Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects authenticated network attackers (PR:L per CVSS). The CWE-126 flaw allows an authorized attacker to corrupt memory and execute arbitrary code within the browser process over a network channel. No active exploitation is confirmed (not listed in CISA KEV, SSVC exploitation=none), and EPSS of 1.00% at the 59th percentile reflects above-median but still modest real-world exploitation probability.
Remote code execution via use-after-free in Microsoft Excel affects multiple product lines including Microsoft 365 Apps for Enterprise, Excel 2016, and Office 2019/LTSC 2021/LTSC 2024. An unauthenticated remote attacker can exploit this memory corruption flaw by convincing a target user to open a specially crafted Excel workbook, resulting in arbitrary code execution under the context of the victim process. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, no-privilege network attack vector makes it an attractive phishing payload candidate.
JSON-LD signature validation in Misskey's ActivityPub federation layer accepts fraudulent federated activities due to a TOCTOU flaw where the JSON-LD parsing context used during signature verification is not shared with the context used during subsequent message processing. Affected are all self-hosted Misskey instances running versions 12.37.0 through 2026.5.3. A remote, unauthenticated attacker operating or spoofing a federated server can craft payloads that pass signature checks yet resolve to malicious content during processing, resulting in high integrity impact across the instance and potentially propagating to federated peers; no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthenticated network attacker via a missing authorization check (CWE-862), requiring only that the victim interact with attacker-controlled content. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact with no privilege requirement, though user interaction is necessary. No active exploitation has been confirmed by CISA KEV, and SSVC currently rates exploitation status as none, suggesting this has not yet been weaponized at scale despite its serious technical impact classification.
Uncontrolled decompression in Apache NiFi 1.5.0 through 2.10.0 exposes the REST API to unauthenticated denial-of-service attacks via crafted gzip payloads. The Jersey encoding filter enforces its configurable size limit against the compressed form of the request body rather than the decompressed output, enabling a classic zip-bomb condition that can exhaust JVM heap memory. No public exploit has been identified at time of analysis, but the CVSS 4.0 supplemental metadata flags the attack as automatable (AU:Y) with Amber utility, indicating meaningful real-world risk against organizations with network-accessible NiFi REST API endpoints.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.
Stored cross-site scripting in OpenEMR's patient portal template system (through version 8.2.0) allows authenticated administrators to inject persistent JavaScript payloads that execute in the browsers of any admin, clinician, or portal patient who views a poisoned template. The combination of absent output encoding at the template retrieval endpoint and missing HttpOnly attributes on session cookies enables direct document.cookie exfiltration, resulting in full session hijacking of privileged healthcare accounts. No public exploit identified in CISA KEV, but a publicly available proof-of-concept and detailed researcher writeup (VulnCheck / jivasecurity.com) significantly lower the bar for exploitation in targeted scenarios.
Unauthenticated path traversal in OpenWrt's luci-app-bmx7 package exposes arbitrary files on affected routers via the bmx7-info CGI endpoint. Attackers can supply directory traversal sequences in the CGI query string to escape the configured runtimeDir and read any file readable by the CGI process, including credentials, network configuration, or cryptographic keys stored on the device. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated network attack vector (CVSS 4.0: 8.7) presents a low barrier to opportunistic exploitation against exposed management interfaces.
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the `days` query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (VA:H, PR:N, AC:L) reflects that this is a trivially reachable denial-of-service with no authentication barrier.
Path traversal in Grav CMS versions before 2.0.11 enables authenticated editors to disclose arbitrary server-side files to unauthenticated visitors through the image watermark feature. The function ImageMedium::watermark() forwards unsanitized editor-controlled input to the resource locator, whose file:// scheme handler normalizes paths using only lexical '..' collapsing - never verifying containment within the media sandbox - so a crafted Markdown image directive causes the CMS to composite a traversed file into a cached image served at a public, unauthenticated URL. No public exploit has been identified at time of analysis; however, the high confidentiality impact and ease of exploitation once editor access is obtained make this a priority patch for multi-tenant Grav deployments with untrusted editors.
Uncontrolled memory allocation in Bouncy Castle for Java's HSS public-key parser allows remote unauthenticated attackers to exhaust JVM heap memory by supplying a crafted public key with an arbitrarily large HSS level count (L value), causing denial of service during signature verification. All three product lines are affected: bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FIPS (bc-fja) before 2.0.2/2.1.3 depending on series. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the AV:N/AC:L/PR:N attack profile and Bouncy Castle's ubiquity as a Java crypto dependency make this a credible availability risk for any service accepting external HSS/LMS key material.
