 8.9 with exploit maturity E:P reflects a high-priority, real-world risk of complete device compromise with no authentication or user interaction required.
Remote command injection in GL-iNet GL-MT3000 firmware through version 4.4.5 allows unauthenticated network attackers to execute arbitrary OS commands via crafted package name input to the plugins.install_package or plugins.remove_package functions exposed through the /cgi-bin/glc CGI endpoint. The CVSS 4.0 vector confirms no authentication, no complexity barriers, and full confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit is available on GitHub, no public exploit identified in CISA KEV at time of analysis, but the combination of unauthenticated network access and live exploit code makes this a high-urgency issue for any deployment with an internet-exposed management interface.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 exposes the device to full remote compromise through its modem management CGI endpoint. The vulnerable remove_profile function within modem.so accepts unsanitized input via /cgi-bin/glc, enabling arbitrary OS command execution without authentication. A public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier for opportunistic exploitation; no vendor-released patch has been confirmed at time of analysis.
Unauthenticated remote command injection in GL-iNet GL-MT3000 firmware (versions 4.4.0 through 4.4.5) allows network-adjacent or remote attackers to execute arbitrary OS commands by sending a crafted request to the /cgi-bin/glc CGI endpoint with a manipulated port argument passed to the s2s.enable_echo_server function. The vendor has confirmed the vulnerability, the CVSS 4.0 base score is 8.9 with full high-impact ratings across confidentiality, integrity, and availability, and a public proof-of-concept exploit is available on GitHub, materially lowering the exploitation bar. No public CISA KEV listing exists at time of analysis, but the combination of unauthenticated network access and a published PoC makes active exploitation a near-term realistic risk.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 allows remote attackers to execute arbitrary OS commands through the `set_upgrade` function exposed via the `/cgi-bin/glc` CGI endpoint in `modem.so`. The CVSS 4.0 base score of 8.9 (with E:P reflecting public exploit availability) reflects high confidentiality, integrity, and availability impact on the affected device. A public proof-of-concept exploit has been disclosed on GitHub and the vendor has confirmed the vulnerability's existence, making this an active remediation priority for any network exposing the GL-MT3000 management interface.
Remote command injection in GL-iNet GL-MT3000 firmware (up to version 4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands on the device by supplying a malicious public_key argument to the server.set_peer function exposed via the /cgi-bin/glc CGI endpoint of the WireGuard server native plugin (wg-server.so). The vendor has confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation. No publicly confirmed KEV-listed active exploitation is identified at time of analysis, though the combination of unauthenticated network access, high-impact command execution, and available POC makes this an urgent remediation priority for any deployment.
Remote command injection in the GL-iNet GL-MT3000 travel router (firmware 4.4.0-4.4.5) allows unauthenticated network-adjacent or internet-exposed attackers to execute arbitrary OS commands by supplying a maliciously crafted `private_key` argument to the WireGuard server public key generation endpoint at `/cgi-bin/glc`. The vendor has confirmed the vulnerability, and a public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of PR:N attack profile and public POC warrants urgent remediation on any internet-exposed device.
Remote command injection in GL.iNet GL-MT3000 routers (firmware 4.4.0-4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands by supplying crafted shell metacharacters in the Hostname argument to the ovpn-client.get_recommend_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor has confirmed the vulnerability's existence, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the exploitation barrier. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the PR:N/UI:N posture combined with a live PoC makes opportunistic exploitation against internet-exposed travel routers a credible near-term risk.
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.
Authentication bypass in the SoftMarket - Digital Marketplace WordPress plugin (versions through 1.0.0) lets remote unauthenticated attackers impersonate any verified user by supplying only that user's numeric ID to a flawed branch of the email-verification flow, resulting in full account takeover. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Despite the critical rating, the EPSS probability is low (0.19%, 9th percentile) and there is no evidence of active exploitation.
Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitrary SQL through an unsanitised, unescaped user-supplied value used directly in a database query. Publicly available exploit code exists (published by WPScan), and CISA's SSVC assessment rates the flaw as automatable with total technical impact, though the EPSS probability remains low at 0.18%. A vendor patch is available in version 7.9.3.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
Injection vulnerability in GL-iNet GL-MT3000 (Beryl AX) firmware through version 4.4.5 exposes the plugins.set_config function via /cgi-bin/glc to remote exploitation with no authentication or user interaction required per the CVSS 4.0 vector. Successful exploitation yields high confidentiality, integrity, and availability impact on the device, consistent with OS command or argument injection against the native plugin handler. A proof-of-concept exploit is publicly available on GitHub and the vendor has confirmed the vulnerability, though no patch has been released at time of analysis.
