Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a low-privileged, remote authenticated attacker to abuse improper access-control checks (CWE-284) to reach functionality or data intended for higher-privileged roles, with full confidentiality, integrity, and availability impact (CVSS 9.9, scope changed). The flaw was discovered internally by Cisco during a proactive hardening review and shipped as part of a consolidated software-hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SD-WAN Manager is the central orchestration plane for an entire SD-WAN fabric, successful abuse can cascade beyond the compromised component to the managed network.
Authentication bypass in mrswapnilsahu's Stock-Inventory-Management-System (PHP) lets an unauthenticated remote attacker log in as any user by injecting SQL through the login form. The login.php script concatenates raw POST username/password into the auth query (CWE-89) and also ships hardcoded admin credentials (admin/neola), giving two independent full-bypass paths. No public exploit identified at time of analysis, though the trivial ' OR '1'='1 payload is described directly in the disclosure.
Missing authentication in IoTSharp's BlobStorageController lets unauthenticated remote attackers reach Upload, Download, List, Modify, and Delete blob endpoints that every other controller (Devices, Customers, Tenants) guards with [Authorize]. Because the path and filename parameters are written to disk without sanitization, attackers can traverse outside the blob directory to read, alter, or delete arbitrary files - and drop a webshell into a web-accessible path for remote code execution. No public exploit identified at time of analysis, but the combination of unauthenticated access and a clear RCE path makes this trivially weaponizable.
Unauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in the server process by creating a malicious "calc rule". The POST /calc-rule/create endpoint omits the AuthToken guard applied to other routes, and the supplied script field is later passed unsandboxed to quick_js::Context::eval(), giving full script execution once triggered. CVSS is 9.8; no public exploit identified at time of analysis, though the flaw is trivially reachable and the root cause is confirmed by source-level reference.
Out-of-bounds heap/stack write in nanoMODBUS through v1.23.0 lets an unauthenticated network client corrupt memory in the Modbus server via a single crafted Read File Record (FC 0x14) request. The server-side handle_read_file_record() function validates per-request and per-sub-request sizes but never checks the cumulative response size, and a uint8_t accumulator (response_data_size) silently overflows, allowing swap_regs() to write up to ~8490 bytes past the 260-byte receive buffer. There is no public exploit identified at time of analysis, but the flaw yields reliable denial of service and, on embedded/bare-metal targets lacking memory protection, potential remote code execution.
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker circumvent password verification and run queries as any named user, including administrators. Because impersonation extends to admin-level accounts, an attacker gains full read/write control over the database and its data. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and admin-impersonation impact make this a critical, network-reachable flaw.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Missing authentication in the NASA-AMMOS ANMS reference implementation exposes the amp-manager REST API (CivetWeb, port 8089) directly on the host network, allowing any network-reachable client to command DTNMA agents without credentials. Because the shipped docker-compose.yml publishes the port and bypasses the CAM authentication gateway, unauthenticated remote attackers can enumerate agents, submit arbitrary EXECSET command sets to them, and clear stored reports. No public exploit identified at time of analysis; the flaw affects the reference/testbed implementation rather than onboard spacecraft flight software, though managed agents may represent real ground or space nodes depending on deployment.
Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the disclosure is a bundled hardening advisory, the exact injection sink and affected feature/protocol are not specified, so the concrete attack surface is not confirmed from available data.
SQL injection in the Inventory-Management-System-PHP application (Harsh21Patel GitHub project) allows unauthenticated attackers to fully bypass authentication and destructively manipulate the product database. login.php concatenates raw POST email/password into its query, so a payload like email=' OR 1=1 LIMIT 1-- - logs in as the first user, while delete.php runs a DELETE on an unsanitized GET id parameter with no auth check, enabling arbitrary row deletion and blind SQLi. No public exploit identified at time of analysis, though the advisory itself publishes working payloads; the flaw carries CVSS 9.8 and is not listed in CISA KEV.
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.
Authentication bypass and database exfiltration in Miantang's IoT-PHP application via SQL injection in the login handler. The POST /userlogin route in index.php concatenates the unsanitized $_POST['pwd'] value directly into a MySQL query, letting an unauthenticated attacker log in as any user with a payload like pwd=' OR '1'='1 and use UNION-based injection to read arbitrary database contents. No public exploit identified at time of analysis, though the technique is trivial and well-documented; no EPSS or KEV data was supplied.