Authentication bypass in Admidio's forum module before version 5.0.11 enables unauthenticated network-accessible attackers to read private forum topics and posts that administrators intended to restrict to logged-in members. The flaw stems from `modules/forum.php` failing to validate the login-only configuration state before serving content, meaning a direct HTTP request with read-only parameters is sufficient to circumvent the access gate. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, but the mechanistic simplicity of the bypass - a direct module access with no authentication - means exploitation requires minimal skill once a vulnerable, login-only-configured instance is located.
CPU exhaustion in Bouncy Castle for Java allows remote attackers to cause denial of service by supplying X.500 distinguished name attribute values densely packed with RFC 4514 special characters or leading/trailing spaces. The root cause is a quadratic-time O(n²) escaping algorithm in `IETFUtils.valueToString()` that inserts backslashes into the buffer being actively scanned - triggerable through `X500Name.toString()`, `.equals()`, or `.hashCode()`, methods commonly invoked during TLS certificate and LDAP DN processing. No public exploit has been identified beyond the vendor's own regression test, and this vulnerability is not listed in CISA KEV, though the CVSS 4.0 score of 8.7 with AV:N/PR:N signals meaningful exposure for Internet-facing Java services.
Memory exhaustion denial-of-service in Bouncy Castle's DTLS implementation allows remote unauthenticated attackers to crash or degrade Java applications by sending crafted handshake messages with inflated 24-bit length fields. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bctls-fips) before 1.0.24, 2.0.24, or 2.1.24 depending on the deployed branch. The buffer allocation occurs pre-authentication during the DTLS handshake reassembly phase - before any signature or Finished verification - making this exploitable without credentials against any exposed DTLS endpoint. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Uncontrolled recursion in Bouncy Castle for Java's lazy ASN.1 parser enables remote unauthenticated denial of service across all three library release lines (bc-java, bc-lts-java, and bc-fja FIPS). When a LazyEncodedSequence is forced during tree traversal, it resets the nesting-depth guard to its configured maximum instead of continuing with the remaining depth budget, allowing crafted deeply-nested ASN.1 structures to bypass StreamUtil's recursion limit and trigger a StackOverflowError. No public exploit has been identified at time of analysis, but any Java application accepting externally-supplied ASN.1 data - TLS certificates, CMS signatures, PKCS structures - is potentially exposed without authentication.
Heap exhaustion via uncontrolled memory allocation in Bouncy Castle for Java's MLS wire decoder allows remote unauthenticated attackers to crash any application using the bc-java MLS module. The MLSInputStream.readOpaque() method decodes an attacker-supplied Varint length field (up to 0x3FFFFFFF, approximately 1 GiB) and allocates that buffer before verifying the input stream actually contains that many bytes; a handful of concurrent few-byte crafted messages can exhaust the JVM heap. No public exploit has been identified at time of analysis and CISA KEV listing is absent, though the attack is trivially constructable from the published patch and regression test.
Out-of-memory denial-of-service in Bouncy Castle for Java allows remote unauthenticated attackers to crash Java applications by submitting a crafted ASN.1 definite-length object with an inflated declared size. The ASN.1 parser in `DefiniteLengthInputStream.toByteArray()` allocated a full heap-sized byte array before reading any body bytes, meaning a few-byte header claiming a near-JVM-heap payload was sufficient to trigger OOM. All major Bouncy Castle release lines are affected - including the FIPS-certified BC-FJA variant - and a vendor patch is available; no public exploit code or CISA KEV listing exists at time of analysis.
Bouncy Castle for Java's OpenPGP session-key decryption path re-exposes the Mister-Zuccherato adaptive-chosen-ciphertext oracle by failing to suppress the legacy CFB 'quick check' on the PKESK/session-key route, enabling an attacker with decryption oracle access to recover plaintext from SEIPD v1 encrypted messages. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bcpg-fips) across the 1.0.X, 2.0.X, and 2.1.X series - three distinct product lines used broadly in enterprise and open-source Java applications. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack technique is well-established in cryptographic literature dating to the Mister-Zuccherato paper.
CPU exhaustion in Bouncy Castle for Java's MLS (Messaging Layer Security) implementation allows a network attacker to trigger unbounded HKDF key-derivation iterations by supplying a crafted 32-bit generation counter in an MLS message. The hash-ratchet in GroupKeySet.get(int generation) advances one HKDF step per skipped generation without any upper bound, so a maximally crafted counter forces up to ~4.29 billion derivation steps on the receiving process. Scored CVSS 4.0 at 8.7 with High availability impact and no authentication prerequisites per vendor scoring; no public exploit code or KEV listing has been identified at time of analysis.