OS command injection in ClearOS 7.9's Log Viewer component allows authenticated attackers to execute arbitrary commands as the webconfig user and immediately escalate to full root access via default NOPASSWD sudo privileges. The vulnerable parameter (`filter`) in `File.php` is interpolated directly into a shell command without sanitization, making exploitation trivial once credentials are obtained. A public proof-of-concept exploit is available via lazytitan.ro and documented by VulnCheck; no CISA KEV listing is present, so confirmed widespread active exploitation has not been established at time of analysis.
OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized `pid` parameter in `action_audio.php`. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the `apache` system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale.
HttpTransferCache key collision in Angular's Server-Side Rendering subsystem enables cache poisoning by exploiting identical serialization of scalar comma-separated query parameters and semantically distinct repeated query parameters against the same endpoint. Angular SSR applications using client-side hydration across versions 20.x, 21.x, and 22.x - and 19.x with no available patch - are at risk of having security-sensitive HttpClient responses silently replaced by earlier attacker-influenced cached responses, bypassing trusted backend authorization calls entirely. Vendor patches 22.0.2, 21.2.19, and 20.3.27 are confirmed available; no public exploit code and no CISA KEV listing exist at time of analysis.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
Certificate path building in python-cryptography before 49.0.0 is exploitable as a denial-of-service vector by attackers who can supply crafted X.509 chains containing duplicate self-signed intermediate certificates. The Rust-based `build_chain_inner` function explores issuer candidates recursively without deduplicating previously analyzed entries, causing computational work to grow exponentially with the number of duplicates present - empirically exceeding 5 seconds per rejection in testing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the fix shipped in 49.0.0 bounds path-building via a global signature-check budget.
Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
OpenEMR through 8.2.0 exposes an OAuth2 password grant pathway that fully bypasses multi-factor authentication for any user with valid credentials, because the unauthenticated dynamic client registration endpoint allows an attacker to mint a first-party OAuth2 client and exchange legitimate credentials for an API access token without triggering the MFA challenge enforced on the normal web login interface. Any organization using OpenEMR's MFA controls to protect sensitive patient health information (PHI) is exposed: the control is structurally bypassed at the OAuth2 layer regardless of how MFA is configured in the web UI. A detailed public proof-of-concept writeup from JivaSecurity documents the full exploit flow, confirmed by VulnCheck advisory; no KEV listing has been observed at time of analysis.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Unauthenticated OAuth2 dynamic client registration in OpenEMR through 8.2.0 allows any network attacker to self-register a malicious OAuth2 client with system-level FHIR scopes by supplying a self-generated RSA keypair in the jwks field, bypassing all access controls on a critical endpoint. Once an OpenEMR administrator approves the registered client - a step that healthcare staff routinely perform for EHR interoperability integrations - the attacker authenticates via the client_credentials grant using a self-signed JWT and obtains access tokens covering all FHIR resources across every patient in the system. A publicly available proof-of-concept exploit and technical writeup from JivaSecurity confirm the attack chain; this CVE is not currently in CISA KEV but carries an 8.6 CVSS 4.0 score and exposes PHI at scale.
SQL injection in the LogMyTrip WordPress plugin (≤1.9) lets unauthenticated remote attackers extract data from the underlying WordPress database by injecting malicious SQL through an unsanitized cookie value on any page rendering a plugin shortcode. A proof-of-concept is publicly available via WPScan, and the CVSS Scope:Changed rating reflects the injection crossing the application boundary into the database tier. Despite high CVSS (8.6) and a public exploit, EPSS sits at 0.19% (9th percentile) and SSVC records no observed exploitation, suggesting limited real-world targeting consistent with this plugin's niche footprint.
Privilege escalation in Telenia Software TVox allows any process running as the apache OS user to obtain full root-level command execution without a password, by exploiting a misconfigured vendor-supplied sudoers entry in /etc/sudoers.d/telenia that grants NOPASSWD execution of /bin/nice. Affected branches are 26.x up to and including 26.5.3, and 24.x up to and including 24.9.21. A public exploit is available via KarmaInsecurity advisory KIS-2026-16; no CISA KEV listing has been confirmed, though the trivial exploitation complexity and available proof-of-concept materially elevate real-world risk for any environment where the TVox web tier is reachable.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.
SQL injection in the sm page duplicator WordPress plugin (versions through 1.0.0) allows authenticated users holding the Editor role or above to execute arbitrary SQL against the WordPress database by exploiting an unsanitized stored value consumed during the page duplication workflow. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) signals limited observed exploitation activity and the vulnerability is not listed in CISA KEV. The high CVSS score of 8.1 reflects the potential for full database read and write access, tempered in practice by the requirement for a privileged authenticated account.
Command injection in the GL.iNet GL-MT3000 router's Network Lua RPC Plugin allows authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `switch` argument of the `network.switch_info` or `network.switch_status` RPC methods. Firmware versions 4.4.0 through 4.4.5 are confirmed affected, with the vendor acknowledging the vulnerability following coordinated disclosure. A public proof-of-concept exploit has been published on GitHub (E:P reflected in the CVSS 4.0 vector), no public exploit identified as confirmed actively exploited (CISA KEV), though the low complexity and available PoC materially lower the bar for exploitation.
Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion in Node.js applications that use Address4 classification methods to block internal destinations. The library decodes leading-zero octets as decimal (e.g., '012' → 12) while system resolvers interpret the same notation as octal (e.g., '012' → 10), causing Address4.isPrivate() and related methods to return false for RFC 1918 addresses expressed in octal shorthand, while the underlying fetch connects to the private host. A functional proof-of-concept is included in the vendor advisory; no CISA KEV listing is present at time of analysis, but exploitation requires no special configuration and rides the ordinary URL-parsing code path.
Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0-4.4.5) allows an authenticated network attacker to execute arbitrary OS commands by manipulating the `module` argument of the `logread.get_system_log` RPC function in the Logread Lua plugin. The vendor confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub. No publicly available exploit confirms CISA KEV-level active exploitation at time of analysis, though the combination of a PoC and a widely used consumer router creates meaningful opportunistic risk.
Cross-site scripting in the Angular compiler's i18n pipeline allows arbitrary JavaScript injection into localized application builds when event-handler attributes such as `onerror` or `onclick` are marked for translation using `i18n-on*` template directives. Angular's standard `validateAttribute()` and `validateProperty()` guards block binding to event-handler attributes at runtime, but the `I18nMetaVisitor` code path in `packages/compiler/src/render3/view/i18n/meta.ts` contained no equivalent restriction, enabling a lower-trust translation file to replace a benign handler with executable JavaScript at compile time. Patched versions 22.0.1, 21.2.19, and 20.3.27 are available; no public exploit has been identified at time of analysis.
Command injection in GL.iNet GL-MT3000 firmware versions 4.4.0 through 4.4.5 allows an adjacent, low-privileged attacker to execute arbitrary OS commands by manipulating the `record_size` argument in the `logread.set_config` RPC function of the Logread Lua plugin. A proof-of-concept exploit has been publicly released on GitHub, and the vendor confirmed the vulnerability exists following early disclosure. While not yet listed in CISA KEV, the combination of low attack complexity, public exploit code, and full high-impact confidentiality/integrity/availability compromise makes this a credible and actionable risk for any network where GL-MT3000 devices are deployed.
Remote denial-of-service in the brace-expansion npm library (all active version lines prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9) allows unauthenticated attackers to either crash the Node.js process via an uncatchable out-of-memory error with a ~25 KB crafted input, or stall the event loop for over two minutes with a ~400 KB padded-sequence input. Both attack paths bypass the incomplete mitigation introduced in version 5.0.8 for CVE-2026-14257, meaning applications that already patched that predecessor vulnerability remain fully exposed. Publicly available proof-of-concept code is included in the GitHub security advisory; no CISA KEV listing is present at time of analysis.
Memory exhaustion via malformed binary attachment packets in the socket.io-parser npm library allows unauthenticated remote attackers to crash or hang Socket.IO servers. By sending crafted packets that declare a large number of pending binary attachments, an attacker causes the server's Decoder to allocate and hold buffers indefinitely, exhausting Node.js heap memory. The vendor advisory (GHSA-2m8v-j782-fhvr) confirms the impact and vendor-released fixed versions are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
Out-of-bounds heap read in aiohttp's C HTTP response parser (versions ≤ 3.14.2) allows an attacker-controlled server to crash the client application via a malformed chunked HTTP response, causing denial of service. The flaw exists only when the compiled C extension is active - the default installation mode - and is triggered during error-message construction in aiohttp/_http_parser.pyx when the llhttp error-position pointer is materialized as a raw pointer rather than a bounded offset into the Python bytes buffer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Privilege escalation in Razer RzUpdateService 1.10.14.0 allows a local low-privileged user to gain SYSTEM-level access by manipulating the lpThreadParameter argument processed by the service's Named Pipe Handler. The service, which runs at elevated Windows privilege, fails to enforce proper privilege boundaries when handling named pipe input (CWE-269), enabling a local user to leverage the service's execution context against the underlying system. A public proof-of-concept is confirmed available; the vulnerability is not currently listed in CISA KEV, though the low attack complexity combined with the published POC elevates real-world risk in environments with Razer hardware deployed.
SSRF classification bypass in the ip-address npm library (versions 10.1.1-10.2.1) allows network-accessible applications to be deceived into treating internal IP addresses as external. When a caller-supplied CIDR suffix such as /0 is retained during parsing, the isInSubnet() guard short-circuits before any bit comparison, causing every special-use classifier - isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), and others - to return false for internal addresses, while correctForm() still resolves to the real internal target. A publicly available proof-of-concept is included in the GHSA advisory; no CISA KEV listing exists at time of analysis, so active exploitation is not confirmed.