Authentication bypass and data exfiltration in IOTSmartHome's login component allow an unauthenticated attacker to submit a base64-encoded SQL injection payload via the lastLogin cookie, defeating login checks and reading arbitrary database contents including user credentials. The checkCookie() function in gui/login.php decodes the client-supplied cookie with URL-safe base64 (safe_decode()) and concatenates the result directly into a SQL query without sanitization. No public exploit is identified at time of analysis, but the trivial injection path (base64("' OR '1'='1")) and network reachability make weaponization straightforward.
Authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server allows unauthenticated remote attackers to impersonate the aerie_admin role because the authorization middleware trusts a session_variables object supplied in the request body over the Authorization header JWT. An attacker who submits {"session_variables":{"x-hasura-role":"aerie_admin"}} to POST /command-expansion/put-expansion can insert arbitrary expansion rules that govern how spacecraft activities are translated into commands, and POST /put-dictionary is separately whitelisted for unauthenticated writes. Rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Arbitrary-address memory write in the nanoMODBUS Modbus client library (through v1.23.0) allows a malicious or compromised Modbus server to corrupt the memory of any client that issues a Read Device Identification request. The flaw stems from an unchecked server-supplied object_id used as an array index, ultimately steering a strncpy() destination pointer with attacker-controlled data - a condition that typically leads to remote code execution or crash on embedded/IoT clients. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the assigned CVSS is 9.8, though exploitation requires the victim client to communicate with an attacker-controlled server.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
Denial-of-service (NULL pointer dereference) in the open62541 OPC UA server v1.5.5 lets remote attackers crash the server by sending an AddReferencesRequest whose target uses an empty targetServerUri combined with a non-zero targetNodeId.serverIndex; the server's AddReferences handler fails to validate this non-local ExpandedNodeId case, leaving the target node pointer NULL while execution continues and dereferences it. Publicly available exploit code exists (SSVC exploitation: poc); it is not listed in CISA KEV and EPSS is low at 0.27% (19th percentile). Note that although the input CVSS is scored 9.8 with full C/I/A impact, the underlying flaw class (CWE-476) is consistent with a crash/DoS rather than confidentiality or code-execution impact.
Authentication bypass in the My Safetipin Android application version 5.2.1 stems from hardcoded credentials in the authentication module that produce predictable OTP values, letting remote attackers log in as arbitrary users and take over accounts without legitimate credentials. Any personal-safety data stored in a victim's account - location history, safety pins, and profile details - becomes exposed and modifiable. No public exploit has been identified at time of analysis, and the EPSS score of 0.27% (18th percentile) reflects low observed exploitation activity despite the maximal CVSS rating.
Predictable Fernet encryption key generation in IBM Langflow OSS (versions 1.0.0 through 1.10.3) stems from the ensure_fernet_key() function deriving keys from a cryptographically weak source (CWE-338), letting an attacker reconstruct the symmetric key that protects stored secrets such as API keys, credentials, and connection variables. Because the key is guessable rather than random, an actor who can read Langflow's encrypted data store can decrypt it and, depending on how the key is reused, potentially forge or tamper with protected values. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), but IBM rates the flaw CVSS 9.8 and a vendor patch is available.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Heap-based buffer overflow in lib60870-C 2.4.0 affects the server-side FileSegment ASDU encoding path, where FileSegment_encode() checks only the standalone segment length via FileSegment_GetMaxDataSize() but never verifies remaining capacity in the current ASDU frame before writing object fields and segment data. In IEC 60870-5-101/104 telecontrol servers using the library's file transfer functionality, this out-of-bounds heap write can corrupt memory, enabling denial of service and potentially remote code execution. There is no public exploit identified at time of analysis, and the flaw is tracked upstream as issue #201 against the current 2.4.0 release.
Insecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library, allowing an attacker who can supply crafted serialized data to a Lucy-backed application to corrupt reconstructed object state and potentially achieve code execution or logic abuse during deserialization. Because Apache Lucy is retired, the ASF has explicitly declined to ship a fix, so exposure is permanent for any deployment still using it. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Kernel memory corruption in the Linux IPsec IP-TFS/AGGFRAG (xfrm iptfs) receive path allows crafted or normal traffic arriving on an IPTFS tunnel to corrupt kernel memory and panic affected hosts (introduced in Linux 6.14, fixed in 6.18.42, 7.1.6 and 7.2-rc4). Because iptfs_skb_add_frags() fails to propagate the SKBFL_SHARED_FRAG flag when copying page-pool-backed shared frags, a subsequent nested transport-mode esp_input() takes the no-COW fast path and decrypts in place over pages still referenced by the outer SKB. There is no public exploit identified at time of analysis and EPSS is low (0.15%), consistent with the narrow, non-default configuration required.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Heap buffer overflow in libXfont2's font-server client allows a malicious or compromised font server to overflow the X server's heap with attacker-controlled content by sending overlapping glyph source offsets. Affected systems running X server as root are exposed to privilege escalation; unprivileged X server instances crash with denial of service. All libXfont2 versions prior to 2.0.9 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attacker-controlled write primitive makes this a high-severity memory corruption issue.