Unbounded recursion in Bouncy Castle's OER (Octet Encoding Rules) parser enables remote unauthenticated denial-of-service against any Java application processing IEEE 1609.2 V2X messages. Because the IEEE 1609.2 schema is cyclic - an Ieee1609Dot2Data structure can nest inside its own SignedData payload - a few kilobytes of crafted input drive the parser into unbounded recursive descent, terminating in a JVM StackOverflowError. Critically, parsing occurs before signature verification, so no authentication or trust relationship is needed to trigger the crash. No public exploit has been identified at time of analysis, but the patch commit exposes two additional heap-exhaustion vectors alongside the primary recursion flaw, all reachable from the same pre-verification code path.
Memory exhaustion in Bouncy Castle for Java's OpenPGP parser enables unauthenticated remote denial of service via a crafted User Attribute subpacket with an oversized length header. All Java applications importing untrusted OpenPGP certificates using bc-java before 1.85, bc-lts-java before 2.73.12, or BC-FJA (FIPS) in affected series are vulnerable to pre-authentication JVM heap exhaustion. No KEV listing or public exploit has been confirmed at time of analysis, but the zero-complexity unauthenticated network attack vector and CVSS 4.0 score of 8.7 signal high operational priority for services that accept OpenPGP certificates from external sources.
CCMBlockCipher in Bouncy Castle for Java decrypts ciphertext directly into the caller-supplied output buffer before verifying the authentication tag, leaving unverified CTR-decrypted plaintext in memory when tag verification fails and violating NIST SP 800-38C §6.2. Every edition - bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across three active release lines (1.0.x, 2.0.x, 2.1.x) - is affected. Applications that reuse pooled byte buffers, log failure-path output, or otherwise expose the buffer on an authentication failure inadvertently become CTR decryption oracles, allowing attackers to submit forged ciphertexts and recover plaintext without possessing a valid authentication tag. No public exploit and no CISA KEV listing exist at time of analysis.
RSA PKCS#1 v1.5 signature forgery is possible in Bouncy Castle for Java (bc-java before 1.85, bc-lts-java before 2.73.12) when the DigestInfo encoding omits the NULL AlgorithmIdentifier parameter. The off-by-two bytes in the RSADigestSigner comparison loop allows any forged signature whose DigestInfo matches all bytes except the final two of the message hash to pass verification as valid, achieving a high-integrity bypass. No public exploit has been identified at time of analysis, but the public patch commit includes a step-by-step test demonstrating the exact forgery technique, substantially lowering the bar to exploitation.
Cross-nonce AEAD forgery in Bouncy Castle for Java's KCCMBlockCipher (DSTU 7624 CCM mode) allows an attacker with chosen-plaintext oracle access to forge valid authenticated ciphertext under an un-queried nonce when no associated authenticated data is present. All bc-java releases before 1.85 and bc-lts-java releases before 2.73.12 are affected. The G1 initialization block - which binds the nonce into the MAC under the DSTU 7624:2014 standard - was conditionally skipped when no AAD bytes were supplied, leaving the authentication tag independent of the nonce and breaking the core AEAD security guarantee. No public exploit has been independently released and this vulnerability is not listed in CISA KEV, though the fix commits include a working regression test that fully demonstrates the forgery technique.
Signature bypass in Bouncy Castle for Java allows any attacker-supplied content wrapped in a zero-signer CMS envelope to pass `CMSSignedData.verifySignatures()` without any valid cryptographic signature. The method iterates an empty signerInfos SET, falls through to a vacuous `return true`, and any application using it as its top-level authenticity check silently accepts unsigned attacker-controlled content as authenticated - a classic fail-open flaw (CWE-347). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is trivially constructible using any standard CMS/PKCS#7 library.
Signature forgery via back-dated signingTime in Bouncy Castle's S/MIME validator allows an attacker holding a revoked or expired signing certificate to have that certificate accepted as valid by unpatched validators. The SignedMailValidator in bc-java before 1.85, bc-lts-java before 2.73.12, and all bc-fja (FIPS) lines before their respective 1.0.7/2.0.7/2.1.7 fixes unconditionally used the signer-asserted CMS signingTime attribute as the PKIX path-validation date, making certificate expiry and revocation checks bypassable. No public exploit or CISA KEV listing exists at time of analysis, but the flaw is architecturally straightforward to exploit by any party that holds or has previously held a Bouncy Castle-validated signing certificate.