Unauthenticated SQL injection in Rongzhitong Visual Integrated Command and Dispatch Platform (all versions through build 20260617) exposes the `/dm/dispatch/user/findAll` endpoint to remote database manipulation via the unsanitized `Name` parameter. A publicly available exploit has been published, and the vendor has not responded to responsible disclosure, meaning no patch exists. With CVSS 4.0 AV:N/PR:N and a live exploit, any internet-exposed deployment is at immediate risk of data extraction or modification.
SQL injection in ESAFENET CDG's USB key login endpoint allows remote unauthenticated attackers to manipulate backend database queries through the unvalidated `keyid` parameter at `/CDGServer3/ukey/usbkey;logindojojs`. All CDG versions up to build 20260615 are affected per CPE data, with impacts spanning limited database read and write access. A public exploit is available (E:P per CVSS 4.0 vector), the vendor has not responded to disclosure, and no patch has been released - leaving all deployed instances exposed with no vendor-confirmed remediation path.
SQL injection in Shandong Hoteam PDM Product Data Management System (versions up to 8.3.10) allows unauthenticated remote attackers to inject arbitrary SQL commands via the `FilterString` parameter of the `GetStoredClassByFilter` function exposed through the `/Base/BaseService.asmx/DataService` ASMX web service endpoint. A public exploit has been disclosed via a Feishu document, elevating real-world risk despite the moderate CVSS 4.0 score of 5.5. The vendor did not respond to responsible disclosure, meaning no patch is available and no remediation timeline exists.
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious prototype across the isolation boundary into preload script context, bypassing context isolation in versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. Exploitation is conditional on preload scripts accepting object arguments from untrusted content and reading inherited properties without own-property guards. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the scope-change (S:C) CVSS metric reflects that a successful attack crosses the renderer-to-preload privilege boundary, which can have amplified consequences in apps that expose sensitive Node.js APIs through the bridge.
External protocol handler bypass in Electron allows sandboxed iframes to launch OS-registered external applications, circumventing iframe sandbox enforcement in all Electron versions below 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. The root cause is that Electron's HandleExternalProtocolInUI function in electron_browser_client.cc failed to inspect WebSandboxFlags before processing external protocol navigation requests, and critically did not forward the frame's sandbox state to the app's permission handler - so even a custom handler could not make an informed allow/deny decision. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack is network-deliverable with no authentication required against apps relying on Electron's default permission configuration.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.
Stored XSS in the WP Custom HTML Page WordPress plugin (≤0.6.2) enables users with the Author role to persist arbitrary JavaScript via an unsanitized custom page handler, which then executes for every visitor - including administrators - at a publicly accessible URL. The plugin fails both to sanitize HTML input and to enforce WordPress's native unfiltered_html capability restriction, effectively granting Author-level users a privilege they should not have. A publicly available exploit is documented by WPScan; EPSS (0.15%, 5th percentile) indicates no observed widespread opportunistic exploitation, though the public-URL delivery mechanism means admin-targeted attacks require no active phishing.
Backdoored firmware in Zbtlink routers ships ENDLESSDOORS, an embedded implant (librctl.so, based on the open-source ycsunjane/rctl tool) present in every published build across the product line, granting unauthenticated remote root code execution. Started at boot as root and masquerading as a kernel [kworker/*] thread, it beacons every ~35 seconds over cleartext, unauthenticated TCP to a hardcoded command-and-control server, passing any received command to popen() as uid=0 and offering an interactive root shell via a reserved 'rctlbash' command. Because the channel has no authentication or encryption, control is not restricted to whoever planted it - anyone who answers at the C2 address, hijacks the network path (DNS/route), or registers the hardcoded fallback domain obtains root; no public exploit is identified in the input and there is no CISA KEV listing, though the underlying rctl tooling is publicly available open-source code.
Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Electron's window.open() features string parsing forwards untrusted BrowserWindowConstructorOptions directly to child BrowserWindows without an allowlist, allowing renderer-side web content to supply privileged options - such as icon - that cause the trusted main process to access attacker-chosen file or network paths. All Electron apps serving untrusted web content without a setWindowOpenHandler guard are affected across the 39.x, 40.x, 41.x, and 42.x beta series. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the practical attack surface is narrowed to apps that load third-party or user-controlled content and omit the recommended setWindowOpenHandler override.
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).
Unauthenticated IDOR in the DHL Shipping Germany for WooCommerce WordPress plugin (versions before 4.0.1) exposes every generated shipping label to any internet visitor. The plugin's label-download endpoint performs no authorization check whatsoever - no capability check, nonce, login requirement, or order-ownership verification - and labels are indexed by predictable sequential IDs, enabling trivial full enumeration. A publicly available exploit exists; successful exploitation leaks customer full names, complete postal addresses, and order references at scale, carrying significant GDPR implications for any German e-commerce operator running the affected plugin.
Out-of-bounds heap read and write in libXfont2's font server client (all versions prior to 2.0.9) allows a malicious or compromised network font server to corrupt X server heap memory, enabling privilege escalation when the X server runs as root or denial of service via crash in unprivileged configurations. The flaw arises because fs_read_glyphs() in src/fc/fserve.c allocates the encoding[] array based on num_extents from one protocol reply but indexes it using num_chars from a separate reply with no cross-validation, so a crafted server can send mismatched values to trigger OOB heap reads and attacker-controlled OOB heap writes. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is confirmed in libXfont2-2.0.9.
Hardcoded shared Bluetooth authentication key in KARR BT and DR-100 dealer-installed automotive anti-theft systems allows any attacker within Bluetooth range to issue unauthorized commands to affected vehicles without credentials. Exploitation requires only physical proximity and basic Bluetooth tooling, enabling door unlocking and engine immobilization on any unit sharing the static key. No public exploit or CISA KEV listing has been identified at time of analysis, but the hardcoded key class of vulnerability (CWE-321) is well-understood and trivially reversible once discovered.
Account takeover in Flarum forum software before 1.8.16 lets remote unauthenticated attackers reuse expired password reset tokens by POSTing them directly to the reset endpoint, bypassing the 24-hour token lifetime that is only enforced when the reset form is rendered. Because SavePasswordController::handle() calls PasswordToken::findOrFail() with no expiry check, anyone holding a stale-but-still-existing token can set a new password and log in as that user. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Rancher's authorization (SAR) impersonation middleware lets an authenticated user holding only the default 'user' global role forge Impersonate-User and Impersonate-Group HTTP headers (e.g. impersonating cluster-admin or the system:masters group) to obtain full administrative control of the Rancher control plane and, transitively, every downstream cluster it manages. The flaw stems from the middleware trusting client-supplied impersonation headers instead of the authenticated identity in the request context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix in rancher/rancher PR #55983 and advisory GHSA-v584-7w32-jwpq confirm the root cause and remediation.
Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to abuse improper symbolic-link resolution (CWE-59) to read, overwrite, or destroy files outside intended boundaries, with a scope-changing impact that reaches beyond the vulnerable process. The flaw was found during Cisco's internal SD-WAN security review and remediated in hardening releases; it carries a CVSS 9.1 rating driven by network reach, low complexity, and high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high base score and management-plane exposure make it a meaningful patching priority.
Credential brute-forcing against Typemill CMS (versions up to and including 2.25.0) is possible because its primary password-login endpoint (POST /tm/login, ControllerWebAuth::login()) implements no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled - the default state. Any unauthenticated attacker can submit unlimited password guesses against any account, including administrators, enabling account takeover of weakly-protected credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthorized data modification in the Easy Post Submission plugin for WordPress (all versions through 2.3.0) lets unauthenticated attackers overwrite the title, content, excerpt, categories, tags, and publication status of any existing post by supplying its postId to a public AJAX endpoint. Because the rbsm_submit_post action is registered for logged-out users with no capability check, an anonymous request can silently rewrite or unpublish arbitrary site content, an integrity- and content-availability-focused flaw scored CVSS 9.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds write in the LINUXTCP demo port of FreeModbus (cwalter-at fork) lets a remote, unauthenticated attacker overflow the static aucTCPBuf receive buffer by sending a single crafted Modbus TCP (MBAP) frame. Because the xMBPortTCPPool() length validation uses a strict '>' instead of '>=' against the 263-byte MB_TCP_BUF_SIZE, a frame declaring Length 264 passes the check and recv() writes 7 bytes past the buffer into the adjacent usTCPBufPos variable, corrupting parser state. CVSS is 9.1 (I:H/A:H); there is no public exploit identified at time of analysis and it is not on CISA KEV.