OpenPGP inline-signature policy enforcement in Bouncy Castle for Java silently discards rejection exceptions, causing signatures that use prohibited weak hash algorithms (MD5, SHA-1, RIPEMD-160) or otherwise violate the configured OpenPGPPolicy to be reported as cryptographically valid. Affected are bc-java before 1.85 and bcpg-fips (bc-fja) before 2.0.13; the detached-signature and prefixed-signature verification paths are not affected - only the inline one-pass path. A vendor patch is available; no public exploit code has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects a high integrity impact driven by the unauthenticated network vector.
CMS AuthEnvelopedData decryption in Bouncy Castle for Java fails to enforce a minimum AEAD authentication tag length, allowing a network attacker to supply a crafted CMS message carrying a truncated AES-GCM/CCM ICV (e.g., 32 bits instead of the standard 128 bits), effectively reducing the authentication space to the point where tag forgery becomes computationally feasible. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and all bc-fja (FIPS) 1.0.x/2.0.x/2.1.x series before their respective .12 patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with VI:H reflects the high integrity impact of bypassing authenticated encryption guarantees.
OpenPGP AEAD decryption in Bouncy Castle for Java silently bypasses the final authentication tag when plaintext is an exact multiple of the AEAD chunk length, allowing an attacker who can tamper with ciphertext to strip trailing plaintext chunks and have the truncated message accepted as cryptographically authentic. Affected libraries span bc-java before 1.85, bc-lts-java before 2.73.12, and all three active BC-FJA FIPS series before their respective bcpg-fips 1.0.13, 2.0.13, and 2.1.13 releases. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 (Integrity: High) reflects a complete and silent bypass of AEAD integrity guarantees for chunk-aligned messages with no downstream exception or warning.
IESEngine in Bouncy Castle for Java allows cross-message MAC forgery when stream mode is used with static key pairs, affecting bc-java before 1.85 and bc-lts-java before 2.73.12. The flaw stems from a length-dependent KDF output split: in the static-key path (no ephemeral V component), the MAC key K2 was placed at a byte offset equal to the message length after the keystream K1, so an observer of one known-plaintext encryption can recover K2 and forge valid ciphertext-plus-tag pairs for shorter messages. No public exploit beyond the vendor's own proof-of-concept regression test exists, and no CISA KEV listing is present at time of analysis.
CMS AuthenticatedData integrity verification in Bouncy Castle for Java is bypassable when authenticated attributes (authAttrs) are present, allowing an attacker to substitute arbitrary content while the recipient MAC check passes without error. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA across the 1.0.x, 2.0.x, and 2.1.x series - all widely deployed in Java enterprise and FIPS environments. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VI:H) reflects unauthenticated remote exploitation with high integrity impact; no public exploit or CISA KEV listing is confirmed at time of analysis.
Cross-site scripting in @angular/platform-server's domino DOM emulation library allows attackers to inject executable script blocks into SSR-rendered HTML by supplying closing-tag sequences inside user-controlled data bound to <iframe>, <noembed>, <noframes>, or <noscript> Angular template elements. Angular 20.x through 22.x applications using Server-Side Rendering that reflect user input into these specific fallback raw-content elements are affected; Angular 19.x and earlier receive no backport patch. No public exploit has been identified at time of analysis, though the mechanism is straightforward once the vulnerable application pattern is present, and patches are available across three supported Angular branches.
Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.
DLL hijacking in Zucchetti FirmaCheck for Windows before 1.3.16 allows local low-privileged attackers to achieve arbitrary code execution at the privilege level of the FirmaCheck startup process. FirmaCheck.exe loads OpenSSL configuration from the unvalidated path C:\Program Files (x86)\Common Files\SSL\ without verifying the integrity or ownership of the directory; an attacker who can write to this location may plant a crafted openssl.cnf referencing an attacker-controlled DLL, which is then loaded automatically when FirmaCheck runs at system startup. No public exploit code or active exploitation has been identified at time of analysis; exploitation is reported by VulnCheck and is bounded by the local access requirement.
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.
Endress+Hauser FDI Package Library versions 1.00.00 through 2.01.00 exposes a CWE-427 (Uncontrolled Search Path Element) flaw in its iDTM FDI component, allowing a locally privileged attacker to activate the debug interface by dropping a crafted file into the application directory. Successful exploitation grants unauthorized access to connected industrial field devices, enabling data exfiltration, configuration manipulation, or operational disruption. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for elevated privileges and local host access - significantly limiting the realistic attack surface.
Path traversal in SiYuan's attribute-view read endpoints allows low-privileged users to read arbitrary JSON files outside the intended storage directory on versions before v3.7.3. The avID parameter is unsanitized across all code branches, enabling RoleReader-level authenticated users - or anonymous clients when publish authentication is disabled - to exfiltrate cross-scope database content stored as JSON on the server filesystem. No public exploit has been identified at time of analysis, and a vendor patch is available in v3.7.3.
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor on a multivendor marketplace to overwrite product attributes and default attributes belonging to other vendors via the plugin's REST API write endpoints. Exploitation requires only a low-privilege vendor account - no admin access needed - making this accessible to any registered seller on the platform. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited observed exploitation activity so far; the vulnerability is not listed in CISA KEV.
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to modify the status of arbitrary WooCommerce orders across the entire marketplace, including orders owned by other vendors and customers. The flaw stems from a REST endpoint handling bulk order-status changes that accepts attacker-supplied order IDs without verifying the requesting vendor's ownership of those orders. No active exploitation is confirmed (not in CISA KEV), but a publicly available proof-of-concept exists and EPSS at 0.13% (3rd percentile) reflects low observed exploitation to date.
ProfileGrid WordPress plugin before version 6.0.0.0 exposes pending group membership request data to any authenticated user due to missing authorization checks on the listing endpoint. Any subscriber-level account can enumerate the names and request timestamps of users awaiting approval for any group, including groups configured as private. No active exploitation is confirmed (not in CISA KEV), though a public exploit exists via WPScan; EPSS of 0.13% (3rd percentile) places real-world exploitation probability as very low.
GEO my WP WordPress plugin versions before 4.5.5.3 allows any subscriber-level (or higher) authenticated user to modify or permanently delete geolocation records belonging to other users or posts by supplying arbitrary record IDs to two unprotected AJAX actions. The root cause is a complete absence of ownership and capability checks on these endpoints, a textbook CWE-639 IDOR. A publicly available exploit exists per WPScan; however, no public exploit identified at time of analysis corresponds to confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.13% at the 3rd percentile reflects low observed exploitation activity despite POC availability. A vendor-released patch is available in version 4.5.5.3.
Shared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and managed devices by any attacker who extracts those certificates from a single unit. The CVSS 4.0 vector (AV:A/PR:N/VC:H/SC:H) confirms that an unauthenticated attacker with adjacent network access to the Omada management plane can intercept management communications at high confidentiality impact across both the vulnerable and subsequent systems, with no patch complexity required beyond certificate possession. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, though the authentication-bypass tagging and the breadth of affected product lines (gateways, switches, access points, controllers, OLTs) give this meaningful real-world weight in environments relying on Omada for network management.
Origin validation bypass in Microsoft Edge (Chromium-based) enables a remote, unauthenticated attacker to circumvent Same-Origin Policy protections, resulting in unauthorized cross-origin access to sensitive data. The flaw (CWE-346) affects all versions of Chromium-based Edge and carries a vendor CVSS of 8.1 with both high confidentiality and high integrity impact - the latter is notable given the description characterizes this as an information disclosure issue, a discrepancy that warrants verification against the MSRC advisory. No public exploit code exists and the vulnerability is not listed in CISA KEV; Microsoft has released an official patch.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.
XML Signature Wrapping in Net::SAML2 before 0.86 allows any party holding a single valid IdP-signed assertion to authenticate as an arbitrary user against Perl applications that use this SAML SP library. Identity fields - NameID, attributes, SessionIndex, audience - are extracted via document-wide XPath queries selecting the first matching element in document order, not the element covered by the verified signature; an attacker who prepends an unsigned forged assertion to a Response containing their own legitimate signed assertion bypasses identity verification entirely while the signature check still passes. A vendor-released patch exists in version 0.86, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.
SQL injection in Z-BlogPHP 1.7.5 enables authenticated low-privilege attackers to execute arbitrary SQL commands against the underlying database via the unsanitized `id` parameter in the CommentBat feature. Successful exploitation yields high-severity confidentiality and integrity impact - including extraction of password hashes, user data, and arbitrary record manipulation - with no availability impact indicated. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 5th percentile, suggesting limited real-world exploitation activity despite the high CVSS score.